Privacy Policy

The data controller is Mashrokit Ltd (משרוקית בע"מ), company number 515328235, HaBanai 6, Modi'in 7176213, Israel. For any privacy question, write to hello@skinspawn.com.

Only what an order needs:

• The image you upload. We strip its embedded metadata — including any GPS location your camera recorded — before storing it.
• Your email address, so we can send you the link to your item.
• Your Roblox username, so the item is named and described for you. We verify it exists using Roblox’s public API.
• Any notes you type in the optional field on the order form.
• Order and payment records — amount, currency, timestamps, and the payment reference issued by Paddle.
• Server logs containing IP address and request details, kept briefly for security and debugging.

We never receive your card number, expiry date or security code. Those go directly to Paddle.

• To perform our contract with you — generating and publishing your item, and emailing you the result.
• To meet legal obligations — Israeli tax and accounting law requires us to retain transaction records.
• For our legitimate interests — preventing abuse and fraud, and keeping the service working.

We do not use your data for advertising and we never sell it.

Fulfilling an order necessarily involves sending your image to AI providers and to Roblox. These are our processors:

We may also disclose data where the law requires it, or to establish or defend a legal claim.

We are established in Israel, which the European Commission recognises as providing an adequate level of data protection. Our infrastructure and AI providers are in the United States; those transfers rely on the European Commission’s Standard Contractual Clauses or on the provider’s certification under the EU–US Data Privacy Framework.

• Your uploaded image: 90 days. Deletion is automatic — enforced by a storage lifecycle rule, not by anyone remembering to do it.
• The generated item file: while the item remains published, so we can support it.
• Order and payment records: seven years, as required by Israeli tax law.
• Server logs: up to 30 days.

Note that once an item is published on Roblox it lives on Roblox’s systems under their policies, and deleting our copy does not remove it from there. Ask us and we will take the item down.

Under the Israeli Privacy Protection Law, 5741-1981 and — where it applies to you — the GDPR, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to its processing, or provide it in a portable format. Email hello@skinspawn.com and we will respond within 30 days.

If you are in the EEA or the UK you may also complain to your national supervisory authority.

This site sets no advertising or analytics cookies, and we run no third-party trackers. The only browser storage we use is what Next.js needs to serve the pages. Paddle’s checkout is hosted on Paddle’s own domain and is covered by Paddle’s privacy notice.

The service is sold to adults: you must be 18 or over to order, as set out in our terms. We do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.

Uploads and generated files are stored in a private bucket with public access blocked and encryption at rest; they are reachable only through short-lived signed links. Database connections are encrypted and certificate-verified. Access is limited to the people who need it.

If we change this policy we will update the date at the top of this page. Material changes affecting existing orders will be emailed to the address on the order.