ViCake

Privacy Policy

Last updated: 2026-05-30

1. Data controller

The controller of your personal data is Wiktoria, operating under the ViCake brand as jednoosobowa działalność gospodarcza (JDG) (Poland), based in Gdańsk. Privacy contact: kontakt@vicake.example.

2. What data we process

  • The content of messages you send us via Instagram Direct.
  • Your Instagram username, the language you write in, any reference images you attach.
  • Order details you share with us: date, number of guests, fillings and sponge, design, delivery address, name and phone number.

3. Why we process it

  • To respond to inquiries and prepare your order — legal basis: Art. 6(1)(b) GDPR (steps to enter into and perform a contract).
  • To comply with tax and accounting obligations — Art. 6(1)(c) GDPR.

4. AI assistant

First replies in Instagram DM are drafted by a virtual assistant. To do so, the content of your message is sent to language models from Anthropic (Claude) and Google (Gemini). Every reply sent to you, every price, and every prepayment request is reviewed and approved by Wiktoria personally. We do not make automated decisions producing legal effects on you within the meaning of Art. 22 GDPR.

5. Who we share data with

  • Meta Platforms Ireland Ltd. — operator of Instagram, whose API we use to receive and send messages.
  • Anthropic, PBC (USA) — drafting reply text using the Claude model.
  • Google LLC (USA) — classifying the message type using the Gemini model.
  • Neon Inc. (USA, EU hosting — Frankfurt) — Postgres database.
  • Vercel Inc. (USA) — website hosting.
  • Telegram FZ-LLC — notification channel for Wiktoria.

Data transfers to the USA rely on the Standard Contractual Clauses (SCCs) approved by the European Commission.

6. How long we keep the data

Correspondence and order details are kept for the duration of our cooperation and for the period required by tax law (typically 5 years from the end of the relevant fiscal year). On your request we delete the data earlier, to the extent it does not conflict with legal obligations.

7. Your rights

You have the right to access, rectify, erase, restrict processing, port your data, and object (Art. 15–22 GDPR). To exercise these rights, email kontakt@vicake.example. You also have the right to lodge a complaint with the Polish Personal Data Protection Authority (UODO, ul. Stawki 2, 00-193 Warsaw).

8. Cookies and analytics

The ViCake website does not currently use tracking cookies or analytics tools. If that changes, we will update this policy.

9. Children

The service is not directed to people under the age of 16. If we learn that we have inadvertently collected data of such a person, we will delete it.

10. Changes to this policy

The current version is published on this page. The last-updated date is shown at the top of the document.