Privacy Policy

1. Scope

This Privacy Policy explains how XCoffee perler beads collects, uses, stores, and shares information when you use its image-to-bead-chart service. The operating entity and contact details are the information currently published on the website. Using the service means that you have read this policy.

2. Information We Collect

We may collect the following information to provide accounts, payments, AI generation, and chart storage:

1. Account information — Email, name, avatar, login-related information, and account status.
2. User content — Uploaded source images, prompts, chart titles, width, color limit, palette, outline, safety-margin settings, generated reference images, construction charts, summary images, and edit history.
3. Credits and order information — Credit balances, grants and consumption, order number, product, amount, currency, payment status, payment channel, and transaction identifiers. Full card numbers and similar payment-sensitive data are normally handled directly by payment providers and are not actively stored by us.
4. Device and log information — IP address, browser and device type, operating system, language, access time, request records, error logs, and security events for operation, troubleshooting, and abuse prevention.
5. Cookies and similar technologies — Used to maintain sessions, remember language and preferences, protect accounts, and, when enabled, understand service usage.

3. How We Use Information

We may use information to:

• Create and maintain accounts and provide login, chart generation, storage, viewing, downloading, and credit features.
• Send images and related settings to an AI service to generate results, and record task status, duration, request IDs, and errors.
• Process payments, grant credits, verify orders, handle refunds, and resolve disputes.
• Send account, order, service-change, security, and support communications.
• Diagnose errors, improve the product, protect the service, and detect fraud, abuse, and prohibited content.
• Comply with legal obligations and respond to lawful requests from authorities.

4. Service Providers and Sharing

We do not sell your personal information. To operate the service, we may share necessary information with these categories of providers:

• AI model services — Images, prompts, and generation parameters may be sent to OpenAI or a relay/model provider configured by the operator. Those providers' policies also govern their handling of the request.
• Object storage and databases — Source images, reference images, charts, and task records may be stored in Cloudflare R2, S3-compatible storage, or a database configured for the deployment.
• Payment providers — Payment channels process orders, payment status, and necessary transaction identifiers. The actual providers depend on which channels the website has enabled.
• Email, support, and analytics providers — When enabled, necessary information may be provided to email, ticketing, error-monitoring, or website-analytics providers.
• Legal and security disclosures — We may disclose necessary information to comply with law, enforce the Terms of Service, resolve disputes, or protect users, the public, and our rights or property.

Some providers may be located in other countries or regions, so information may be transferred across borders. We will use reasonable contractual, access, and transmission safeguards based on the deployment and provider capabilities, but we cannot guarantee that third-party systems are risk-free or that data will always remain in your region.

5. Retention and Deletion

Actual storage locations and retention periods depend on deployment settings, providers, account status, order records, and legal requirements. We generally retain account, chart, and task information while needed to provide the service. Some orders, logs, or audit records may be kept longer for payments, refunds, disputes, security, and compliance. AI, payment, and storage providers may also retain records under their own policies.

You may use account controls or the website support entry to request access, correction, export, or deletion of personal information. Deleting an account or content may make related charts, task records, and unused credits unavailable. Information that must be retained by law or has been de-identified may not be immediately deleted.

6. Data Security

We use reasonable measures based on risk, including encryption in transit, access controls, separated permissions, audit logs, and provider review. Internet transmission and electronic storage are never completely secure. If a security incident may affect you, we will take notice and remediation steps required by applicable law.

7. Your Choices and Rights

You may choose not to provide certain information, but you may then be unable to register, pay, upload images, or use all features. You can view and update some details in account settings and request access, correction, export, deletion, or restricted processing through support. We may verify your identity and handle requests subject to applicable law, other people's rights, and security needs.

8. Children

The service is not directed to children. If you believe a child provided personal information without appropriate authorization, contact us through the website support entry and we will handle the request as required by applicable law.

9. Changes to This Policy

We may update this policy as the product, storage methods, service providers, or legal requirements change. Material changes will update the date on this page and, where reasonably practical, be announced through the service. Continued use means that you acknowledge the updated policy.

10. Contact Us

For questions about this policy, personal information, or deletion requests, email hi@xcoff.ee or use the website support entry.

Browser-only tools and progress

Free starter-pattern edits and pixel-art conversion run in your browser. Starter edits are kept for the current session; download them before leaving. Beading progress is stored separately in this browser's local storage, not in your account or the pattern author's shared chart. Clearing browser storage removes that progress. A changed chart uses a separate progress record. Beading progress and manual edits are not automatically uploaded. Free conversions, including signed-out use, report result, duration, entry point, grid size and color count to the administrator. Signed-in records are associated with your account; signed-out records have no persistent visitor identifier. Records support usage statistics, not billing. Original images are not uploaded. Only if you explicitly opt in do we save a small thumbnail drawn from the final grid, visible only to administrators. Thumbnails expire after 30 days and are cleared in batches; usage metadata is retained for historical statistics. Turning off the option affects thumbnails not yet sent; contact support to request deletion of already saved content.