PRIVACY POLICY

Vendy Studio

Version 04 (US) - Last updated: 06/10/2026

This Privacy Policy explains how the Vendy Studio platform (the "Platform") collects, uses and protects your personal information.

A note for users in the United States. Vendy Studio is a French business. Because of that, the European General Data Protection Regulation (GDPR) applies to how we handle personal information regardless of where you live — so the protections and rights described below are available to you as a US user, not only to European users. We do not sell your personal information, and we do not share it in exchange for money or anything of value. Section 11 addresses US state privacy laws specifically.

1. Who is responsible for your data

The data controller is: VLA STUDIO – Mr François Vella, operating the Vendy Studio platform.

Registered address: 1A Rue Marcel Sembat, 62880 Vendin-le-Vieil, France
SIRET: 835 236 852 00025
Email contact: contact@vendystudio.fr

The website is hosted by: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA.

2. Personal information we collect

In the course of using the Service, Vendy Studio may collect the following categories of information:

Identification data: email address, account identifier;
Connection data: technical logs, IP address, browser type, dates and times of connection;
Browsing data (analytics): information relating to the use of the Platform (pages visited, events, analytics cookie identifiers), according to your choices;
Payment data: information relating to transactions (via Stripe — we never receive or store your full card details);
Uploaded content: photographs of garments (which may contain personal information if you do not comply with the content rules);
Usage data: number of generations, credit consumption, functional preferences;
Exchanges with support: when you write to contact@vendystudio.fr: sender email address and name, subject and content of the message, date of receipt, attachments (JPG, PNG and WebP images are kept with the request; other attachments are contained only in the technical copy of the message received), technical message headers (identifier, routing, results of sender authentication checks such as SPF, DKIM and DMARC), as well as our replies; where applicable, the information in your account that is needed to handle the request, where the sending address matches an account;
Cancellation data: first name, last name, email address, order reference (or date and amount of the purchase) and free-text message, submitted through the online cancellation form — which is open WITHOUT an account, so this data may relate to a person who has never registered.
Abuse-prevention data (multiple accounts): at sign-up, a normalized form of your email address, an irreversible fingerprint (hash) of your IP address and a random technical device identifier (the "vs_did" cookie), used solely to check compliance with the one-free-account-per-person-and-household limit (Terms, § 5.1 bis). Your IP address is never stored in clear text. After an account is deleted, only a pseudonymized fingerprint of this data (a non-reversible cryptographic hash computed with a secret key) may be kept, as described in section 6.

The Service is not intended to process sensitive information. However, if you upload non-compliant content (for example a photograph containing an identifiable person, a home, or a name label), personal information may be processed incidentally. In that case, we reserve the right to delete the content concerned and/or restrict access to the Service in accordance with the Terms.

3. Biometric information — what we do and do not do

This section is provided for clarity because our Service processes photographs.

We do not perform facial recognition. We do not scan, extract, store or compare facial geometry, retina or iris scans, fingerprints, voiceprints, or hand geometry.
We do not create or retain biometric templates or identifiers, and we do not use any image to identify a person or to match a person against a database.
Our Service transforms photographs of garments. Our Content Rules prohibit uploading photographs containing an identifiable person, and we ask you not to do so.
If a photograph containing a person is uploaded in breach of our Content Rules, it is processed only to produce the requested image and is deleted on the schedule in section 6; it is not used to identify anyone.

4. Why we use your information

We process your information for the following purposes:

Provision of the Service (account creation, image generation, credit management) — to perform our contract with you;
Management of payments and fraud prevention — to perform our contract and for our legitimate interests;
Security and stability of the Platform — legitimate interests;
Analytics (for example Google Analytics) — only with your consent, via the cookie banner;
Advertising measurement and attribution (for example the Meta Pixel) — only with your consent, via the cookie banner;
Improvement of the Service (aggregated, non-identifying statistics) — legitimate interests;
Communications relating to the Service — to perform our contract;
Receipt, acknowledgment, handling and evidential retention of cancellation declarations — legal obligation and legitimate interests in evidencing those declarations;
Handling requests sent to support (receipt, automatic acknowledgment of receipt, reply and follow-up) — to perform our contract with you or take steps at your request before entering into it, and, for other requests, our legitimate interests in replying to people who contact us. An automatic acknowledgment of receipt may be sent to you: it only confirms that your message has been received, without constituting acceptance or refusal of your request, and is sent only to authenticated sending addresses;
AI-assisted support: messages we receive are analyzed by an artificial intelligence (AI) system in order to identify their subject, to look up on a read-only basis the account information relevant to the request (credits, purchases, generations and their images, previous exchanges with support, cancellation requests, subscription) and to prepare a draft reply and, where relevant, proposed operations. No reply is sent and no operation is carried out without having been reviewed and approved by a person; no decision producing legal effects concerning you or similarly significantly affecting you is made solely on the basis of automated processing (Art. 22 GDPR). Only the acknowledgment of receipt, whose content is fixed, is sent automatically. We do this to perform our contract with you or take steps at your request before entering into it (customers) and, for other people, for our legitimate interests in dealing promptly with the requests sent to us;
Verifying the authenticity of messages received and filtering unsolicited messages (protection against phishing and impersonation) — legitimate interests;
Keeping, as evidence, requests to exercise your privacy rights and cancellation declarations received by email — legal obligation and legitimate interests in establishing, exercising or defending legal claims;
Preventing abuse of free benefits (one free account per person and per household, detection of multiple accounts) — legitimate interests. Where detected, only free benefits are affected; a person reviews any challenge you raise (contact@vendystudio.fr);
Keeping, after an account is deleted, a pseudonymized fingerprint in order to prevent free credits from being obtained repeatedly by deleting and re-creating an account — legitimate interests.

We do not use your Source Photographs to train AI models, and we do not build or enrich reusable datasets from them.

5. Who receives your information

We use providers acting on our behalf to provide the Service:

Hosting / infrastructure: Vercel (hosting of the application, technical logs);
Database & storage: Supabase (storage of garment photographs and generated images, database, including exchanges with support and their attached images);
Image generation: Google (GenAI) (generation of images from garment photographs);
Image generation & enhancement (additional models): Replicate (image generation and enhancement/upscaling from garment photographs);
Analytics: Google (Google Analytics) (Platform traffic statistics), subject to your consent;
Advertising measurement: Meta (Meta Pixel and Conversions API), subject to your consent;
Payment: Stripe (payment processing and fraud prevention);
Email: Resend (sending of transactional emails);
Mailbox: OVH SAS (hosting of the contact@vendystudio.fr mailbox, receipt of emails sent to support and sending of our replies and acknowledgments of receipt; France).
AI support assistance: Google (Gemini API, paid offering: the content sent is not used to train Google's models) (analysis of messages received by support, read-only lookup of the account information relevant to the request and preparation of draft replies, reviewed and approved by a person before anything is sent);

We may also share certain information with providers strictly necessary for security (fraud prevention, abuse mitigation) and the proper functioning of the Service, or where required by law.

No information is sold or rented to third parties.

6. How long we keep your information

Account data: for the whole duration of the contractual relationship; it is erased as soon as the account is deleted, which you can do at any time from your "My account" area;
Payment / accounting data: as required by applicable accounting and tax obligations. After the account is deleted, purchase records (date, amount, number of credits, Stripe transaction reference) are kept without any direct link to the account (Art. 17(3)(b) GDPR); the transaction reference makes it possible to find the corresponding payment at Stripe. Our payment provider Stripe keeps its own transaction data in accordance with its legal obligations;
Technical logs: 6 to 12 months;
Uploaded and generated images: the period strictly necessary to provide the Service, and in any event deleted within 10 days of generation;
Abuse-prevention data: the IP fingerprint and device identifier are deleted no later than twelve (12) months after sign-up; the normalized form of the email address is kept for as long as the account exists. After the deletion of an account that has received free credits (or that was refused those credits under the household limit), a pseudonymized fingerprint (a non-reversible cryptographic hash computed with a secret key) of the normalized email address, of the device identifier and, where the account was created less than ten (10) days earlier, of the IP address fingerprint (for those ten days only) is kept for twelve (12) months, for the sole purpose of preventing free credits from being obtained repeatedly;
Account deletion: the confirmation code (hashed) is kept for seven (7) days; a technical log of the procedure (technical account identifier, without email address) is kept for ninety (90) days; a record of the deletion, without email address (technical identifier, credit balances on the date of deletion), is kept for five (5) years as evidence; residual technical logs relating to the account are erased automatically in the following days. Security backups of the database, kept for no more than thirty (30) days, are overwritten at the end of that period; if a backup is restored, deletions made in the meantime are applied again;
Exchanges with support: twenty-four (24) months after the request is closed, and no later than twenty-four (24) months after the last exchange; attached images: ninety (90) days after receipt; full technical copy of the message received (including all its attachments): thirty (30) days; messages identified as unsolicited (spam, commercial solicitation, automatic notifications): no later than sixty (60) days after their last message. When your account is deleted, exchanges with support linked to your account or to your email address are erased, subject only to the cancellation declarations received by email described below;
Analyses and draft replies produced by the support AI: kept with the exchange concerned, for the same periods. The AI provider (Google) keeps its own technical logs under its terms (Google: fifty-five (55) days for abuse detection);
Cancellation declarations received by email: the exchange in which a cancellation is declared by email is kept for five (5) years from the declaration, as evidence (Art. 17(3)(b) and 17(3)(e) GDPR). If your account is deleted before that date, only the message containing the declaration (with its content, its date and the sending email address, which are necessary as evidence) is kept until the end of that period; the rest of the exchange is erased;
Cancellation declarations: five (5) years from the declaration. They are retained as evidence even after the account is deleted: the email address is masked at that point, while the name and any message are kept, being necessary to identify the contract concerned.

7. Where your information is processed

Vendy Studio is established in France, and your information is processed in the European Union and by the providers listed in section 5, some of which are located in the United States. Where information is transferred outside the European Economic Area, we rely on appropriate safeguards recognized under the GDPR (in particular the European Commission's standard contractual clauses, or the EU–US Data Privacy Framework where the recipient is certified).

Where the AI support assistance processing entrusted to Google takes place outside the European Economic Area, in particular in the United States, we rely on the adequacy decision on the EU–US Data Privacy Framework where the recipient is certified under it, and/or on the European Commission's standard contractual clauses.

You may request information about these safeguards by writing to contact@vendystudio.fr.

8. Your rights

Because the GDPR applies to our processing, these rights are available to you wherever you live, including in the United States:

access your personal information;
have inaccurate information corrected;
have your information deleted, where applicable;
restrict or object to processing;
portability of the information you provided to us;
withdraw your consent at any time, where processing is based on consent (without affecting processing carried out beforehand);
object to direct marketing at any time.

You can delete your account yourself, at any time, from your "My account" area ("Delete my account" button), after confirming with a code sent to your email address; deletion is immediate, unless a cancellation request or a payment dispute is pending (Terms, section 16.2). Information already transmitted, with your consent, to our analytics and advertising partners remains subject to their own retention periods.

To exercise any of your rights, including deletion, write to contact@vendystudio.fr. We will respond within one month. We will not discriminate against you for exercising any of these rights — your access to the Service, your credits and your pricing are unaffected.

Emails exchanged with support are also kept in our mailbox (OVH): a deletion request, like the deletion of your account, also applies there, subject to the same reservation for cancellation declarations kept as evidence.

If you are not satisfied with how we handle your personal information, you may also lodge a complaint with the French supervisory authority, the Commission Nationale de l'Informatique et des Libertés (CNIL) — cnil.fr. We would appreciate the chance to address your concerns first.

9. Your choices about tracking

Analytics and advertising cookies are placed only after you consent via the cookie banner shown on your first visit, with separate controls for analytics and for advertising. You can accept all or reject all with equal ease, and you can change or withdraw your choices at any time via the "Cookies" link on the Platform. Rejecting non-essential cookies does not affect your access to the Service.

Our Cookie Policy describes each category of cookie, its purpose and its retention period.

10. Children

The Service is intended for adults and is not directed to children. You must be at least 18 years old to create an account. We do not knowingly collect personal information from anyone under 18 — and, in any event, from any child under 13 within the meaning of COPPA. If you believe a person under 18 has provided us with personal information, please contact contact@vendystudio.fr and we will delete it.

11. Information for US residents

We do not sell your personal information, and we do not share it for cross-context behavioral advertising in exchange for money or other valuable consideration.

Vendy Studio is a very small business, operated by one person. Based on our size and activity, we understand that we fall below the applicability thresholds of the California Consumer Privacy Act (CCPA/CPRA) and of the comprehensive consumer privacy laws currently in force in other US states — whether those laws set a revenue threshold, a threshold based on the number of consumers whose information is processed, or, in states that set no numerical threshold, an exemption for small businesses as defined by the US Small Business Administration.

We therefore do not operate the specific mechanisms those laws require of covered businesses — for example, we do not publish a "Do Not Sell or Share My Personal Information" link, because we do not sell or share personal information in the way those laws define, and we do not want to offer a mechanism that would not correspond to anything real.

This does not leave you without protection. As explained in section 8, the GDPR applies to our processing because we are established in France, and it gives you rights of access, correction, deletion, restriction, objection and portability that are broadly equivalent to — and in several respects broader than — those provided by US state privacy laws. You can exercise them at any time by writing to contact@vendystudio.fr, whatever state you live in, and we will not discriminate against you for doing so.

If our size or activity changes so that a US state privacy law becomes applicable to us, we will update this policy and implement the mechanisms that law requires.

12. Data security

Vendy Studio implements appropriate technical and organizational measures to protect your information (access controls, encryption, key management, logging, backups). However, no system is entirely free of risk.

13. Data breaches

In the event of a personal data breach likely to result in a risk to people's rights and freedoms, Vendy Studio will notify the competent supervisory authority without undue delay and, where the breach is likely to result in a high risk, will inform the individuals concerned. We will also comply with any applicable US state breach notification law.

14. Changes to this Policy

This Policy may be amended at any time. The applicable version is the one published on the Platform on the date the Service is used. We will inform you of any substantial change by appropriate means.