Skip to content
Sign in Sign up

Home › Privacy Policy

Privacy Policy

Last updated: 31 October 2026

Who is responsible

The controller of your personal data is RkRRa, Bulgaria, operator of rkrra.com. Contact: info@rkrra.com.

What we collect and why

  • Your email address — to create your account, send you sign-in links, show you what you bought and contact you about your purchases. Legal basis: performance of the contract.
  • Your purchases and subscriptions (what you bought, plan, status, dates and amounts) — to give you access to your downloads and to keep the accounting records the law requires. Legal basis: contract and legal obligation.
  • Download and sign-in records (which file, when, and the IP address) — to limit abuse, detect shared accounts and keep the service secure. Legal basis: our legitimate interest in protecting the shop.
  • Requests and messages you send us through the form on the Custom LoRAs page or by email (your name, email, what you need and any reference image you attach) — to answer them and, if you order, to do the work. The form sends them to our mailbox; the reference image is not stored on the website. Legal basis: steps at your request before a contract, and the contract.
  • Images and datasets for custom work — used only to make your order and deleted within 30 days of delivery. Legal basis: the contract.

We do not see or store your card details: payments are handled entirely by Stripe. We do not sell your data, and we do not use it for advertising.

Who else processes your data

  • Stripe (payments, invoices and the subscription portal). Stripe acts as an independent controller for payment data; see stripe.com/privacy.
  • Namecheap (web hosting and email), where the shop and its database run.
  • Cloudflare (file storage for downloads with R2, Web Analytics, and Turnstile, the check against bots on the sign-in and request forms). Cloudflare Web Analytics does not use cookies and does not track you across sites; Turnstile looks at signals from your browser only to tell people from bots, and not for advertising.

Some of these providers may process data outside the European Economic Area. They do so under the European Commission’s standard contractual clauses or an adequacy decision.

Cookies

We only use cookies that the shop needs to work, so we do not ask for consent:

  • rk_s — keeps you signed in (30 days, not readable by scripts).
  • rk_in — tells the page that you are signed in, so it can show your download buttons (30 days).

Stripe sets its own cookies on its payment page to prevent fraud.

How long we keep it

  • Your account and purchase records: while you have an account, and afterwards for as long as tax and accounting law requires (usually up to 10 years for invoices).
  • Download and sign-in records with IP addresses: 12 months.
  • Sign-in links: they expire after 30 minutes and are deleted within a day.

Your rights

You can ask us to access, correct, delete or export your data, to restrict its use, or object to its use for our legitimate interests. Write to info@rkrra.com from the email of your account. We will answer within one month. Records we must keep by law cannot be deleted before that period ends.

You also have the right to complain to a data protection authority, in particular the one of the country where you live or the Bulgarian Commission for Personal Data Protection (cpdp.bg).

Changes

If we change this policy, we will update the date at the top, and tell you by email if the change is important.

Terms of Service · Refund Policy · Contact