Privacy Policy

1.Who We Are

UIpick is operated by SIA NXM, a company registered in Riga, Latvia, LV-1048 ("UIpick", "we", "us", "our"). We run the website uipick.net and the marketplace on it. For anything to do with your data, write to [email protected].

For the purposes of the GDPR, SIA NXM is the data controller for the personal data described here.

2.What This Policy Covers

Everything we collect through the website and the services behind it: creating an account, buying assets, subscribing to a membership, applying to sell, submitting work for review, and contacting support. Using UIpick means these practices apply to you. If you'd rather they didn't, please don't use the service.

3.Data We Collect

3.1 Account data

• Your email address, and your name and username if you give them
• Your password, stored only as a hash — we never see or keep the password itself
• Account preferences, including your interface theme and whether interface sounds are on

3.2 Purchases and membership

• Which assets you've bought and downloaded, and when
• Your plan, billing period, renewal date and payment status
• Billing details are handled by Stripe. We receive a record that a payment succeeded and the billing country for VAT — never your card number.

3.3 Author data

• Your application: portfolio links, the message you write, and anything you attach
• Assets you submit: files, previews, descriptions, prices and the review decisions on them
• Earnings and payout history
• Identity and bank details for payouts are collected by Stripe directly through Stripe Connect onboarding. We see whether onboarding is complete and what you are owed, not your bank details.

3.4 Usage and device data

Standard server and security logs: IP address, browser and device type, pages requested, and the time of each request. We use them to keep the service running and to investigate abuse. We also read the country our CDN derives from your IP address, to show prices in a sensible currency — the country, not the address itself, and we don't store it.

3.5 Communications

Anything you send through the contact form or by email, and comments you post on product pages.

3.6 Stored in your browser, not by us

Your cart, your theme choice and your interface-sound preference live in your browser's local storage until you check out or clear them. They never reach our servers.

4.How We Use Your Data

Each use below names the lawful basis we rely on under the GDPR.

• Running your account and your purchases — signing you in, giving you your downloads, managing your membership. Necessary to perform our contract with you.
• Reviewing author applications and submissions, and paying authors — necessary to perform our contract with authors.
• Support — answering what you ask us. Our legitimate interest in helping the people who use UIpick.
• Fraud, abuse and enforcement — spotting shared accounts, scripted downloading and chargeback abuse. Our legitimate interest in protecting the service and its authors.
• Transactional email — sign-in links, receipts, renewal and payout notices. Necessary to perform our contract with you.
• Legal and tax records — invoices and VAT records. Necessary to comply with a legal obligation.

We don't send marketing email today. If that changes, it will be opt-in, and every message will carry an unsubscribe link.

5.Storage & Retention

5.1 Closing your account

Ask us and we'll delete your account, your profile, your favourites and your comments. Records of completed purchases and payouts stay for the tax period above, because we're required to keep them — they hold the transaction, not your browsing.

5.2 Where it lives

Our database, sign-in and file storage all run on Supabase; asset files and previews are stored there too. Payment data lives with Stripe.

6.Data Sharing

We don't sell your personal data, and we don't share it with advertisers. We use a small number of processors to run UIpick, each under a data processing agreement, and each gets only what its job needs:

Beyond that, we disclose data only where the law requires it, or to establish or defend a legal claim — a chargeback dispute, for instance. If UIpick is ever sold or merged, account data would transfer with the business, and we'd tell you before it did.

Some things are public by design: your username, your public profile, and, for authors, your listed assets and the comments you post.

7.Analytics & Cookies

UIpick uses PostHog EU Cloud in strict cookieless mode to understand page visits, referrers and browser/device categories. It does not set analytics cookies or persistent browser storage, identify visitors, create person profiles or record sessions. PostHog derives a short-lived, privacy-preserving visitor count and discards the IP address before analytics enrichment. We use this limited audience measurement under our legitimate interest in improving the marketplace.

8.Your Rights

Under the GDPR — and under similar laws elsewhere — you can ask us to:

• Give you a copy of the personal data we hold about you
• Correct anything inaccurate or incomplete
• Delete your data, subject to the retention rules in section 5
• Restrict or object to how we're using it
• Send it to you, or to another service, in a portable format
• Withdraw consent where we relied on it, without affecting what we did beforehand

Write to [email protected] and we'll answer within 30 days. We may need to confirm it's really you first. If you think we've got it wrong, you can complain to your local data protection authority — in Latvia, the Data State Inspectorate (dvi.gov.lv).

9.Content You Upload — Your Responsibilities

By uploading anything to UIpick, you confirm that:

• You own it, or you have the rights to sell and distribute it
• It contains no personal data about anyone else that you aren't entitled to share — including photographs of identifiable people who haven't agreed to it
• It's lawful, and doesn't infringe anyone's intellectual property or privacy

We remove content that breaks these conditions, and can suspend or close the account behind it.

10.Ownership of Uploads

Authors keep full ownership of what they upload. Listing work on UIpick transfers no intellectual property to us — it grants us the right to host, display and distribute it to buyers and members under the License Terms, for as long as the asset is listed. Take it down and that right ends, though people who already bought it keep their license.

11.Children

UIpick isn't meant for children, and we don't knowingly collect data from anyone under 16. If you believe a child has given us personal data, tell us and we'll delete it.

12.Security

Traffic is encrypted in transit over HTTPS. Passwords are hashed, never stored in readable form. Database access is restricted by row-level security, so one account can't read another's data. Card and bank details never touch our servers — Stripe holds them under PCI-DSS. No system is perfectly secure; if you think your account has been compromised, email us straight away and we'll help you lock it down.

13.International Data Transfers

UIpick is operated from Latvia. Our processors — Supabase, Stripe and Google — may process data outside the EU/EEA, including in the United States. Where they do, transfers are covered by the European Commission's standard contractual clauses or an equivalent safeguard, agreed in our contracts with them.

14.Changes to This Policy

When this policy changes we update the date at the top of the page. If a change materially affects how we use your data, we'll tell registered users by email or an in-app notice at least 14 days before it takes effect.

15.Contact

Privacy questions, or a request under section 8: [email protected], or the contact page.

SIA NXM · Riga, Latvia, LV-1048