Peekroom

Privacy Policy

The short version

  1. 1We collect only what we need to run Peekroom: your account, your rooms and files, and basic records of how rooms are used.
  2. 2Payments go through Stripe. We never see card or bank details.
  3. 3Your files are stored in the EU and our server is in Finland. A few providers we use are outside the EU, under EU safeguards.
  4. 4No advertising, no analytics trackers and no selling of data. We only use cookies needed to sign in, remember your language and open rooms.
  5. 5You can ask to see, correct, export or delete your data at any time: hello@peekroom.art.
Contents
  1. 1Who is responsible
  2. 2What data we collect
  3. 3Why we use it and on what legal basis
  4. 4Who processes data for us
  5. 5Transfers outside the EU
  6. 6Cookies
  7. 7How long we keep data
  8. 8Your rights
  9. 9Security
  10. 10Children
  11. 11Changes to this policy
  12. 12Contact

01Who is responsible

The controller of your personal data is Peekroom, Portugal. Contact: hello@peekroom.art. This policy covers the Peekroom app (app.peekroom.art), the rooms we host and our website (www.peekroom.art).

When a brand buys from a creator, the creator is the seller and decides how to use the buyer’s details for that sale. Stripe also processes payment data as its own controller, under its privacy policy.

02What data we collect

From creators:

  • Account: name, email, studio name, language and how you sign in. With Google we receive your name, email and profile picture.
  • Sessions: the IP address and browser of each signed-in session, to keep you signed in and protect the account.
  • Payments: the ID and status of your Stripe account and of your subscription. Stripe collects your identity and bank details directly. We do not receive them.
  • Content: the files you upload, room titles and descriptions, the brand name and email you enter, prices, watermark settings and your sales.
  • Access tokens for AI assistants and the API: we keep only a hash, plus when they were created and used.

From brands and other visitors of a room:

  • Room views: when a room or file was opened, linked to a random session ID in a cookie. No name or email.
  • Wrong access codes: a one-way hash of the IP address that changes every day, to stop guessing.
  • Purchases: the email entered in the Stripe checkout, the amount and the payment status. We use it to send the download email and show the sale to the creator.

From anyone who writes to us: name, email and message, and a daily hash of the IP address to stop spam.

Technical logs: our server records requests (including IP address and browser) to keep the service secure and fix errors.

03Why we use it and on what legal basis

  • To provide Peekroom: your account, rooms, previews, payments, downloads and service emails. Basis: contract (GDPR art. 6(1)(b)).
  • To bill subscriptions, the founder pass and extra storage, and keep accounting records. Basis: contract and legal obligation (art. 6(1)(b) and (c)).
  • To keep Peekroom secure: limits on sign-ups, codes and messages, fraud and abuse prevention, logs. Basis: legitimate interest in a safe service (art. 6(1)(f)).
  • To understand how Peekroom is doing: internal notices to our team about sign-ups, plan changes, published rooms and sales. Basis: legitimate interest in running the business (art. 6(1)(f)).
  • To answer your messages. Basis: legitimate interest, or contract if you are a customer.
  • To meet legal requests and defend our rights. Basis: legal obligation or legitimate interest.

We do not use your data for advertising, we do not sell it and we do not make automated decisions about you that have legal effects. We do not use your content to train AI models.

04Who processes data for us

We use these providers. Each one only gets what it needs for its job:

  • Stripe: payments, Stripe accounts of creators, subscriptions and invoices. Stripe Payments Europe (Ireland), with data also processed in the United States.
  • Hetzner: the server that runs the app and the database, in Finland (EU).
  • Cloudflare: storage of the files (R2, EU jurisdiction) and hosting of the website www.peekroom.art.
  • Resend: sending emails such as sign-in codes, sale notices and download links. United States.
  • Google: sign-in with Google, only if you choose it. Our support inbox also runs on Gmail, so messages you send us are stored there.
  • Telegram: internal notices to our team. Sign-up and plan notices include the creator’s email and studio name. Room notices include the room title, brand name and price. Sale notices include the room and the amount, but not the buyer. Error alerts have personal data masked.

05Transfers outside the EU

Some providers (Stripe, Resend, Google, Telegram) may process data outside the European Economic Area, mainly in the United States. In those cases the transfer is covered by an adequacy decision, such as the EU-US Data Privacy Framework, or by the European Commission’s standard contractual clauses.

06Cookies

We only use cookies that are needed for Peekroom to work, so we do not ask for consent. We use no analytics or advertising cookies.

  • Session cookie (better-auth.session_token): keeps you signed in.
  • peekroom_lang: remembers the app language. 1 year.
  • pr_s_<room>: lets a brand stay inside a room after entering the code. 30 days.
  • pr_lang_<room>: remembers the language chosen in a room. 1 year.

Stripe sets its own cookies on its checkout and billing pages, and on the payments page of the app, to prevent fraud.

07How long we keep data

  • Account data: while your account exists. After you ask us to delete it, we delete it, except what we must keep by law.
  • Files: as long as the room keeps them under your plan. On the Free plan, files are deleted when a room closes (30 days after publishing). If a brand bought the room, files stay until its 30-day download period ends.
  • Sales and invoices: as long as accounting and tax law requires (in Portugal, usually 10 years).
  • Room views and security records: they hold no names, emails or readable IP addresses. We keep them only as long as they are useful for room statistics and security.
  • Messages to us: as long as needed to answer and follow up.
  • Server logs: for a short period, to keep the service secure.

08Your rights

Under the GDPR you can ask us to:

  • show you the data we have about you (access);
  • correct it (rectification);
  • delete it (erasure);
  • give it to you in a machine-readable format (portability);
  • stop or limit some uses, including those based on legitimate interest (objection and restriction).

Write to hello@peekroom.art. We answer within one month. If you are a brand and your request is about a purchase, we may also forward it to the creator, who is the seller.

You can also complain to the Portuguese data protection authority, the CNPD, or to the authority in your country.

09Security

Files sit in private storage and are only reachable through links that expire in minutes. Originals are only available after payment. Access codes are stored with a hash and encryption, and IP addresses in security records only as a daily hash. Only the people who run Peekroom can access the systems.

10Children

Peekroom is not for anyone under 18. We do not knowingly collect data from children. If you think a child has given us data, write to us and we will delete it.

11Changes to this policy

We may update this policy. The date at the top shows the latest version. For important changes we will tell you by email or in the app.

12Contact

Peekroom, Portugal. Email: hello@peekroom.art. You can also use our contact form.