Privacy policy

Effective 24 September 2026

This policy covers the Sttockry website, Android app and connected marketplace and creative tools. The app displays our online service, so the same account and data practices apply on both surfaces.

1. Who is responsible

STOCKRYSTUDIO S.R.L., C.U.I. 47429077, J13/71/2023, operates Sttockry. Our address is Constanta, Str. Prelungirea Sg. Nicolae Grindeanu, nr. 1, Km. 5, Lot 5/1, Camera 5, Constanta County, Romania. Contact contact@sttockry.com about privacy or use our account and data deletion form.

2. Information we process

• Account and profile: name, username, email, password hash, optional profile photo, phone/address and linked Google or Facebook account identifiers. OAuth providers process your sign-in under their own policies; we do not receive your Google or Facebook password.
• Seller and commercial records: company details, tax/registration identifiers, verification documents, signed seller contracts, billing information, purchases, licences, wallet transactions and payout information where those features are used. Payment providers may receive payment credentials directly; we retain the transaction information needed to provide and account for the service.
• Creative content: photos, videos, audio, documents, templates and other files you upload; text, subtitle transcripts, edits, AI prompts, reference media and generated results. Uploaded content can itself contain personal information. Only upload material you are entitled to use.
• Communication and activity: support/deletion requests, reviews, comments, messages, searches, browsing interactions and security/technical records such as IP address, browser/device information, timestamps and error details.

You can browse public content without an account. Data needed for an account or transaction is necessary for that feature. Creative uploads, linked social sign-in and optional profile information are provided when you choose the corresponding feature. The Android app uses a system file picker; optional camera access is used only when you choose camera capture. We do not request contacts, SMS or precise device-location access.

3. Why we use it

We process information to create and manage accounts, supply purchases and licences, operate creator tools, generate and translate content, process payments and payouts, communicate about requests, prevent abuse and secure the service. We also use website activity and cookie/pixel information for analytics and marketing measurement. The legal basis is performance of the requested service, legal obligations, consent where required, or a legitimate interest such as fraud prevention and service security. You may object to processing based on legitimate interests and withdraw consent without affecting processing already lawfully performed.

4. Content processing and recipients

• Subtitles: speech recognition and video rendering run on Sttockry-controlled server infrastructure; “local” does not mean offline on your phone. When you choose a translated subtitle language, transcript text and the requested language are sent to Groq for translation. Groq is not used for speech recognition in this workflow.
• AI creation: requested generation can send your prompt, reference images/video and relevant project or brand instructions to xAI. Avoid including information that is not necessary for the generation. Outputs and project content are saved to your Sttockry workspace.
• Service providers: hosting/storage, email delivery, payment, authentication and AI providers process the information needed for the feature. Integrated providers include Google and Facebook for sign-in, Groq for translation, xAI for generation and the payment provider identified at checkout. Providers may also process data to meet their own security and legal duties.
• Public and shared content: publishing a seller profile, product, review or share link makes the selected information available to others; buyers receive the content they licence. Previously downloaded copies cannot be remotely erased.
• Legal disclosures: we may disclose necessary records to authorities or professional advisers to comply with law, resolve disputes or protect rights. Access to private account data is restricted to the purposes above.

5. Cookies and marketing measurement

The website embedded in the app includes Google Ads and Meta/Facebook tracking pixels. These services can receive page URLs, interactions, cookie/device identifiers, IP address and browser/device information, which may also support approximate geographic reporting and advertising measurement. The app does not display third-party ad placements, but that does not mean these tracking transfers are absent. Essential session cookies support login, security and shopping. You can manage cookies in your browser/device and use available consent controls; blocking essential cookies may prevent sign-in or checkout. Consult Google’s privacy policy and Meta’s privacy policy for their practices and controls.

6. Security and international processing

The Android app connects to Sttockry over HTTPS and blocks cleartext web connections. Server access and private workspaces are restricted, and passwords are stored as hashes. No service can guarantee absolute security. Some providers process data outside Romania or the European Economic Area, including in the United States. Applicable transfer requirements and provider contractual safeguards must be observed; this policy does not claim that all processing stays in the EU or that the service has an independent security certification.

7. Retention and deletion

Account and workspace data are kept while needed to provide your account and the features you use, until you delete eligible content or a verified erasure request is fulfilled. Retention exceptions apply only to the necessary records and purposes below, not to the entire account.

• Accounting: invoices and required payment/payout supporting records are generally retained for five years from 1 July of the year following the relevant financial year under Romanian accounting rules, unless a different specific legal requirement applies.
• Licences and disputes: minimum evidence needed to honour an existing licence, settle an outstanding balance or resolve a dispute/legal hold is restricted and retained for the duration of that obligation. We identify the applicable reason and period or end trigger when handling your request.
• Support/security: messages and necessary security evidence are kept while needed to resolve the request, investigate an incident or comply with a documented legal obligation. They are included in an erasure review; no blanket indefinite retention exception applies.
• Backups: archives are not claimed to have an automatic expiry. They are included in the deletion workflow. Copies of data due for erasure must be removed, redacted or made irrecoverable before full completion is confirmed, except for disclosed legal-retention obligations. Erasures must be applied before restoring an archive.
• AI providers: xAI’s standard API audit retention is 30 days. Groq normally does not retain inference inputs/outputs, but reliability/abuse logs can be kept for up to 30 days. Legal exceptions and separate provider metadata retention can apply. We do not claim zero-data-retention is enabled. Provider-held data is included in applicable deletion requests. See xAI data handling and Groq data handling.

8. Request account or data deletion

Open the Sttockry deletion-request form to request deletion of your account and associated data, or selected data while keeping your account. It works without signing in or reinstalling the app. You can also email contact@sttockry.com from the account email with the subject “Sttockry account deletion”. Do not include passwords or payment credentials.

Support verifies ownership before action. A form submission does not immediately delete or disable an account. Active generations, subscriptions, wallet balances, seller obligations and licensed purchases may need to be resolved first. We respond within one month and aim to complete routine verified requests within 30 days. Any lawful extension, reason and revised deadline will be communicated within the first month. The response explains deleted data, any justified retained records and outstanding processor/backup work. External store subscriptions may require cancellation through the relevant store. Account deletion cannot recall copies already lawfully downloaded by another person.

9. Your rights

Subject to applicable law, you can request access, correction, erasure, restriction, portability or object to processing, and withdraw consent. You may complain to Romania’s National Supervisory Authority for Personal Data Processing at dataprotection.ro. Sttockry is intended for users aged 16 and above; age restrictions for particular content can be higher. If a child has supplied account information contrary to these requirements, contact us so we can investigate.

10. Changes

We update this policy when the service or data practices change and show the effective date above. Material changes will be communicated through an appropriate service notice. Contact details and the public deletion pathway remain available without an account.