Privacy Policy

Last updated: [DATE]

In short: We collect what we need to run StudioSet: your account details, the photos you upload, what you make, and basic usage data. We send photos and prompts to AI providers only to make your results. We do not do face recognition, we do not create face-geometry templates, and we do not sell or share your personal information for advertising. To keep a persona consistent, we store a written description of its look. You can delete your personas, photos and account at any time.

Draft — to be reviewed by a lawyer before launch.

1. Who we are

StudioSet (the "Service") is run by StudioSet, [ADDRESS] ("we", "us", "our"). We are the controller of the personal information described in this policy.

Privacy questions: support@studioset.app
Legal notices: legal@studioset.app
EU/UK representative or data protection officer: [DPO/EU REPRESENTATIVE IF REQUIRED]

This policy explains what we collect, why, who we share it with, how long we keep it, and your rights. It is part of our Terms of Service.

2. What we collect

Information you give us

Account information: your email address, name, and the sign-in provider you use (for example, Google).
Persona photos: photos of you, or of a person who gave you permission, that you upload to create a persona.
Other photos: inspiration photos, product photos and clothing photos you upload.
Prompts and settings: text you type, templates you pick, and options you choose.
Messages to us: what you send when you contact support or report content.
Payment information: handled by our payment provider, Stripe. We receive limited details such as your plan, payment status, and the last digits and type of your card. We do not store full card numbers.

The ready-made personas, templates and example photos included in StudioSet are AI-generated and show people who do not exist. They are not based on any real person's photos or personal data.

Information we create

Generated photos and videos: the results the Service makes for you.
Persona descriptions: a written description of a persona's look (for example, hair color and style, eye color, skin tone, build and general features). We create it from your persona photos so that new photos of the persona stay consistent. It is plain text, not a biometric template.
Outfit information: lists of clothing items found in outfit photos, cut-out images of those items, and simple outlines or boxes showing where each item is in the photo.
Credit ledger: your credit balance and a record of credits added, used and refunded.
Quality and safety records: internal checks on results, and records of requests an AI provider refused.

Information collected automatically

Usage data: which features you use, jobs you start, and how long they take.
Device and log data: IP address, browser and device type, operating system, app version, dates and times, and error logs.
Cookies: see section 11.

3. Face photos: how we treat them

We know face photos are personal. Here is exactly what we do and do not do with them.

What we do

We use your persona photos to make new photos and videos of that persona, as you ask.
We send persona photos to our AI providers so their models can make those results.
We ask an AI model to write a text description of the persona's look, and we store that text to keep future photos consistent.
We may use a segmentation model to outline clothing items in outfit photos. This outlines clothes, not faces, and does not identify anyone.

What we do not do

We do not use face recognition or try to identify who a person is.
We do not create, store or use face-geometry scans, faceprints, face embeddings or any other biometric template.
We do not compare faces across users, or search for a person in other photos.
We do not sell face photos or persona descriptions, or use them for advertising.
We do not use your photos to train AI models.

Special categories of data

A photo of a person can reveal sensitive information, such as racial or ethnic origin, religious beliefs (for example, from religious clothing) or health information. Under EU and UK law this is called "special category" data. We do not process photos to learn these things, and we do not use them to make decisions about you. Because photos may still reveal this information, we ask for your explicit consent before you upload persona photos. You can withdraw that consent at any time by deleting the persona. This does not affect anything we did before you withdrew it.

If you upload photos of another person, you must have their permission, and you are responsible for telling them how their photos will be used. You can share this policy with them.

4. Why we use your information, and our legal bases

The EU and UK General Data Protection Regulation (GDPR) require us to explain the legal basis for each use.

To provide the Service (creating personas, making photos and videos, storing your library, exports): to perform our contract with you.
To process persona photos and any special category data they may reveal: your explicit consent.
To manage your account, plan, credits and payments: to perform our contract with you.
To keep the Service safe (preventing fraud, abuse and misuse, enforcing our Acceptable Use Policy, checking the quality and safety of results): our legitimate interests in running a safe and reliable service.
To fix problems and improve the Service (using usage and log data): our legitimate interests.
To reply to you and send service messages (for example, about your account, billing or changes to our terms): to perform our contract, and our legitimate interests.
To send marketing emails, if we do: your consent, which you can withdraw at any time.
To follow the law (tax, accounting, responding to valid legal requests, handling takedown reports): our legal obligations.

Where we rely on legitimate interests, we have weighed them against your rights. You can object, as explained in section 9.

We do not make decisions about you based only on automated processing that have legal or similarly significant effects. Our automated safety checks may block a request, and you can contact us if you think that was a mistake.

5. Who we share information with

We do not sell your personal information. We share it only with:

Service providers (subprocessors)

These companies process data for us, under contracts that limit how they can use it.

OpenAI: image generation and image understanding (for example, writing persona descriptions and reading outfit photos).
Google (Gemini): an optional image model ("Nano Banana") you can choose in Settings.
Higgsfield: video models (Kling, Seedance). The start photo of a video is uploaded to them to make the clip.
fal.ai: video models (Kling, MiniMax, FLUX) as a backup, and image segmentation (SAM 2) for outlining clothing items.
Stripe: payments (planned).
Google Firebase: sign-in, file storage and hosting (planned).
Neon: database hosting (planned).
Google Cloud Run: processing of generation jobs (planned).

To make your results, we send the relevant photos and prompts to the AI provider doing the work. We choose providers that, per their API terms, do not use data sent through their APIs to train their models by default. Some providers keep data for a limited time, for example to monitor for abuse. Their terms can change, so please also check each provider's own terms and privacy policy.

Other cases

Legal reasons: if the law requires it, or to protect the rights, safety or property of our users, the public or us. This includes reporting child sexual abuse material to the authorities.
Business transfers: if we are involved in a merger, acquisition or sale of assets, your information may be transferred. We will tell you before it becomes subject to a different privacy policy.
With your permission: for example, if you choose to publish content to a social network once that feature is available.

6. How long we keep information

Account information: while your account is open.
Photos, personas, persona descriptions and generated results: until you delete them or your account.
Credit ledger and payment records: as long as tax and accounting laws require, usually 10 years.
Log data: up to 30 days, unless needed to investigate abuse or a security issue.
Reports and takedown records: as long as needed to handle the report and meet our legal obligations.

Deletion

You can delete personas, photos, results and your whole account in the app. When you do:

we delete the files from our storage within 30 days;
copies in our backups are deleted within 35 days;
we may keep limited records where the law requires it (for example, billing records) or to handle a pending report, dispute or legal claim.

When you delete a persona, we also delete its stored text description.

7. International transfers

We and our providers may process information in the United States and other countries whose data protection laws may differ from yours. When we transfer personal information out of the European Economic Area, the UK or Switzerland, we use legal safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), where available. You can ask us for more information at support@studioset.app.

8. Security

We use reasonable technical and organizational measures to protect your information, such as encryption in transit, access controls and limited staff access. No service is perfectly secure. If a breach affects your personal information, we will tell you and the authorities when the law requires it.

9. Your rights

Everyone

You can always:

see, download and delete your photos, personas and results in the app;
delete your account;
contact us at support@studioset.app with any privacy question.

EU, EEA, UK and Swiss residents

Under the GDPR and UK GDPR you have the right to:

access your personal information and get a copy;
correct information that is wrong;
delete your information;
restrict how we use it;
object to our use based on legitimate interests;
receive your information in a portable format;
withdraw consent at any time, without affecting earlier processing;
complain to your local data protection authority (in the UK, the Information Commissioner's Office).

California residents

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), you have the right to:

know what personal information we collect, use and disclose, and get a copy;
delete your personal information;
correct inaccurate personal information;
opt out of the sale or sharing of personal information;
limit the use of sensitive personal information;
not be treated differently for using your rights.

We do not sell or share your personal information, as those words are defined in the CCPA, and we have not done so in the past 12 months. We do not use cross-context behavioral advertising. We only use sensitive personal information (such as account sign-in details and, where it applies, information in photos) to provide the Service you ask for, and not to infer characteristics about you.

In the past 12 months we have collected these categories: identifiers (name, email, IP address); customer records (account and payment status); commercial information (plan and credit history); internet activity (usage and log data); audio or visual information (photos and videos); and inferences limited to the written description of a persona's look. Sources, purposes and recipients are explained in sections 2, 4 and 5.

Other US states

Residents of other US states with privacy laws (for example, Virginia, Colorado, Connecticut, Texas and others) have similar rights to access, correct, delete and get a copy of their data, and to opt out of targeted advertising, sale and profiling. We do not sell data, do targeted advertising, or do profiling with legal or similar effects. If we deny your request, you can appeal by replying to our decision or writing to support@studioset.app.

How to use your rights

Email support@studioset.app from the address linked to your account. We may need to check your identity before acting. You can use an authorized agent, and we may ask for proof that they act for you. We will reply within the time the law requires (usually one month under the GDPR, and 45 days under the CCPA).

10. Biometric privacy laws (Illinois, Texas, Washington and others)

Some US states, including Illinois (Biometric Information Privacy Act, "BIPA"), Texas (Capture or Use of Biometric Identifier Act) and Washington (RCW 19.375), have special rules for biometric identifiers such as scans of face geometry.

We do not collect, capture, store or use biometric identifiers or biometric information as those laws define them. We do not scan face geometry, create faceprints or face templates, or identify people from their faces. Photos you upload are used to make new images, and the persona description we store is ordinary text (for example, "shoulder-length wavy brown hair"), not a biometric measurement.

If we ever plan to use biometric identifiers, we will update this policy, publish a retention and destruction schedule, and ask for your written consent first, as those laws require.

11. Cookies and similar technology

We use only the cookies we need to run the Service and remember your choices:

Sign-in session: keeps you signed in.
Preferences: your theme (light or dark), language, image model choice, current project and selected persona.
Local storage: unsent drafts and similar conveniences, kept only in your browser.

We do not use advertising cookies or third-party tracking for ads. If we add analytics in the future, we will update this policy and ask for your consent where the law requires it. You can block or delete cookies in your browser, but the Service may not work properly without the essential ones.

12. Children

The Service is only for people 18 and older. We do not knowingly collect personal information from anyone under 18, and we do not allow personas of minors. If we learn that a user is under 18, or that photos of a minor were uploaded, we will delete them and close the account. If you think this has happened, contact us at support@studioset.app or use our Report content / takedown page.

13. Changes to this policy

We may update this policy from time to time. We will change the date at the top and, for important changes, tell you in the app or by email before they take effect.

14. Contact

StudioSet, [ADDRESS]

Privacy: support@studioset.app

Legal: legal@studioset.app

EU/UK representative or DPO: [DPO/EU REPRESENTATIVE IF REQUIRED]