Legal information
Privacy Policy
Last updated: 10 August 2026
Latenight Miniatures processes only the information needed to operate the store, deliver files, protect the service, and respond to customers.
Information we collect
We process account email and authentication records; guest checkout email; orders, totals, consent records, Stripe customer/payment references and download entitlements; secure guest-token records; commission request details and reference images; community-submission media, publishing permission, and Instagram attribution; email-delivery status; and necessary security, diagnostic, and server logs.
Why we use it
We use this information to perform purchases and digital delivery, create and secure accounts, provide support, prevent fraud and abuse, send transactional email, publish authorised community work, meet legal and accounting obligations, and establish or defend legal claims. Where applicable, processing relies on performance of a contract, compliance with law, legitimate interests in operating a secure store, consent for publishing community media, or your request before entering a contract.
Payments and service providers
Stripe processes card payments and receives checkout information. Resend delivers transactional email. Hetzner hosts the application, PostgreSQL data, and private object storage. These providers process information under their own security and data-protection commitments. We do not receive or store full card numbers.
Guest orders and account claiming
Guest access tokens are generated randomly; a hash and protected recovery form are retained so delivery email can be retried. The token stays valid until revoked or a full refund. If the same email is later confirmed on an account, matching guest orders are automatically attached to that account while the original email access link remains usable.
Community and Instagram attribution
Community media is published only after permission is recorded. The displayed Instagram handle and optional Instagram link are supplied for attribution. Instagram is a separate service; following a link is governed by Instagram’s own privacy terms. You may ask us to unpublish authorised media by contacting support.
Retention
Order and payment records are retained as needed for contract, accounting, tax, fraud-prevention, and legal obligations. Account information is kept while the account is active and then deleted or restricted where permitted after a valid deletion request. Commission reference images are scheduled for deletion after 30 days. Security logs are kept only as long as reasonably necessary. Community media is retained until removed, permission is withdrawn, or it is no longer needed.
Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent without affecting earlier lawful processing. You may also complain to the competent data-protection authority. Some order records must be retained despite an account-deletion request where law requires it.
Security and contact
We use encrypted transport, private object storage, access controls, protected authentication cookies, hashed access tokens, and operational monitoring. No internet service is risk-free. For privacy requests, contact [email protected] and include enough information for us to verify the request without sending passwords or payment-card details.
Questions or requests can be sent to [email protected].