1. Controller
Næve Utvikling og Media (organisation number 927 824 043 MVA), Trondheim, Norway, is the data controller for steambanner.com. Contact: patrick@nightmarestudios.net.
2. What we collect and why
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Google account: name, email, profile picture, Google user id | Sign-in, showing your account, receipts | Contract | Until you delete your account |
| Uploaded images and the brief you type | Rendering your sheet; sent to the image model for that request | Contract | Our servers hold the files in memory for the request only and never write them to storage. The image model provider may retain what it received for up to 30 days for abuse monitoring (see section 4). The brief text is stored with your sheet so refines and re-rolls work |
| Steam store URL and the public data on that page (name, description, tags, header, screenshots) | Building the brief and the reference set | Contract | Fetched at request time; the URL and text stay with your sheet |
| Generated images: sheets, previews, banners, kits | Showing your work in your account, downloads, refining | Contract | Until you delete them or your account |
| Credit balance, ledger, order ids and amounts | Running credits, accounting, tax | Contract; legal obligation (bookkeeping) | Orders 5 years (bookkeeping law); ledger while the account exists |
| IP address, a random device id cookie, timestamps of free previews | Free-preview limits and abuse prevention | Legitimate interest (keeping the free tier alive) | Device id cookie 180 days; IP counters for the calendar month, removed after 45 days of inactivity; the IP on a sheet record is cleared after 30 days |
| Server logs (request path, status, timing, error text) | Reliability and security | Legitimate interest | Up to 30 days at our hosting provider |
We do not run advertising trackers or analytics that profile you. We do not sell personal data.
3. Cookies
- Session cookies from our sign-in library, so you stay logged in. Essential.
- sb_device: a random identifier that lets us recognise a returning browser so the free preview stays one per person. Every free render costs us money, so without it the free tier could not exist; we treat it as strictly necessary for a service you asked for, and it is set only when you request a free render. It carries no personal data, is not shared with anyone, and lasts 180 days (long enough to cover a typical launch cycle; shorter would let the limit be reset by waiting a few weeks).
- No marketing or third-party tracking cookies.
4. Who receives your data
Two kinds of recipients. Processors act only on our instructions under data-processing terms. Independent controllers (Google for the sign-in itself, Polar as the merchant that sells you the credits) process what you give them under their own privacy policies. Your images and prompt go only to the image model, and only for the duration of a render.
| Recipient | Role | What for | Where |
|---|---|---|---|
| OpenAI | Processor | Image generation. Receives your prompt text, your reference images and Steam images for the duration of a request. | United States |
| Independent controller | Sign-in. Provides your name, email address and profile picture. | Global | |
| Vercel | Processor | Hosting and request logs. | EU / United States |
| Turso | Processor | Database: accounts, credits, orders and your generated images. | EU |
| Polar (merchant of record) | Independent controller | Sells you the credits as merchant of record: checkout, invoices, VAT and subscription billing under its own privacy policy. Receives your email, name and payment details; card details never reach our servers. We attach our user id, the pack and the time you waived withdrawal. | EU / United States |
About the image model. We use OpenAI's API. Under OpenAI's API terms, content sent through the API is not used to train their models, and may be retained by OpenAI for up to 30 days for abuse monitoring before deletion. Transfers to the United States rely on the EU–US Data Privacy Framework and standard contractual clauses. See How we use AI.
5. Your rights
Under the GDPR you can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Email patrick@nightmarestudios.net; we answer within 30 days. You can delete your account yourself from the account page: that removes your sheets, banners, kits, credits and sign-in link at once, and replaces your name and email on the account record with a placeholder. Order records required by bookkeeping law are kept for five years with personal data minimised. You can also complain to Datatilsynet (the Norwegian Data Protection Authority) or your local authority.
6. Security
Traffic is encrypted in transit. Images and account data are stored in a managed database in the EU with access limited to the operator. Your sign-in is handled by Google; we never see or store a password. API keys for our providers are held server-side only.
7. Children
The service is for adults and businesses. We do not knowingly collect data from anyone under 18; if you believe we have, email us and we will delete it.
8. Changes
We will post changes here and, for material changes, notify signed-in users by email before they take effect.