Record of Processing Activities
Record of Processing Activities (RoPA) - in accordance with GDPR Art. 30
Data Controller
Company: MP Merlin Limited
Address: 97 Wordsworth Road, M27 9SJ, Swinton, UK
Contact email:support@upvinti.com
Personal Data Processing Activities
| Processing activity | Purpose of processing | Legal basis | Data subjects | Data categories | Data recipients | Retention period | International transfers |
|---|---|---|---|---|---|---|---|
| 🔐 Account registration | Providing online service | Art. 6(1)(b) GDPR - performance of contract | Service users | Name, email, password (hash) | Supabase (database hosting) | Until account deletion | UK/EU (Standard Contractual Clauses) |
| 🖼️ Image processing | Providing AI service (generation, enhancement) | Art. 6(1)(b) GDPR - performance of contract | Service users | Product photos, clothing images | Google AI (Gemini), Lovable AI, Supabase Storage | Max. 50 recent generations / until deletion | USA, UK/EU (Standard Contractual Clauses) |
| 💳 Payment processing | Transaction and subscription processing | Art. 6(1)(b) GDPR - performance of contract, Art. 6(1)(c) - legal obligation | Paying customers | Payment data (Stripe), transaction history | Stripe (payment processor) | According to tax requirements (min. 7 years) | USA (Standard Contractual Clauses) |
| 📧 Newsletter and marketing | Sending newsletter and marketing communications | Art. 6(1)(a) GDPR - user consent | Newsletter subscribers | Email, consent date | Resend (email service) | Until consent withdrawal | USA (Standard Contractual Clauses) |
| 📊 Analytics cookies | Traffic analysis and UX optimization | Art. 6(1)(a) GDPR - user consent | Website visitors | IP address, device type, browser | Lovable Analytics | According to cookie settings | None |
| 👤 Custom AI models | AI service personalization (custom models) | Art. 6(1)(b) GDPR - performance of contract | Users with custom models | Person photos, physical description (age, height, body type) | Supabase Storage, Google AI (portrait generation) | Until model or account deletion | UK/EU, USA (Standard Contractual Clauses) |
| 🛡️ Device Fingerprinting (Fraud Prevention) | Protection against fraud, multi-account abuse, promo code abuse | Art. 6(1)(f) GDPR - legitimate interest | All users | Device hash, browser, OS, screen resolution, timezone | Supabase (internal database) | 12 months from last activity | UK/EU (Standard Contractual Clauses) |
Data protection contact
For questions regarding personal data processing, contact us:
support@upvinti.comRelated documents
Full data protection information can be found in:
Privacy PolicyLast updated: 26 November 2025