Sartia

Privacy policy

Effective date: October 1, 2026. Last updated: October 1, 2026.

1. Who we are

Sartia is made by IOCODO LLC, a limited liability company registered in Wyoming, United States. We decide why and how the data described on this page is used, so under European data protection law we are its controller.

Email: support@iocodo.com. Use this address for anything about your data, including the requests described in Your rights.

2. What this policy covers

This policy covers the Sartia app on iOS and Android, and this page.

Here, "personal data" means any information about you as a person who can be identified, directly or indirectly. That includes identifiers such as a user ID, an installation ID or a device token, even when they do not contain your name.

3. Data that stays on your device

Sartia keeps the following in its own storage on your device. We do not receive it, unless another section of this policy says otherwise:

• your choices about usage statistics and crash reports, each with its date, the version of the text you answered, the app version, and the time zone and country settings the app read to decide whether to ask
• your answer to the notice about the AI providers, with its version and date
• a copy of which version of the terms of use you accepted, and when
• display settings, such as light or dark

If you back up your device with iCloud or Google, the backup can include a copy of this data, under Apple's or Google's terms. Uninstalling the app deletes it from the device.

4. Accounts and sign-in

Sartia uses Firebase Authentication, a Google service, to recognize your account.

When you first open the app, you use it as a guest: Firebase Authentication gives your installation a random user ID. It does not contain your name or email address, but it is a pseudonymous identifier: it links the data the app keeps on our servers to your installation.

If you sign in with Google, we receive from Google your email address, the name and profile picture of your Google account and a Google user ID, and Firebase Authentication stores them to keep you signed in.

If you sign in with Apple, we receive an Apple user ID and, the first time only, the name and email address you choose to share. If you choose to hide your email address, Apple gives us a private address that forwards to yours.

If you create an account with an email address and a password, Firebase Authentication stores your email address and a hashed form of your password. We cannot see your password.

5. What the app collects

What you create

The descriptions you type, the concepts drawn from them, the designs you keep (with their garment, color, print position and any lettering you add), the images you upload, your collections and favorites, the pieces in your bag, and when you last opened a design. They are stored on our servers and are private to your account: other users cannot see them.

When you order

Your first and last name, delivery address, phone number (for the courier), email address (for the receipt and for questions about the order), the pieces and sizes you ordered, the delivery method, the amounts, the status and tracking of the order, the version of our terms you accepted and your confirmation that you are 18 or older. You can save addresses in the app's address book, and the app remembers the size you last ordered for each garment.

Payments

Stripe collects your card or wallet details directly. We receive the result of the payment and a reference, never your full card number.

Problems with an order

When you use Get help with this order, we receive what went wrong, the note you write and the photos you attach.

Usage statistics and crash reports

With your permission where the app asks for it (see section 6), Firebase Analytics records which screens and features are used and works out an approximate location, such as the country or city, from a shortened form of your device's IP address, and Firebase Crashlytics records what happened when the app crashes, with the device model, the system and app version and installation identifiers. Sartia does not attach your user ID to them and adds no logs or custom data to crash reports.

Nothing is collected before you pass the app's first screen, where you accept the terms of use. You can turn usage statistics and crash reports on or off separately, at any time, in the app (You, then Privacy choices).

Your answers to the terms and to permission requests

When you accept the terms of use, answer about usage statistics or crash reports, or give or withdraw your permission for the AI providers, our server keeps a record of that answer with:

• what it was about, and your answer
• the version of the text you saw, and a fingerprint of that exact text
• the language, the screen and the button you used
• the app version, and whether your phone runs iOS or Android
• your user ID, and when you answered, by our server's clock and by your phone's

The record does not include your IP address or a device identifier.

Device checks

Firebase App Check asks Apple or Google to confirm that requests come from a genuine copy of the app, so that others cannot use our servers.

6. What we use data for, and on what legal basis

European data protection law (the GDPR) requires a legal basis for each use of personal data. For each use, here is the data involved and the basis we rely on.

• Run your account and keep your designs, bag, collections and addresses.
  Data: your account, what you create, your saved addresses and sizes.
  Legal basis: performance of our contract with you (GDPR art. 6(1)(b)).
• Draw concepts from your words, check content, and print your designs.
  Data: descriptions, lettering, uploaded images, designs.
  Legal basis: performance of our contract with you (GDPR art. 6(1)(b)). The app also asks your permission before your words or images first go to the AI providers (section 8).
• Take payment, make and deliver your order, and handle the first hour, cancellations, refunds and problems.
  Data: order details, payment result, problem reports.
  Legal basis: performance of our contract with you (GDPR art. 6(1)(b)).
• Tell you about your order with notifications.
  Data: a device token.
  Legal basis: your consent, which you give when you allow notifications (GDPR art. 6(1)(a)).
• Measure use and fix crashes.
  Data: usage events, crash reports, installation IDs.
  Legal basis, where the app asks: your consent (in the European Union and the European Economic Area, GDPR art. 6(1)(a)).
  Sartia is offered only in the United States. The app asks before usage statistics and crash reports start, each with its own answer, when your device is in one of these places:
  • the European Union, including Åland and the EU's outermost regions (such as the Canary Islands, Réunion or Saint Martin)
  • Iceland, Liechtenstein and Norway
  • Guernsey
  • the Faroe Islands, Greenland, and Svalbard and Jan Mayen
  • Saint Barthélemy, Saint Pierre and Miquelon, New Caledonia, French Polynesia, Wallis and Futuna, and the French Southern and Antarctic Lands
  • Canada, Türkiye and Vietnam
  The app tells where your device is from its time zone, or from its region setting when the time zone names no country. For Canada, Türkiye and Vietnam it also asks when your device's region or one of its languages is set to that country.
  Everywhere else, including the United Kingdom and Switzerland, nothing is asked: both are on unless you turn them off, and the app's first screen tells you about them before they start and lets you turn them off there. Everywhere, you can turn each one off at any time in the app (You, then Privacy choices).
• Prevent fraud and abuse, and keep the app secure.
  Data: device checks, order limits, payment disputes, the results of content checks.
  Legal basis: our legitimate interests (GDPR art. 6(1)(f)) in protecting buyers, us, and the people whose rights a design could infringe. You can object at any time by writing to us.
• Keep order records, answer legal claims, and report illegal content where the law requires it.
  Data: order records, problem reports, notices we receive.
  Legal basis: compliance with a legal obligation (GDPR art. 6(1)(c)), and our legitimate interest in defending legal claims (GDPR art. 6(1)(f)).
• Keep a record of the terms you accepted, of your age confirmation, and of your answers to permission requests.
  Data: the version of the terms, when you accepted them and confirmed you are 18 or older (each order carries that confirmation), your user ID, and the records of your answers described in section 5.
  Legal basis: our legitimate interest in being able to show what we agreed and what you answered (GDPR art. 6(1)(f)). For a consent you gave, also a legal obligation, because the law requires us to be able to show it (in the European Union and the European Economic Area, GDPR art. 7(1) and art. 6(1)(c)).

Sartia makes one automated decision that affects you: if a payment on your account is disputed with a bank, the account stops accepting new orders. Write to us if you think this is a mistake, and a person will review it.

7. Who receives data

We use these service providers to run Sartia. Each one receives only the data listed, for the purpose listed:

• Google LLC, Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, App Check, Remote Config, Cloud Messaging, Crashlytics and Analytics): runs accounts, the database, file storage, our server code, device checks, settings, notifications and statistics. It receives the data the app keeps on our servers, and the usage statistics and crash reports described in section 6. It processes this data on our behalf, under its data processing terms. Firebase privacy information
• Google LLC, Gemini models on Google Cloud Vertex AI: read your descriptions and write the art brief, and check lettering and uploaded images. It receives descriptions, lettering and uploaded images, and processes them on our behalf, under the Google Cloud data processing terms. Google Cloud privacy notice
• Features & Labels Inc. (fal.ai), United States: draws the concept images from the art brief. It receives the brief, which can include words you asked to have printed, and processes it on our behalf, under its data processing terms. Your device loads the concept images from fal.ai's servers, which see your device's IP address. fal.ai privacy policy
• Stripe, Inc., United States: takes payments. It receives your card or wallet details, the amount, the email address for the receipt, and references to the order and the account. It processes this data for us, and also uses it under its own privacy policy, for example to prevent fraud. Stripe privacy policy
• Gelato ASA, Norway, and the printers in its network: print and ship the pieces. They receive your name, delivery address, phone number, email address, the pieces and sizes, and the print files, and process them on our behalf, under Gelato's data processing terms. Gelato passes each order to a printer near the delivery address, and the parcel to a carrier, which receives your name, address and phone number. Gelato privacy policy
• Apple and Google: if you sign in with them, they share with us the data described in section 4. The App Store and Google Play also handle your download, under their own privacy policies.

In the current version of Sartia, we do not sell your personal data.

8. AI features

When you ask for a sketch, a new direction or a change, the app sends your description to Google's Gemini models on Google Cloud Vertex AI. They read it and write an art brief, which goes to fal.ai, whose image models draw the concepts. If the brief cannot be written, the sketch stops and fal.ai receives nothing. fal.ai never receives your name or contact details. Lettering you add and images you upload are checked by Google's Gemini models before they can become a design or be printed.

Before your words or images go to these providers for the first time, the app tells you this and asks for your permission. Without it, the app sends them nothing. You can withdraw your permission at any time in the app (You, then Privacy choices).

We do not use your descriptions, images or designs to train AI models. Google's terms for Vertex AI say that Google does not use this data to train or fine-tune its models without our permission, and we have not given it.

AI concepts can be wrong or look like existing work. Our terms of use explain what to keep in mind.

9. Notifications

If you allow notifications, Firebase Cloud Messaging gives your device a token, and the app stores it with your account so that we can tell you about your orders, for example when a parcel ships and when it is delivered. Today Sartia sends notifications only about your orders. If we want to send other kinds, the app will ask you first.

You can turn notifications off at any time in your device settings, or in the app (You, then Order updates). The token is deleted with your account.

10. Where data is processed

IOCODO LLC is registered in the United States, and our database and servers run on Google Cloud in the United States. Google, fal.ai and Stripe are based in the United States. Gelato is based in Norway and passes each order to a printer in its network close to the delivery address, which can be in another country.

Where European, UK or Swiss data protection law requires a safeguard for this, we rely on:

• the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, for providers certified under them (you can check a provider on dataprivacyframework.gov)
• the Standard Contractual Clauses approved by the European Commission, with the UK and Swiss adjustments, which are part of our providers' data processing terms

You can ask us for a copy of these safeguards at support@iocodo.com.

11. How long we keep data

• Your account, designs (including the concepts you did not keep), uploads, collections, bag, saved addresses and sizes: until you delete them or your account.
• Orders and the problem reports about them: up to 10 years after the order, for tax, accounting and product-safety reasons and in case of a dispute. If you delete your account before then, we keep them without your name, email address, phone number, delivery address and the link to your account.
• Photos attached to a problem report: until you delete your account.
• The record of the terms you accepted: with your account, and with each order for as long as we keep the order.
• The records of your answers to the terms and to permission requests: while you have your account. After you delete it, we keep them only to answer a legal claim about what you agreed to, and only for as long as a claim about that agreement can still be brought.
• At fal.ai: the text it receives is kept for 30 days, and the concept images it draws for at least 7 days, after which fal.ai can delete them. The image of a design you keep is copied to our own storage.
• Usage statistics: up to 14 months, then deleted automatically.
• Crash reports: 90 days, then deleted automatically.
• Notification token: until you delete your account.
• Reports of apparent child sexual abuse material: one year, as US law requires.
• Emails you send us: as long as we need them to deal with your request and any dispute about it.

When you delete your account or ask us to delete your data, we delete it as described here, unless the law requires us to keep part of it.

12. How we protect data

Data travels between the app and our service providers over encrypted connections (HTTPS).

Our providers encrypt the data they store for us, and the access rules of our database and file storage let each account read only its own data. Access to our systems is limited to the people who run Sartia, and only to run and support it.

If a security incident puts your personal data at risk, we tell you and the competent authorities when the law requires it.

13. Your rights

Wherever you live, you can ask us to:

• tell you what personal data we have about you, and give you a copy
• send that copy to you, or to another company, in a machine-readable format
• correct data that is wrong or incomplete
• delete your data
• stop or limit a use of your data, including any use based on our legitimate interests
• withdraw a consent you gave, at any time (this does not affect what we did before)

To ask, write to support@iocodo.com. It is free. We reply within one month, and we may ask you to confirm that the data is yours before we act.

Deleting your data

You can delete your account and its data:

• in the app: You, then Delete account and data
• on the web: iocodo.com/apps/sartia/delete-account
• by email: write to support@iocodo.com with the subject "Sartia Account Deletion"

The account deletion page lists what is deleted and what is kept. Data that stays on your device is deleted when you uninstall the app.

Complaints

You also have the right to complain to an authority:

• in the European Union and the European Economic Area, the data protection authority of the country where you live or work (list of authorities); in Italy, the Garante per la protezione dei dati personali
• in the United Kingdom, the Information Commissioner's Office
• in Switzerland, the Federal Data Protection and Information Commissioner
• in Brazil, the Agência Nacional de Proteção de Dados
• in the United States, the attorney general of your state

If you are in Brazil, you have the rights listed in article 18 of the LGPD (Lei 13.709/2018), and you can use them as described above.

14. Privacy rights in US states

Several US states, including California, Colorado, Connecticut, Oregon, Texas and Virginia, give their residents privacy rights. We give the same rights to everyone in the United States:

• to know what personal information we collect, use and disclose, and to get a copy of it
• to correct it
• to delete it
• to opt out of the sale of your personal information, of its use for targeted advertising and of profiling that has legal or similarly significant effects
• to appeal if we turn down your request
• not to be treated differently for using any of these rights

The personal information we collect, where it comes from, why we use it and who receives it are described in sections 5 to 8. In the current version of Sartia, we do not sell your personal information, and we do not use or share it for targeted advertising.

To use these rights, write to support@iocodo.com, or have someone you authorize write for you. We reply within 45 days. If we turn your request down, you can appeal by replying with the word "Appeal" in the subject. We answer an appeal within 45 days, and if you still disagree you can contact the attorney general of your state.

15. Children

Sartia is for adults: you must be 18 or older to use it, and it is not directed to children. We do not knowingly collect personal data from anyone under 18. If you think a child has given us personal data, write to support@iocodo.com and we will delete it.

16. "Do Not Track" and other companies

Some browsers and devices can send a "Do Not Track" signal. There is no common standard for responding to it, so Sartia and this website do not change what they do when they receive one. The choices described in this policy are how you control your data.

The other companies that receive data through Sartia are the ones listed in section 7, for the purposes listed there. Stripe, for example, uses information about your device and your payment to detect fraud across the businesses it serves.

17. Changes to this policy

We update this policy when Sartia or the law changes, and the date at the top shows when the current version took effect. If a change affects how we use data you have already given us, we tell you in the app before it applies, and we ask for your consent again where the law requires it.

18. Contact

IOCODO LLC, a limited liability company registered in Wyoming, United States
Email: support@iocodo.com
Website: iocodo.com