Privacy policy

What personal data we collect, why, who we share it with, and your rights.

Version 2026-10-20 · in force from 20 October 2026

This Privacy Policy explains what personal data Inni collects when you use inni.com, a store on Inni, or the Inni app, why we collect it, who we share it with, and your rights under the General Data Protection Regulation (GDPR).

1. Who is the data controller?

INNI Finland Oy (Business ID 3649689-6), Satamakatu 1, 00160 Helsinki, Finland, is the data controller for personal data processed through Inni. You can reach us at hello@inni.com.

2. Data we collect

Account data

When you create an account we collect your name, email address and a hashed password. If you sign in with Google we receive your name, email address and Google account ID from Google. If you invite people to a team or a store we store their email address and role.

Profile and public content

If you fill in a public profile (username, picture, bio, links) or make a design public, that information is visible to anyone. Follows are visible on public profiles. You decide what to make public and can make it private again at any time.

Designs and uploads

When you design a product we store the artwork, text, colours, placement and product choices that make up the design, and any images you upload. We use them to show previews, to produce the print files and to fulfil orders. Designs, uploads and AI prompts may be checked by automated tools and by people to enforce our Content policy; a refused design and the reason are kept with the order.

AI tools

When you use the AI tools (for example generating an image or removing a background), your prompt and the images involved are sent to our AI service provider to produce the result, and checked to prevent misuse.

Orders

When you buy something we collect your name, email address, phone number, delivery address, the items and designs ordered, and the order and delivery status. You can buy from a store without an account; we then keep the same details for that order. Card payments are handled by Stripe: we never see or store your card number.

Stores

If you buy from a store run by another person or company on Inni, the store owner sees your order: the order number, the products, the amount and the country it goes to. The store owner never sees your name, email address, phone number, delivery address or tracking number. Inni handles customer service for every order.

If you run a store, we store its details and, for payouts, Stripe holds your identity and bank details.

Messages

If you contact us through the contact form, or send a message to a creator through their page, we store your name, email address and message, plus your IP address and browser details for abuse prevention. A message to a creator is forwarded to them by email so they can reply to you.

Technical data

Our servers record your IP address, browser and device details, and the pages you request, for security, debugging and abuse prevention. Errors are reported to our error-monitoring service.

3. Cookies and browser storage

We only use cookies that are needed for the site to work: a session cookie that keeps you signed in and your basket, and a security cookie that protects forms. We also store some choices in your browser's local storage, such as unsaved design drafts and interface settings. We do not use analytics, advertising or tracking cookies, so there is no cookie banner.

4. Who we share data with

We share personal data only with the companies that help us run Inni, and only what each one needs:

  • Amazon Web Services — servers, database, file storage, content delivery and email (EU, Frankfurt).
  • Laravel Forge — server management.
  • Stripe — payments, refunds and payouts to store owners.
  • Pure Waste Textiles Oy — production, warehouse and shipping of your order, and its order system (Odoo, hosted by Avoin Systems).
  • nShift, Posti and DHL — shipping labels, delivery and delivery estimates. Carriers receive your name, address and phone number to deliver your parcel.
  • Immersive — the 3D studio, the AI tools and content checks. Prompts, images and design text are processed for it through OpenRouter by AI model providers, including Google and TypeSafe AI.
  • Google — sign-in with Google, if you choose it.
  • Cloudflare — bot protection on the contact form (Turnstile).
  • Sentry — error monitoring (EU).
  • Bunny.net — web fonts (EU).

Store owners see their buyers' orders, as described above. We do not sell personal data or share it for advertising.

  • Contract — to provide your account, make and deliver your order, and pay store owners and creators.
  • Legitimate interests — security, abuse prevention, error monitoring, and showing store owners the orders placed in their store.
  • Legal obligation — keeping accounting records and answering lawful requests.

6. How long we keep data

Account data is kept until you delete your account. Deleting your account removes it straight away from our application. Orders and payment records are kept for as long as Finnish accounting law requires, even after the account is deleted. Designs and uploads are kept until you delete them or your account. Messages are kept as long as needed to handle them. Server logs are kept for a limited time for security.

7. Where data is processed

Our servers and database are in the European Union (AWS, Frankfurt, Germany). Some providers, such as Stripe, Google and the AI model providers, may process data outside the European Economic Area. Where they do, the transfer is covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

8. Your rights

Under the GDPR you have the right to:

  • Access — get a copy of the personal data we hold about you.
  • Rectification — correct inaccurate data.
  • Erasure — ask us to delete your data.
  • Restriction — ask us to limit how we use your data.
  • Portability — receive your data in a machine-readable format.
  • Objection — object to processing based on legitimate interests.

To use any of these rights, email hello@inni.com with the subject "Data Rights Request". We answer within one month. You can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or the data protection authority where you live.

9. Security

We protect your data with encryption in transit, access controls and regular security reviews. No system is completely secure, but we work to keep your data safe and will tell you if a breach affects you.

10. Age

Inni is for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy. When we make important changes we will tell you by email or with a notice on the site. The date at the top of this page shows the latest version.

12. Contact

Questions about this policy? Email us at hello@inni.com or write to INNI Finland Oy, Satamakatu 1, 00160 Helsinki, Finland.