Legal
Last updated: 6 July 2026. This notice explains how personal data is processed when you use WallpackAI (wallpackai.com).
The controller within the meaning of the GDPR is Mustafa Yesilyayla (trading as “WallpackAI”), Kurt-Schumacher-Straße 76, 67663 Kaiserslautern, Germany, email service@wallpackai.com. Further details are provided in the Imprint.
The application runs on Firebase App Hosting (Google Cloud) in the EU region europe-west4 (Netherlands); associated background processing runs in europe-west1 (Belgium). The provider is Google Ireland Ltd. / Google LLC. When you access the site, the infrastructure processes technically necessary access data (including IP address, time, requested resource, and user agent) in order to deliver and secure the service. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).
We use technically necessary cookies for sign-in, billing, and secure downloads. We store your cookie choice in the cookie wallpack_cookie_consent (lifetime up to 180 days). Optional product analytics (see section 8) and optional marketing/conversion measurement (see section 9) are only activated after your explicit consent. The storage or reading of non-essential information is based on your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your consent at any time with effect for the future via “Cookie settings” in the footer of every page.
To use the service, you create an account via Firebase Authentication – either with email/password or via “Sign in with Google”. In doing so we process your email address, authentication identifiers, and the status of your email verification. When you sign in with Google, Google’s privacy notices additionally apply. The legal basis is the performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR).
To provide the service, we store your project information (guided preset inputs, jobs, job status, credits) in Google Cloud Firestore and the generated image files in Firebase Storage – in each case scoped to your account and accessible via time-limited, signed URLs. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).
For image generation and upscaling, we transmit data to our image processor Runware (api.runware.ai). Depending on the job, this includes: the prompts derived from your preset inputs; the generated artwork as image data when it is sent as a reference for ratio variants or mockup renders; the artwork image file itself when it is upscaled for print exports; and provider-side image identifiers of previously generated images. Runware processes this data solely to provide the generation, variant, mockup, and upscaling service and returns the resulting images to us, where they are stored in your account (see section 5). Data may be processed outside the EU/EEA; in that case we base the transfer on the European Commission’s Standard Contractual Clauses (Art. 46 GDPR). The legal basis for the processing is the performance of a contract (Art. 6(1)(b) GDPR).
We process payments and subscriptions via Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.). Your payment data (e.g. card details) is processed directly by Stripe; we do not store full card details. We process the associated billing and contract data (plan, status, payment references). The legal bases are the performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in fraud prevention (Art. 6(1)(f) GDPR).
Only with your consent do we use Firebase Analytics (Google) to improve the service. Without consent, no analytics takes place. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time.
Only with your consent to marketing cookies do we use Google Ads conversion tracking (Google Ireland Ltd. / Google LLC) to measure whether our ads lead to signups and purchases. We have implemented Google Consent Mode v2: all advertising signals default to “denied” and are only enabled after you allow marketing cookies in the cookie banner. With marketing consent we also store campaign parameters of your first visit (UTM parameters, Google click ID, referrer) in your browser and link them to your account when you sign up, so we can evaluate which channel brought you to us. When you make your first purchase, we may additionally transmit your email address to Google in pseudonymized, hashed form (SHA-256) together with the Google click ID to confirm the conversion (“enhanced conversions”). The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time via “Cookie settings” in the footer. Google may process this data in the USA; the transfer is based on the EU–US Data Privacy Framework and Standard Contractual Clauses (Art. 44 et seq. GDPR).
When you contact us via the contact form or by email, we process your information (e.g. email address and message) in order to handle your request. The legal basis is our legitimate interest in responding (Art. 6(1)(f) GDPR) or the performance of a contract (Art. 6(1)(b) GDPR).
We use carefully selected service providers as processors or recipients: Google/Firebase (authentication, Firestore, Storage, hosting, optionally Analytics and Ads conversion measurement), Stripe (payments), and Runware (AI image generation). Data processing agreements pursuant to Art. 28 GDPR are in place with our processors.
Where data is transferred to recipients outside the EU/EEA (e.g. to the USA), this is done on the basis of appropriate safeguards, in particular the EU Standard Contractual Clauses, or an adequacy decision (Art. 44 et seq. GDPR).
We process personal data only for as long as is necessary for the stated purposes or as required by statutory retention periods (in particular under commercial and tax law). Account and project data are removed when the account is deleted (see section 15).
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on a legitimate interest (Art. 21). You can withdraw any consent you have given at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority; the authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate.
You can delete your account and the associated data at any time in your account settings. Please send requests regarding your rights to service@wallpackai.com.
We update this privacy policy when the processing or the legal situation changes. The version published on this page at the relevant time applies.