CREATE MY SPACE
Privacy policy
Last updated: 27 October 2026. This policy describes the Create My Space website and enquiry form.
Controller
Niklas Horstmann, Wanner Str. 22, 45888 Gelsenkirchen, Germany. Email: hello@create-my-space.de. Phone: +49 174 7205407.
Visiting the website
The hosting provider processes connection data including IP address, time, requested address, browser information and security logs. This supports delivery, security and troubleshooting. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in a secure and available website. We use no analytics, advertising trackers or externally loaded fonts.
Enquiries and required information
We process your name, email address, space type, ideas and room photos to review your enquiry, prepare a concept and reply. Business or property name, phone number, budget, measurements, frame preferences, timing and further notes are optional. Required fields, including at least one room photo, are marked. The form cannot be submitted without them. The legal basis is Article 6(1)(b) GDPR for pre-contractual steps you request, or Article 6(1)(f) for contacts acting for a legal entity, based on our interest in business communication. We do not use these details for general advertising.
Photos and browser processing
Selected photos are initially displayed only in your browser. Before upload, they are resized to a maximum of 2,400 pixels on the longest edge and re-encoded as JPEGs. Original metadata, such as GPS coordinates, is not retained. These planning copies are not print-ready files. Photos and details are only uploaded when you send the enquiry. The site does not permanently save form contents on your device. Unsent information may be lost when you leave or reload the page. Share only necessary content and avoid identifiable people or confidential documents.
Hosting and private storage
We use Vercel Inc., 440 N Barranca Avenue, Suite 4133, Covina, CA 91723, USA, for hosting. Enquiry details, room photos and delivery records are stored in a dedicated Neon, LLC database accessible only from server-side code. Processing and the database are configured for Frankfurt. Files are not publicly available; protected download links expire. Access is restricted to authorised people and necessary technical providers. The providers’ international infrastructure and support may involve other processing locations, including the USA. Information and data-processing agreements: https://vercel.com/legal/dpa, https://vercel.com/legal/privacy-policy, https://neon.com/security and https://neon.tech/dpa.
Email delivery and personal correspondence
We use Resend, operated by Plus Five Five, Inc., USA, for acknowledgements, enquiry notifications and receiving messages sent to hello@create-my-space.de. The domain is configured for Europe, Ireland. Sender, recipient, subject and message content are processed. Form photos remain in private project storage; notifications contain protected download links valid for 90 days. Incoming emails and attachments are forwarded to our Gmail account for personal review. Large attachments may be stored privately and made available through protected links. Gmail is provided by Google, in Europe Google Ireland Limited. These services may also process data outside the EU, including in the USA. Information: https://resend.com/legal/privacy-policy and https://policies.google.com/privacy?hl=en. Processing supports the requested correspondence on the legal bases described above. Email content does not trigger autonomous AI actions.
Personal review and AI
Successful submission is confirmed on the website. You also receive an acknowledgement by email. We review enquiries personally. For your art concept, we may analyse room photos with AI and edit them for previews, for example to show proposed wall art in your interior. The form currently does not automatically send photos to an AI service. Before external processing, we identify the provider, purpose, necessary content and possible international transfers and agree the use with you. Only photos needed for the project are used. An enquiry does not authorise publication or general AI model training. Where processing is necessary for the concept you request, the pre-contractual legal basis stated above applies; any separately required consent is obtained beforehand. Website examples contain no client photos.
Form security and cookies
The website uses no analytics or advertising cookies and no long-term local storage for enquiries. Short-lived signed form tokens support secure submission and are held only in memory. To limit misuse, pseudonymised security counters are stored for up to 72 hours. IP addresses are not stored in plain text for these counters. The legal basis is Article 6(1)(f) GDPR.
Retention and deletion
Abandoned or incomplete enquiries and their photos are removed by a daily cleanup no later than 72 hours after creation. Completed enquiries and planning copies are scheduled for deletion after 180 days and removed in the following daily cleanup. If an order is placed, necessary records may be processed outside this website’s storage. Statutory retention obligations, for example for invoices and business correspondence, continue to apply. Other records are deleted when no longer needed for their purpose. These periods apply to private project storage. Messages, attachments and protected links may also be included in email correspondence, which is deleted according to its purpose and applicable statutory retention requirements.
Your rights
Subject to legal conditions, you may request access, rectification, erasure, restriction of processing and data portability. Where consent is the legal basis, you may withdraw it for the future. You may object to processing based on legitimate interests on grounds relating to your particular situation. Contact the controller using the details above. You may complain to a data protection authority, including the North Rhine-Westphalia authority: https://www.ldi.nrw.de. We do not make automated decisions with legal or similarly significant effects.