Privacy information

The controller name, address and verified contact details are still pending. These technical disclosures are therefore not yet a final approved Article 13 GDPR notice.

LittleGarden does not publish invented operator or privacy contacts. Until a private support channel is verified, do not send photos or personal information through public channels.

For the closed beta, LittleGarden uses Supabase to process email address, verification and session data, an internal user ID, locale, and available, reserved and consumed concept credits.

If a user voluntarily chooses Google sign-in, Google and Supabase receive the identity and redirect data required for OAuth. LittleGarden requests only the standard identity profile.

One-time project-package checkout remains disabled until named people approve price, VAT and refund terms, the payment account and these privacy disclosures. Once activated, the customer is redirected to Stripe for payment; Stripe processes payment-method, billing and transaction data under its own or the contractually agreed roles.

LittleGarden stores only the internal order ID, package version, locale, Stripe Checkout and PaymentIntent identifiers, expected and confirmed gross EUR amount, status, receipt link, refund amount, granted/used/revoked credits and timestamps. Card, bank, billing-address and complete webhook data are not stored in the product database. Signed webhooks are reduced to bounded identifiers and a content digest.

Internal project-package history is visible in Account, included in the data export and removed on account deletion. Payment and security evidence at Stripe may follow legal or contractual retention duties; exact roles, legal basis and periods remain part of the human payment and privacy approval before activation.

Beta measurement is off by default and starts only after voluntary consent in Account. It uses no analytics cookies, browser advertising identifier, photos, result images, location fields or free-text garden notes.

After consent, LittleGarden stores the internal user ID, locale, named garden-journey steps and bounded categories such as style, goal, budget, maintenance and space type. A random attempt key controls duplicates and is not persisted in the browser.

Withdrawing in Account stops new collection and deletes previously stored beta-funnel events. Without withdrawal, a protected daily cleanup deletes events after 90 days; account deletion also removes consent and events.

After opting into beta measurement, a customer can optionally submit two 1-to-5 ratings, up to three fixed improvement categories and separate contact permission for a beta interview after a concept. Feedback includes a random concept key, concept ID, rendering class and locale, but no photo, free-text brief, location field, model name or comment. It remains until account deletion; interview contact permission can be withdrawn in Account at any time.

The exact legal basis, controller details and consent wording require human privacy review before production activation. The server-side measurement switch remains disabled until then.

The paid expert-review pilot remains disabled until named experts, service scope and target, commercial terms, refund path and access rules are approved. Once activated, one review is bound to exactly one saved project and immutable concept version.

An assigned expert receives through LittleGarden only the relevant brief, saved source version, prior review reports and a short-lived image link. Other projects, payment data and direct customer contact details are not disclosed. LittleGarden stores assignment and service timestamps, bounded display qualification, structured findings, correction advice, escalation and refund-review status until account deletion.

Reports remain an immutable provenance chain and do not automatically overwrite the customer plan. Professional review is not a structural, legal, toxicity or installation guarantee. Exact legal basis, processing roles, expert confidentiality and retention require human review before the pilot.

Saving, private sharing and beta analytics do not publish a project. The inspiration gallery requires a separate explicit acceptance of the current publication-consent version. The person separately selects one before photo and one exact saved concept version; existing projects are never enrolled automatically.

LittleGarden creates a metadata-free WebP copy of the before photo and a separate copy of the generated result in private moderation storage. The public snapshot contains only a display alias, general goal, style and space type, and the numeric concept estimate. Project or generated prose, product reasons, account ID, email, location, notes, measurements, retained-object text and private project or storage paths are not returned publicly.

A human moderation decision is required before display. Owners can unpublish, which ends public access immediately and removes gallery image objects. Bounded report, consent and moderation evidence remains private until account deletion.

Referral links contain a visible random code. Server-side attribution is stored only after sign-in and voluntary activation of the existing beta analytics consent. LittleGarden keeps no anonymous referral click log, uses no advertising cookie, and stores no photo, brief, IP address or user agent in attribution rows. Moderation and consent policy require human approval before activation.

A partner code in a campaign URL is initially retained only in browser session storage. Without sign-in and voluntary beta analytics, LittleGarden sends no partner attribution to the server and keeps no anonymous click log.

After consent, an attribution contains only account ID, random pilot code, versions, locale, dedupe key and time. It contains no IP address, user agent, photo, brief, project or free text. Withdrawing beta analytics deletes partner-pilot attribution immediately.

Pilot definition, catalogue version, support and cost evidence remain internal. Without a separately approved basis, a partner receives no customer-level data and at most receives an approved aggregate report above a defined minimum cohort. The partner, terms, reporting threshold and data policy require human approval before activation.

The selected original photo stays in the browser for preview. Before real generation, the browser creates a smaller generation copy. LittleGarden sends that copy and the garden brief through its server to the AI service selected for the deployment: the OpenAI Images API or the paid Google Gemini API. The actual recipient is shown before submission.

The selected original stays in the browser. LittleGarden stores the optimized generation copy in private object storage and the bounded garden brief and result in a private generation job so the design can resume after a browser interruption. Input and its source path are cleared at terminal settlement. Customer access expires and automatic deletion of the generation copy, brief, result and job becomes due within 24 hours. If technical deletion repeatedly fails, the content remains inaccessible, deletion is retried daily and the condition is reported as an operational incident until removal is confirmed. Account deletion starts an earlier final private-file sweep.

OpenAI states that API data is not used for training unless the customer explicitly opts in. By default, abuse-monitoring logs may contain customer content and may be retained for up to 30 days; Zero Data Retention has not been verified for the LittleGarden account and is therefore not claimed.

Google states that content submitted to paid Gemini API services is not used to improve its products. LittleGarden opts out of state storage in the stateful Interactions API; Google may still log content for a limited period to detect abuse. LittleGarden does not claim an approved Zero Data Retention configuration.

For generation attempts, LittleGarden stores user ID, a random idempotency key, request purpose, status, time and a bounded failure code. After separate approval it also stores provider route, model, prompt, planner and catalogue versions, estimated route cost and bounded provider latency. A further separate approval may add a server-owned offer code, a link to a failed predecessor attempt and provider cost reconciled in EUR. Invoice identifiers, invoice documents and provider responses are not stored in the product database for this purpose. Those provenance and economics fields are cleared after 90 days; the minimum credit audit remains until account deletion. Photos, free-text notes, prompt content and complete requests are not part of those records.

For distributed attempt limits, a network address is transformed server-side with a secret into an HMAC-SHA-256 value; the raw address is not stored in the LittleGarden database. Counter rows older than 48 hours are pruned during new admissions.

Vercel, as hosting infrastructure, processes connection and request information required to serve the application. Exact production-log retention must still be verified in the deployment account and added to the final notice.

Depending on the legal conditions, data subjects may have rights of access, correction, erasure, restriction, portability and objection, and the right to complain to a data-protection authority.

Signed-in customers can use Account to download the currently stored account, project-package, expert-review, inspiration-publication, referral, partner-pilot, beta-measurement and structured-feedback data as JSON, unpublish work, withdraw optional measurement and interview contact permission, request a recovery link, and schedule permanent account deletion after a fresh sign-in and explicit confirmation. It completes within a few minutes after a final private-file sweep.

HMAC network counters that cannot be linked to an account are pruned within 48 hours. Security and infrastructure logs at Supabase, OpenAI, Google and Vercel follow the providers' published or contracted retention rules.

The verified privacy and support contact will be added before beta. Until then, LittleGarden cannot receive requests through a contact confirmed on this page; this remains a launch blocker.