1. Who processes your data

1.1. The data controller is Individual Entrepreneur Denis Epifantsev, the operator of the Wenrexa Digital Store platform (wenrexa.com). Full details, including country of registration and address, are in the Operator Details section.

1.2. Send privacy questions and requests to exercise your rights to [email protected].

1.3. No separate Data Protection Officer has been appointed: the scale and nature of our processing do not meet the criteria that make an appointment mandatory. Requests are handled by the operator.

2. What data we collect

2.1. Data you provide

• Account data: email address, login, nickname, password (stored as a hash), country of residence.
• External sign-in data: when signing in with Google — name, email and profile identifier.
• Author data (additional): date of birth (optional in the profile; required before adding bank details, for the age check — payouts only from 18), tax identification number (TIN) and bank details, for payouts.
• Content: products, images, descriptions and other material you publish.
• Correspondence: support tickets, complaints, messages in order chats.

2.2. Data collected automatically

• IP address and approximate location (GeoIP);
• browser type, operating system, screen resolution;
• pages viewed, visit time, referrer;
• cookies and session data — see the Cookie Policy.

2.3. Wenrexa AI data

• prompts sent to the generation tools and the results returned;
• ratings and feedback on answers;
• voice input, if you use voice mode.

3. Purposes and legal bases

3.1. We process data only for the purposes listed, and only where we have a legal basis:

3.2. Where the basis is legitimate interests, we weighed that interest against your rights and concluded the processing does not override your reasonable expectations. You may object to it — see section 10.

3.3. Where the basis is consent, refusing does not affect the lawfulness of processing before withdrawal and does not restrict access to the platform's core functions.

4. Who we share data with

4.1. We do not sell personal data. Data is shared only with the following categories of recipient, and only to the minimum extent needed:

• Payment providers — to take payments and make payouts. We do not store buyers' card details.
• Sign-in provider — Google, when you sign in with a Google account.
• Analytics — Google Analytics, only with your consent.
• Email provider — for transactional and informational messages.
• Hosting and infrastructure — server capacity providers.
• Social platforms — Pinterest and similar, to promote public product content.
• Authorities — where there is a lawful request.

4.2. Each of these services has its own privacy policy.

4.1. Automated product promotion

Public product information (title, image, description, link) may be posted automatically to third-party platforms such as Pinterest for promotion. Only what the author made public is posted. No personal data of users is transferred.

4.2. Google OAuth — Data Security and Limited Use

When you sign in with Google we receive only your name, email address and profile identifier. This data is used exclusively to:

• create and manage your account on the platform;
• provide platform functionality (authentication, notifications);
• comply with legal obligations.

We do not sell, rent or transfer data obtained through Google to third parties for any purpose other than operating the platform.

Google data is not used for:

• targeted advertising or marketing profiling;
• credit decisions or insurance risk assessment;
• building consumer profiles for discriminatory purposes;
• any other commercial purpose unrelated to platform functionality.

When an account is deleted, all data obtained through Google OAuth is removed from our servers within 30 days. Our use of Google API data complies with the Google API Services User Data Policy, including the Limited Use requirements.

5. Cookies and tracking technologies

5.1. Strictly necessary cookies keep sign-in, the cart, language, currency and CSRF protection working. They do not require consent.

5.2. Functional, analytics and advertising cookies are set only with your consent, which is requested by the banner on your first visit.

5.3. You can change your choice and withdraw consent in the Cookie Policy section or through the "Cookie settings" link in the site footer. Details are there.

6. Training Wenrexa AI models

6.1. We train our own models on the data listed in 2.3 and on data from products published on the platform.

6.2. You can opt out using the two switches in the "Personal data" section of your account: one for AI conversations, one for published work.

6.3. Opting out applies to subsequent data exports. Material already included in collected sets and trained models cannot be extracted from them.

6.4. Full terms are in the Wenrexa AI Terms.

7. How long we keep data

8. International data transfers

8.1. The servers and third-party services we use may be located outside your country of residence, including outside the European Economic Area.

8.2. For such transfers we rely on the mechanisms the law provides: adequacy decisions adopted by the European Commission, or Standard Contractual Clauses approved by the European Commission, or other permitted safeguards.

8.3. A copy of the safeguards in place can be requested at [email protected].

9. Security

• data travels over an encrypted connection (HTTPS);
• passwords are stored as hashes and are not accessible even to administrators;
• tax numbers and bank details are encrypted at rest (AES-256);
• staff access to personal data is limited to what the job requires and is logged.

No system is perfectly secure, but we take measures proportionate to the risks.

10. Your rights

10.1. In relation to your personal data you have the right:

• of access — to confirmation that we process your data and a copy of it;
• to rectification of inaccurate or incomplete data;
• to erasure ("right to be forgotten"), to the extent it does not conflict with our legal obligations;
• to restriction of processing in the cases the law provides;
• to data portability — to receive your data in a machine-readable form;
• to object to processing based on legitimate interests, including model training;
• to withdraw consent at any time, without affecting the lawfulness of earlier processing;
• to opt out of marketing messages.

10.2. Access and portability are self-service: in the "Personal data" section you can build and download a complete archive of your data. Account deletion is in the same place.

10.3. For the other rights, write to [email protected]. We respond within 30 days; where necessary the period may be extended, and we will tell you.

10.4. Right to complain. If you believe we have infringed your rights, you can complain to a supervisory authority. In Georgia this is the Personal Data Protection Service (personaldata.ge). If you are in the EU or EEA, complain to the authority of your habitual residence, place of work, or the place of the alleged infringement.

11. Automated decision-making

11.1. We do not take decisions producing legal effects concerning you based solely on automated processing, and we do not carry out profiling in that sense.

11.2. Automated means are used in pre-screening content and in fraud detection, but the final decision to restrict or block is taken by a person and comes with a statement of reasons — see Content Complaints.

12. Children

12.1. The platform is not intended for anyone under 16; use from age 13 is permitted only with the consent and supervision of a legal guardian. Payouts are available only from the age of 18 (Seller Terms, 2.4).

12.2. If you believe a child has given us data without such consent, tell us at [email protected] and we will delete it.

13. Changes to this Policy

13.1. We may update this Policy. The current version is always on this page and the update date is shown at the top.

13.2. We notify you of material changes by email and by a notification in your account.

14. Contact

Privacy enquiries: [email protected]