Privacy Policy

This Privacy Policy explains how Canva Austria GmbH (“we”) collects, uses and protects your personal data when you use the Lush Shadow website and service.

Data controller

Canva Austria GmbH, Ungargasse 37/BT1/3.3, 1030 Vienna, Austria. Email: team@lush-shadow.com.

1. What we collect

• Account data: name, email address, phone number.
• Uploaded images: the photos you submit for processing.
• Payment data: handled by our payment processor; we receive only confirmation and transaction reference.
• Usage data: IP address, browser type, device type, log timestamps.
• Cookies: see our Cookie Policy.

2. How we use information

• To provide the Service and process your images (Art. 6(1)(b) GDPR — contract).
• To process payments and prevent fraud (Art. 6(1)(b) and (f) GDPR).
• To comply with legal obligations such as tax and accounting (Art. 6(1)(c) GDPR).
• To improve the Service and detect abuse (Art. 6(1)(f) GDPR — legitimate interest).

3. Data security

We use TLS encryption in transit, encrypted storage at rest, and strict access controls.

4. Data retention and deletion

Uploaded images are deleted within 24 hours after processing unless you ask us to delete them sooner. Account data is kept for the duration of the contract and for statutory retention periods thereafter (up to 7 years for accounting records).

5. Third parties

We do not sell your data. We share data only with vetted processors (hosting, payment, email, analytics) under data processing agreements, and with authorities where required by law.

International transfers

Where processors operate outside the EEA, transfers are protected by Standard Contractual Clauses and supplementary measures as required by GDPR.

6. Your rights

You have the right to access, rectify, erase, restrict and port your data, and to object to processing. You may lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at). To exercise your rights contact