Privacy & cookies

Updated 2 October 2026. This notice covers the Need A Poster website and preview studio. Ordering, accounts, uploads, public sharing and payouts are not active.

Who handles your information

Tiny Agency ApS, Sigvej 2, 7700 Thisted, Denmark, registration CVR 44555689. Contact privacy@needaposter.com for questions and privacy requests.

You can also reach us directly at peter@tinyagency.io.

Need A Poster is currently operated by Tiny Agency ApS. If the service moves to its own company, we will update this notice and explain any change to who handles your information.

Contacting us

If you email us, we process your email address, message and any information you choose to include to answer you. Handling privacy rights requests is based on our legal obligations (GDPR Article 6(1)(c)); ordinary support relies on our legitimate interest in helping you (Article 6(1)(f)). Messages to privacy@needaposter.com are forwarded by Namecheap to our Tiny Agency inbox, handled through Google Workspace. We retain correspondence while handling the request and for as long as necessary for applicable legal obligations or legal claims, then delete it.

Using the studio

We store a random browser session ID, your chosen artwork, versions and generated images, change requests, frame and size choices, creation dates, and edit job status. Jobs also record the AI provider’s request ID, model, timing and usage so we can run and troubleshoot edits. We do not ask for your name or email to use the studio.

We rely on legitimate interests (GDPR Article 6(1)(f)) to provide the free preview studio you choose to use, save its designs, secure the service, prevent abuse and diagnose failures. An AI edit requires your change request and source image; you may browse without using the studio. We limit this processing to the requested preview, with short retention, restricted access and a direct delete action. We do not use your requests for marketing or profiling. You may object to this processing and ask us to stop.

AI edits and service providers

When you select “Make my change”, we send your change request and selected image to OpenAI’s image editing API. Avoid names, contact details, sensitive information or other personal details in your requests. OpenAI does not train on API inputs or outputs by default. Its default abuse monitoring records may retain content for up to 30 days, with exceptions for legal or safety requirements, including flagged image inputs. We have not enabled or verified Zero Data Retention.

Vercel hosts the website and functions. Neon stores the studio’s database and image bytes in Frankfurt, Germany. This release configures the function region as Frankfurt. Infrastructure also processes connection information such as IP address, request time and browser information for delivery and security. Our application logs fixed error codes rather than your prompts or images.

EU hosting does not mean every supplier processes data only in the EU. The OpenAI endpoint used here is not an EU residency endpoint; US processing and supplier access outside the EEA may occur. The providers’ published data processing terms describe safeguards for international transfers, including the European Commission’s Standard Contractual Clauses where applicable: OpenAI, Vercel and Neon. Our mail providers publish their terms here: Namecheap and Google Workspace. Contact us for information about the safeguards applicable to your request or a copy of the relevant clauses.

How long we keep it

Your studio session lasts 30 days from its creation, without renewal on each visit. Designs, images, requests and job records become unavailable 31 days after each design was created, even if it was edited later.

A daily cleanup removes expired designs and their images, requests and job records from the active database, normally within the following day.

You can delete all designs belonging to this browser in Your studio. Deletion removes their images, prompts and job records from our active database and ends the session. It also clears this site’s saved room choices and sharing previews from this browser. An edit already started may still be processed by OpenAI, but its result will not be saved here after deletion. Deletion here does not erase the provider’s separate safety records or copies you downloaded.

Only an aggregate daily attempt count, without session IDs or content, is kept for the current usage-limit day. Standard Vercel runtime logs are retained for one day under our current Pro plan. This period does not describe separate security records or other supplier logs. Neon’s database is configured with a six-hour restore-history window. This is the available point-in-time restore range, not a promise that every separate supplier backup or security record is physically erased after six hours. Deleting active records does not immediately erase historical backups. These copies are not available through the studio and are handled under the providers’ applicable retention and security policies.

To prevent deleted designs from returning after a database restore, we keep their design and image IDs in a separate deletion journal at Neon. It contains no images, change requests, browser session IDs or contact details. Entries are removed after seven days, normally within the following daily cleanup. Restored studio data stays blocked until deletions have been reapplied and old sessions and jobs have been closed.

Cookies and local storage

The studio uses __Host-nap-editor, a first-party, secure, HttpOnly, SameSite=Lax cookie lasting up to 30 days. It connects this browser to its private designs, using a signed random ID and issue date. It is set when the requested studio opens, not when you browse the catalogue. It is necessary for that service, so no optional cookie consent is requested.

Local storage keeps room and view selections (nap-room-preview:…) for the preview you use. When you request a sharing preview, nap-share-previews-v1 saves its design/version IDs, image reference, frame and optional display name in this browser. The display name stays here; the link works only in this browser and does not make the design public. These records remain until you clear site data or use the delete action. Private browsing or clearing the session cookie can make stored designs inaccessible; their server retention deadline still applies.

We do not use advertising pixels, analytics, session recordings or third-party embeds in this release. Fonts are hosted with the site. Instagram links open Instagram, whose own privacy terms apply once you leave.

Your rights

Subject to the relevant conditions, you can request access, correction, erasure, restriction and portability of personal information, and object to processing based on legitimate interests. You can delete this browser’s studio data directly above. We may need enough information to locate and verify a request, such as a design reference; never send the session cookie. We normally respond within one month. There are no decisions with legal or similarly significant effects made solely by automated processing.

You can complain to Datatilsynet in Denmark or your local supervisory authority.