Privacy Policy

Lychy Magical Studio — Last updated: 14 November 2026

This Privacy Policy explains what personal data Lychy Magical Studio (“we”, “us”, “our”) collects when you visit tatianalychy.com or subscribe to the Studio, and what we do with it.

This site is operated by Tatiana Golovko, trading as Lychy Magical Studio. Payments are processed by Whop Inc. as the merchant of record. Contact: tatianalychy@gmail.com. For the data described in this policy, we act as the data controller under UK GDPR.

1. What data we collect ourselves

Our website itself collects very little:

  • Your email address. When you sign in, we keep your email address so that we can send you a one-time sign-in code, recognise your account and fill it in on the payment form. The code is stored only in a protected form and expires after 10 minutes.
  • A sign-in cookie. When you sign in, we set one small, secure cookie in your browser that just remembers which account you’re signed in as, so you don’t have to log in again on every visit. It contains no card details, password, or other personal data — only an account reference, and it is encrypted/signed so it can’t be tampered with. It expires automatically after 30 days.
  • A language preference. If you switch the site between English and Russian, we remember that choice in your browser’s local storage, on your device only. We don’t send it anywhere.

We use Vercel Analytics, a privacy-friendly, cookieless visit counter, to see how many people visit the site and which pages they view. It does not use cookies, does not track you across other websites, and does not collect your name, email, or any other personally identifying information — only anonymous, aggregated visit counts. We do not run any advertising trackers. We do not store names, postal addresses or card details. We do keep a record of your account: your email address, your credit balance and your purchase history (see Section 5).

2. Service providers we use

To run the Studio, we share a small amount of data with a few outside services that process it on our behalf:

  • An AI content-generation service. When you type something into a generator (a scene description, an idea, or answers about your own offer), or upload an image to a generator, that text and/or image is sent to a third-party AI provider to produce your result. No name or email is included — only what you typed or uploaded. These providers process the content outside your country of residence, including in the US and the EU.
  • Cloud storage and hosting providers. Images and videos that some generators create for you, and public reviews people submit (name if given, review text, rating), are stored with our hosting/cloud storage provider (processing in the United States).
  • A private notification tool. When someone submits a review, it is automatically translated by an AI service so we can read it, and a short notification (the rating, name if given, and a snippet of the text) is sent to us through a private messaging tool so we know to check it — this goes only to us, for moderation.
  • An email delivery service. To send you a sign-in code, we pass your email address and the code to a service that delivers the letter. It keeps the letter for about 30 days and stores its records in the United States.
  • A database service. Your account record — your email address, credit balance, the mark that your gift credits were given, your purchase history and the consent you give before a payment — is stored with a managed database service.
  • A rate-limiting service. To enforce usage limits fairly — free tries and the limits of your plan — we store a simple usage counter linked to your IP address or account ID — no text or images, just a count.

To perform the generation, your requests and uploaded images are transmitted to third-party AI services. Only store or submit data you have the right to use.

We don’t sell this data, and we only send each provider what’s needed to run the specific feature you’re using.

3. Data collected by Whop (our payment provider)

When you buy a subscription or a credit pack, payment is taken in Whop’s payment form shown on our site. Whop is our payment processor. Whop collects and processes information such as your email address, name, billing address, and payment card details, in order to process payment, apply tax (VAT/sales tax) where required, and manage your purchase.

For that data, Whop acts as an independent data controller in its own right (not simply as our processor) — Whop decides how it handles payment, fraud-prevention, and tax data for its own regulatory and business purposes. From Whop we receive the payment reference, what was bought (product and plan) and the time of payment; for a refund, also the amount and currency. We do not read or store your card number, name or billing address. To link your payment to your account here, we give Whop a reference to your account on this site and your email address. For full details of what Whop collects and how it’s used, see Whop’s own Privacy Policy at whop.com.

4. What we use this data for, and our legal basis

  • To let you log in and access the Studio you’ve paid for — necessary to perform our contract with you.
  • To check that your subscription is active before letting you use the generators — necessary to perform our contract with you.
  • To keep your credit balance and purchase history — necessary to perform our contract with you.
  • To keep a record of the consent you give before a payment — necessary to comply with our legal obligations.
  • To give the gift credits once per account — based on our legitimate interest in preventing misuse.
  • To respond if you contact us for support — necessary to perform our contract with you, or based on our legitimate interest in providing customer support.

We do not sell your data. We only share it with the service providers described in Section 2, Whop (to process your payment), and, if legally required, relevant authorities.

5. How long we keep it

The sign-in cookie expires automatically 30 days after you sign in, or immediately if you log out or clear your browser’s cookies. We don’t keep any copy of it on our own servers — it lives only in your browser.

  • Your account record — your email address, credit balance and the mark that your gift credits were given — is kept for as long as your account exists.
  • Usage counters (IP address or account ID). The counters that enforce usage limits are short-lived and expire automatically — guest counters keyed to an IP address after about 90 days.
  • Purchase history and payment records are kept for 180 days.
  • The consent you give before a payment is kept for 7 years.
  • Generated images and videos, and saved galleries are kept for a limited time and then removed.
  • Public reviews you submit are kept while they are shown on the site; you can ask us to remove yours by email.
  • You can ask us by email to delete your account record; we will delete everything the law does not require us to keep.

6. Your rights

If you are in the UK or EU, under GDPR you have the right to ask what personal data is held about you, ask for it to be corrected or deleted, restrict or object to how it’s used, and (where technically possible) receive it in a portable format. Payment and billing data is held by Whop as an independent controller (see Section 3), so requests about billing should go to Whop directly. For anything relating to our own website (your account record, the cookie, language preference, or service providers described above), email tatianalychy@gmail.com and we’ll help.

If you’re not satisfied with how we’ve handled your data, you have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, or your local data protection authority if you’re outside the UK.

7. Cookies and local storage

We use only essential cookies, strictly necessary for the service to work — no tracking or advertising cookies, so no separate consent is required under UK/EU cookie law. Our visit counter is cookieless. The cookies we set are:

  • whop_session — keeps you signed in; expires after 30 days.
  • gift_device — keeps the gift credits to one per browser; expires after 2 years.
  • seasonal_session — links your Seasonal Miniatures gallery to your browser; expires after 1 year.

We also use your browser’s local storage, on your device only, for small conveniences — such as your language choice and some apps’ recent history. This never leaves your device and we cannot read it.

8. Children

The site and its tools are intended for adults (18+). They are not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, email tatianalychy@gmail.com and we will delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we’ll update the “Last updated” date above.

10. Contact

For questions about this policy or your data, email tatianalychy@gmail.com.