Privacy and cookies
Last updated 1 November 2026
This page says what SlapMake knows about you, why, who else handles it, and what you can do about it. It applies to everyone; if you are in the European Union, the EEA, the United Kingdom or Switzerland, it is also the information the GDPR entitles you to.
Who is responsible
SlapMake is run by Pavel Gomon, a registered business in Kfar Saba, Israel. For anything about your data, write to support@slapmake.com. Israel is recognised by the European Commission as giving personal data adequate protection.
What we hold and why
| What | Why | Legal basis |
|---|---|---|
| Account | Your name, email address and a scrambled form of your password (or the link to your Google account, with your Google picture). If your Google account later gives a different email address, that one is kept with your account too, so it signs you in. Needed to sign you in and keep your work yours. | Contract |
| Your work | The designs you make, the images you upload or generate, and the prompts you type. Kept so you can come back to them and print them. | Contract |
| Orders | What you ordered and the name, address, email and phone number it ships to. Needed to make and deliver it. | Contract |
| Payments | What you bought (credits, or an order and its shipping), when, the amount, and the type, last four digits and country of the card. Card numbers go straight to our payment provider and never reach us. Each payment gets a tax invoice in your name. | Contract; legal obligation (tax records) |
| Credits | Every change to your credit balance and what it was for, so the balance can always be explained. | Contract |
| Security | Your network address, held briefly in memory to limit repeated sign-in attempts, and kept once when a new account receives its free credits, to stop the same person collecting them many times. | Legitimate interest (preventing abuse) |
| Your country | Worked out from your network address each time a page loads, to decide whether the law where you are requires us to ask before using analytics. It is looked up on our own server against a list we keep there (IP geolocation by DB-IP); your address is not sent to anyone for this. The country is kept only as one more in that day's count of visitors per country (see below). | Legal obligation |
| Visit counts | Daily totals our own server keeps of how many people visited, which pages they opened, the site they came from, their country and whether they used a phone. No cookie is used and nothing is kept about any one visitor: to tell a new visitor from a returning one that day, your network address and browser are scrambled with a secret that changes daily and is never stored, and that scrambled value stays in memory for the day only. Nothing is sent to anyone. | Legitimate interest (knowing how the site is used) |
| Usage statistics | Which pages and features are used, and how well our marketing works, through Google Analytics. Tied to an account number, never to your name or email. | Consent, where the law asks for it |
We do not sell your data, show advertising, or build a profile of you for anyone else.
Who else handles it
These companies work for us and receive only what their part needs:
- Vultr hosts the site and its database, in Frankfurt, Germany.
- Google: sign-in with Google if you choose it, the email we send you (Google Workspace), and Google Analytics.
- fal.ai runs the AI models. It receives the prompts you type and the images you ask it to change.
- Printful prints and ships orders. It receives the print file and the delivery details.
- Allpay takes card payments. It receives your card details directly, with your name and email.
- morning (Green Invoice) issues tax invoices. It receives your name, country, what you bought and what you paid.
If you message us on WhatsApp, the message travels through WhatsApp (Meta) under its own privacy policy, and we see your WhatsApp name and number. Writing by email instead is always fine.
The list that tells us which country a network address is in comes from IP Geolocation by DB-IP. It is kept on our own server; DB-IP receives nothing about you.
Removing a background, in the studio or with the tool for it, is done by your own device. For that your browser fetches an AI model from Hugging Face and the program that runs it from jsDelivr. Like any site you fetch a file from, they see your network address; they do not receive your image. The free tools open your files in your browser too, and send them nowhere (the image converters included: what they need to open HEIC photos comes from slapmake.com itself); the image upscaler is AI, and works as described for fal.ai above.
Some of them are in the United States or process data there. Where the law requires a safeguard for that, they rely on the EU-US Data Privacy Framework or on standard contractual clauses.
How long we keep it
- Account and work: until you delete your account. Deleting it removes your account, designs, library, print files and orders at once.
- Purchases and invoices: for at least seven years, because tax law requires it. The record of each payment, for credits or for an order, with the name and email it was invoiced to, outlives your account.
- The record of credit changes: kept without your name after the account is gone, so the books still add up.
- Signed-in sessions: thirty days from your last sign-in.
- Analytics: kept by Google for up to fourteen months.
- Visit counts: the daily totals are kept; they say nothing about any one person.
- The mark that an email address has had its free credits: kept as a scrambled value that cannot be read back into the address, with the network address it came from, so free credits are given once.
- The mark that you have used a coupon code: the code, your account and the same scrambled value of your email address, so each code gives its credits once per person.
Cookies and what your browser stores
- slapmake_session (necessary, 30 days): keeps you signed in. Without it the site cannot know who you are.
- slapmake_consent (necessary, 1 year): remembers your answer about analytics.
- _ga and _ga_… (analytics, up to 2 years): set by Google Analytics, and only if analytics is on for you.
- In your browser only: work you do before signing in, the last delivery address you typed, what is in your bag (so it is still there after a reload, for the account that filled it), and a few settings such as the last AI model you picked. None of it is sent to us until you sign in or order.
If you are in the EU, the EEA, the UK or Switzerland (judged by your network address, or by your device's time zone when the address tells us nothing), analytics stays off, and nothing of Google's is loaded, until you allow it. Elsewhere it is on unless you turn it off. Either way you can change your mind at any time: open cookie settings.
Our own visit counts (above) use no cookie and store nothing on your device, so they are kept whatever you answer. They are totals per day and cannot be traced back to you.
Your rights
- See and download your data: in the studio, open your account menu, choose Account, then Download my data.
- Correct it: change your name in Account; for anything else, write to us.
- Delete it: Account, then Delete account. It takes effect at once.
- Withdraw consent to analytics: cookie settings, above.
- Object, or ask us to restrict what we do: write to support@slapmake.com. We answer within a month.
- Complain: to the data protection authority where you live, or to Israel's Privacy Protection Authority.
Children
SlapMake is not meant for anyone under 16, and we do not knowingly hold their data.
Changes
When what we do with your data changes, this page changes first, and the date at the top with it. For a change that matters we will also email you.