Privacy Policy

1. Introduction

Welcome to Shotexa, an AI-powered photo generation and editing mobile application developed and operated by Rockuno (a brand of Oemer Kaya, Einzelunternehmen, Germany). This Privacy Policy explains how we collect, use, process, store, and share your personal data when you download, install, and use the Shotexa iOS mobile application.

This policy applies exclusively to the Shotexa mobile application (available on the Apple App Store). It does not govern any other products, services, or websites operated by Rockuno unless explicitly stated.

We are committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679, the German Bundesdatenschutzgesetz (BDSG), and all applicable data protection laws.

By creating an account or using Shotexa, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the app and delete your account.

2. Data Controller

The entity responsible for the processing of your personal data (the "Data Controller") is:

If you have any questions or concerns about how your data is handled, please contact us at info@rockuno.com.

3. Data We Collect

We collect only the personal data necessary to provide and improve the Shotexa mobile application. The following categories of data are collected:

3.1 Account and Identity Data

• Email address – collected when you register an account via Supabase Auth.
• User ID – a unique identifier generated and assigned to your account upon registration.
• Authentication tokens – session tokens managed by Supabase Auth to keep you securely signed in.

3.2 User-Uploaded Content

• Photos and images – images you voluntarily upload to the app for AI-based generation or editing. These are stored in Supabase Storage and may be transmitted to third-party AI processing APIs for the sole purpose of generating or editing results.

3.3 Device and Technical Data

• Device type and model
• Operating system version
• App version
• IP address (used for security and fraud prevention; not stored long-term)
• Crash reports and error logs – anonymous technical data to help us diagnose and fix issues

3.4 Usage Data

• Features used within the app (e.g., which AI tools you interact with)
• Session duration and frequency of use
• In-app navigation patterns (aggregated and anonymized where possible)

3.5 Purchase and Subscription Data

• Subscription status (active, expired, trial)
• Purchase history (plan type, renewal date)
• Data provided to us by RevenueCat regarding in-app purchase events

3.6 Data We Do Not Collect

• Precise real-time GPS location
• Contact list or address book
• Microphone or audio recordings
• Browsing history outside the app

4. Purposes of Processing

5. Legal Basis for Processing (GDPR Art. 6)

Under the GDPR, we are required to identify a valid legal basis for each processing activity. We rely on the following legal bases:

5.1 Performance of a Contract (Art. 6(1)(b))

Processing your account data, uploaded images, and subscription information is necessary to perform the contract between you and Rockuno — that is, to provide you with the Shotexa app's core functionality. Without this processing, we cannot deliver the service.

5.2 Legitimate Interests (Art. 6(1)(f))

We process technical data, device data, and usage analytics based on our legitimate interests in:

• Maintaining and improving the security, reliability, and performance of the app
• Detecting and preventing fraud and abuse
• Understanding aggregate usage to improve product features

These interests are carefully balanced against your rights and freedoms. You may object to processing based on legitimate interests at any time (see Section 11).

5.3 Compliance with Legal Obligations (Art. 6(1)(c))

Where required by applicable law, we process personal data to fulfill our legal obligations, including retention requirements under German tax and commercial law (HGB, AO).

5.4 Consent (Art. 6(1)(a))

For any optional processing activities not strictly required to deliver the service (such as marketing communications, if we introduce them in the future), we will always ask for your explicit, freely given, and informed consent. You may withdraw consent at any time.

6. AI Processing Disclosure

6.1 How AI Processing Works

Shotexa's core functionality relies on artificial intelligence models to generate, transform, and edit photos. When you submit an image for AI processing, that image is transmitted over an encrypted connection to our backend API (hosted at api.rockuno.com on Vercel), which in turn sends your image to a third-party AI provider's API for processing. The AI model analyzes your image and returns a generated or edited result.

6.2 Data Transmitted to AI Providers

The following data is transmitted to third-party AI APIs for the purpose of processing your request:

• The image(s) you upload – transmitted securely for AI inference
• Your prompts or instructions (if text-based editing is used)

We do not transmit your name, email, or other identity data to AI providers unless explicitly required for account verification by that provider (which is currently not the case).

6.3 AI Provider Data Retention

Third-party AI providers may process your images on their servers. We select AI providers that:

• Do not use your submitted images to train their models (unless the provider's terms specifically and transparently permit this with user consent)
• Process data only for the duration necessary to return the result
• Maintain appropriate security and confidentiality measures

Please refer to Section 7 (Third-Party Services) for information on specific AI providers and links to their data processing agreements.

6.4 No Automated Decision-Making with Legal Effect

The AI processing in Shotexa is used solely for creative image generation and editing. It does not make automated decisions that produce legal effects or significantly affect you as defined under GDPR Art. 22.

6.5 Responsibility for Uploaded Content

You are solely responsible for the images you upload for AI processing. By submitting an image, you confirm that you have the right to share that image and that it does not contain content that violates our Terms of Service (e.g., illegal content, images of minors in inappropriate contexts). We reserve the right to remove content that violates our policies.

7. Third-Party Services

Shotexa integrates with the following third-party services. Each service acts as either a data processor (processing data on our behalf) or an independent data controller. We have entered into appropriate Data Processing Agreements (DPAs) with processors where required.

7.1 Supabase, Inc.

Role: Data Processor

Services used: Supabase Auth (authentication), Supabase Database (PostgreSQL), Supabase Storage (image and file storage)

Data processed: Email address, User ID, authentication tokens, uploaded images, app data stored in the Supabase Database

Data location: Supabase-managed infrastructure (AWS regions; EU region available and configured for this application — see Section 10)

Privacy Policy: https://supabase.com/privacy

DPA: Supabase's Data Processing Addendum is available at https://supabase.com/legal/dpa

7.2 RevenueCat, Inc.

Role: Data Processor

Services used: Subscription management, in-app purchase tracking

Data processed: User ID, subscription status, purchase events, device identifiers

Data location: United States (with appropriate safeguards — see Section 10)

Privacy Policy: https://www.revenuecat.com/privacy

DPA: RevenueCat offers a DPA available upon request at https://www.revenuecat.com/dpa

7.3 Vercel, Inc.

Role: Data Processor (infrastructure/hosting)

Services used: API hosting at api.rockuno.com

Data processed: API requests (which may include images and user identifiers in transit)

Data location: United States and globally distributed edge nodes

Privacy Policy: https://vercel.com/legal/privacy-policy

7.4 AI Processing Providers

Role: Data Processor

Services used: AI image generation and editing inference

Data processed: Images you upload, text prompts you provide

Shotexa uses one or more third-party AI API providers to perform image processing. The specific provider(s) in use may change as we update our technology stack. We maintain a current list of AI providers and will update this policy when providers change. Current providers and their data processing terms are referenced in our full sub-processor list, available upon request at info@rockuno.com.

All AI providers are contractually bound to:

• Process your images only as instructed by us (inference only)
• Not use your images for model training without your explicit consent
• Delete images promptly after processing unless storage is explicitly requested
• Implement appropriate technical and organizational security measures

7.5 Apple, Inc.

Role: Independent Data Controller (for App Store distribution and billing)

Services used: App Store distribution, In-App Purchase billing

Apple independently collects and processes data as part of App Store operations and billing. Apple's data practices are governed by Apple's own Privacy Policy: https://www.apple.com/legal/privacy/

8. Data Storage and Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, or as required by applicable law.

When data is no longer required, it is securely deleted or anonymized. Anonymized aggregate data (with no link to any individual) may be retained indefinitely for product improvement.

9. Data Sharing

We do not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share your data only in the following circumstances:

• With service providers (processors): as described in Section 7, solely to enable the app's functionality under our instructions.
• Legal obligations: if required by law, court order, or government authority. We will notify you of such requests unless legally prohibited from doing so.
• Protection of rights: to enforce our Terms of Service, prevent fraud, or protect the safety of our users or the public.
• Business transfers: if Rockuno undergoes a merger, acquisition, or sale of assets, your data may be transferred. We will provide notice and, where required, seek your consent before such transfer. Your rights under GDPR will be preserved.

10. International Data Transfers

As Rockuno is based in Germany (EU), your data is generally processed within the European Economic Area (EEA). However, some of our third-party processors (including Supabase, RevenueCat, Vercel, and AI providers) are based in the United States or operate globally.

When we transfer your personal data outside the EEA, we ensure appropriate safeguards are in place as required by GDPR Chapter V:

• Standard Contractual Clauses (SCCs): We rely on EU-approved SCCs with processors in third countries, including Supabase and RevenueCat.
• Adequacy decisions: Where the European Commission has recognized a third country as providing adequate data protection.
• Supplementary measures: Additional technical and contractual safeguards, including encryption in transit and at rest, are applied.

You may request a copy of the applicable transfer safeguards by contacting us at info@rockuno.com.

11. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights regarding your personal data. To exercise any of these rights, please contact us at info@rockuno.com. We will respond within 30 days.

Right of Access (Art. 15)

You have the right to obtain confirmation as to whether we process your personal data and, if so, to receive a copy of that data along with information about how it is processed.

Right to Rectification (Art. 16)

You have the right to request correction of inaccurate personal data or completion of incomplete data.

Right to Erasure ("Right to be Forgotten") (Art. 17)

You have the right to request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, when you withdraw consent (where processing is based on consent), or when you object and there are no overriding legitimate grounds. Please see Section 12 for how to delete your account and data.

Right to Restriction of Processing (Art. 18)

You may request that we restrict processing of your data in certain circumstances, such as when you contest the accuracy of the data or object to processing based on legitimate interests while your request is being assessed.

Right to Data Portability (Art. 20)

Where processing is based on your consent or a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

Right to Object (Art. 21)

You have the right to object at any time to processing based on our legitimate interests (Art. 6(1)(f)). Upon your objection, we will cease processing unless we can demonstrate compelling legitimate grounds that override your rights.

Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Right Not to Be Subject to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Shotexa does not engage in such decision-making.

12. Account and Data Deletion

We respect your right to erasure. Shotexa provides clear and accessible means to delete your account and associated data.

12.1 How to Delete Your Account In-App

1. Open the Shotexa app and navigate to Settings.
2. Tap Account or Profile.
3. Select "Delete Account".
4. Confirm your decision when prompted.

Your account deletion request will be processed immediately. The following data will be deleted within 30 days of your request:

• Your email address and User ID
• All uploaded images stored in Supabase Storage
• All AI-generated images associated with your account
• All Supabase Database records linked to your account

12.2 Requesting Deletion by Email

If you are unable to access the in-app deletion option, you may submit a deletion request by emailing info@rockuno.com from the email address associated with your account. We will process your request within 30 days.

12.3 Data Retained After Deletion

Following account deletion, we may retain the following data as required by applicable law:

• Purchase and billing records – retained for up to 10 years under German commercial law. This data is retained in anonymized or pseudonymized form where possible.
• Legal hold data – if required by a court order, legal process, or ongoing dispute, certain data may be retained until the matter is resolved.

Beyond legal obligations, no personal data is retained after account deletion.

12.4 Canceling Your Subscription

Deleting your account does not automatically cancel your App Store subscription. To cancel your subscription, go to your iPhone Settings → Apple ID → Subscriptions and cancel the Shotexa subscription. You will continue to have access until the end of the current billing period.

13. Security Measures

We take the security of your personal data seriously and implement appropriate technical and organizational measures to protect it against unauthorized access, loss, destruction, or alteration.

• Encryption in transit: All data transmitted between the Shotexa app and our servers, and between our servers and third-party services, is encrypted using TLS 1.2 or higher.
• Encryption at rest: Data stored in Supabase Database (PostgreSQL) and Supabase Storage is encrypted at rest by Supabase using AES-256.
• Authentication security: Supabase Auth handles user sessions with industry-standard OAuth 2.0 and JWT tokens. Passwords are hashed using bcrypt. We do not store plaintext passwords.
• Access controls: Access to personal data is restricted on a need-to-know basis. Only authorized personnel and systems may access your data.
• Row Level Security (RLS): Supabase Database and Storage are protected by PostgreSQL Row Level Security policies that ensure users can only access their own data.
• API security: Our backend API at api.rockuno.com enforces authentication on all protected endpoints and is hosted on Vercel's secure infrastructure.
• Regular security reviews: We periodically review our security practices and update them in response to new threats.

Despite our best efforts, no security system is impenetrable. In the event of a personal data breach that poses a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with GDPR Art. 33 and Art. 34 within 72 hours of becoming aware of the breach.

14. Children's Privacy

Shotexa is not intended for use by children under the age of 16. We do not knowingly collect personal data from children under 16 years of age. In jurisdictions where the digital age of consent is set at 13 (including the United States), Shotexa is not directed at children under 13.

If we become aware that we have inadvertently collected personal data from a child under the applicable age threshold without verifiable parental consent, we will take immediate steps to delete that information from our systems.

If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us immediately at info@rockuno.com.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you via an in-app notification or email at least 14 days before the changes take effect
• Where required by law, ask for your consent to new processing activities

Your continued use of Shotexa after the effective date of a revised Privacy Policy constitutes your acceptance of the changes. If you do not agree to the updated policy, you must stop using the app and delete your account.

Previous versions of this Privacy Policy are available upon request.

16. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. As Rockuno is based in Germany, the competent lead supervisory authority depends on your state of residence. For general complaints, you may contact:

You may also contact the supervisory authority of the EU member state in which you habitually reside, work, or where the alleged infringement occurred.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

We aim to respond to all privacy-related inquiries within 30 days. For urgent matters, please indicate "URGENT" in your email subject line.