# Privacy Policy

> What personal data Flashly Studio collects, why, how long we keep it, who processes it on our behalf, and how to exercise your GDPR rights.

- Document: privacy
- Language: en
- Last updated: 2026-09-20
- Canonical page: https://flashlystudio.com/privacy
- Other language: https://flashlystudio.com/fr/confidentialite

## In short

- We never use your prompts, uploads or generated images to train any AI model — ours or a provider's.
- We collect what the service needs to run: your account, your content, your billing record, and the counters that enforce your plan's limits.
- Analytics are first-party and tied to your account. There is no advertising pixel, no ad network and no data broker.
- Nothing non-essential is loaded until you say yes. Error session recordings only start after you accept them.
- You can export or delete everything from your account settings, or by emailing us.

## 1. Who is responsible for your data

Flashly Studio ("Flashly", "we", "us") is the **data controller** for the personal data described here, within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR).

Our full legal identity, registered address and registration number are on our [Legal Notice](/legal-notice) page.

For any question about your data, write to **privacy@flashlystudio.com**. We answer within one month, as Article 12(3) GDPR requires.

We have not appointed a Data Protection Officer: we do not carry out large-scale monitoring or process special-category data, so Article 37 does not require one. Your requests go to the address above and are handled by the founder directly.

## 2. What we collect, and why

We collect only what a given feature actually needs. The table below is an exhaustive list — if a category is not here, we do not collect it.

### Account

| Data | Why | Legal basis |
| --- | --- | --- |
| Email address | Sign-in, password reset, service notices | Contract |
| Password (hashed, never stored in clear text) or OAuth provider identifier | Authentication | Contract |
| Display name and avatar, if you set one | To identify you inside a shared workspace | Contract |
| Workspace and team membership, role | Access control | Contract |

### Content you create

| Data | Why | Legal basis |
| --- | --- | --- |
| Prompts you write | To generate the output you asked for, and to show you your own history | Contract |
| Images and reference files you upload | Same | Contract |
| Generated images and videos | To deliver and store your results | Contract |
| Brand kits (logo, palette, typography, tone) | To keep generations on-brand | Contract |
| Comments left in a client portal | To run the review workflow you opened | Contract |

### Billing

| Data | Why | Legal basis |
| --- | --- | --- |
| Stripe customer identifier, plan, subscription status | To give you the plan you paid for | Contract |
| Invoices and payment records | Accounting and tax obligations | Legal obligation |

**We never see or store your card number.** Card details go directly to Stripe, a certified PSP; we only receive the reference to your customer record.

### Usage and technical data

| Data | Why | Legal basis |
| --- | --- | --- |
| Credit and generation counters | To enforce your plan's limits | Contract |
| Product analytics events: event type, page path, anonymous session identifier, page load and render timings | To understand which features are used and to find slow pages | Legitimate interest (Art. 6(1)(f)) — first-party, never sold or shared |
| API request logs, when you use the API | Billing, quota and abuse prevention | Contract / legitimate interest |
| IP address, temporarily, in a rate-limiting table | To block brute-force and abuse | Legitimate interest |
| Error reports: stack trace, browser, page | To fix crashes | Legitimate interest |
| Session recordings, **only when an error occurs and only if you consented** | To reproduce a bug we cannot otherwise diagnose | Consent |

Our product analytics are **first-party**: events are written to our own database, keyed to your account, and never sent to an advertising network or data broker. Analytics events are recorded only for signed-in users; we do not track anonymous visitors across the marketing site.

### If you contact us or apply for a job

| Data | Why | Legal basis |
| --- | --- | --- |
| Sales enquiry: name, email, company, message | To answer you | Pre-contractual steps at your request |
| Job application: name, email, role applied for, links you choose to share, message | To assess your application | Pre-contractual steps at your request |

We ask for nothing beyond this. We do not ask for a date of birth, a photograph, a postal address or a nationality in a job application, and we do not want them.

### What we deliberately do not collect

- No advertising or cross-site tracking identifiers.
- No fingerprinting.
- No precise location.
- No special-category data under Article 9 (health, beliefs, biometrics, sexual orientation, political or trade-union affiliation). Do not upload it.
- No data about children. Flashly is not intended for anyone under 16.

## 3. Our AI commitment

This is the part most people are here for, so it is stated plainly.

- **We do not use your prompts, uploads or outputs to train, fine-tune, evaluate or improve any AI model** — neither our own nor a provider's.
- When you generate, your prompt and any reference image are sent to the AI provider that will render it, the result comes back, and that is the end of the transfer. We keep the prompt and the output in your history so you can find them again, and nothing more.
- We select providers whose commercial API terms exclude training on customer inputs. If a provider changes that policy, we will change provider or tell you before it takes effect.
- **No automated decision has a legal or similarly significant effect on you** within the meaning of Article 22 GDPR. Model routing decides which model renders your image; it does not decide anything about you.

### AI-generated content transparency

Flashly produces synthetic images and video. Article 50 of the EU AI Act (Regulation (EU) 2024/1689) requires such outputs to carry a machine-readable mark identifying them as AI-generated. Where an output you download carries provenance metadata, that is why — it is a legal transparency requirement, it identifies the content and not you, and it contains no personal data.

## 4. Who else processes your data

These are our processors within the meaning of Article 28 GDPR. Each is bound by a data processing agreement.

| Processor | What it does | Where |
| --- | --- | --- |
| Supabase | Database, authentication, file storage, serverless functions | EU — Frankfurt, Germany |
| Vercel | Website and application hosting, CDN | Global edge; EU region for compute |
| Stripe | Payments and subscription management | EU and United States (SCCs) |
| Resend | Transactional email | EU |
| Sentry | Error monitoring and, with your consent, error session replay | EU region |
| AIML API, Replicate, OpenRouter | AI image, video and language model inference | United States (SCCs) |
| Cloudflare | Network protection and caching | Global |

We do not sell your data, and we do not share it with advertisers. If we ever engage a new processor that handles personal data, this table is updated before it goes live.

### Transfers outside the EU

Some processors are established in the United States. Those transfers rely on the European Commission's **Standard Contractual Clauses** and, where the processor is certified, the **EU–US Data Privacy Framework**. You can ask us for a copy of the safeguards that apply to a specific transfer.

### Google Fonts

Our pages currently load typefaces from Google Fonts, which means your browser makes a request to Google's servers and Google receives your IP address. This is a known point of friction with the CNIL's position on non-essential third-party requests, and we are moving to self-hosted fonts to remove it.

## 5. How long we keep it

| Data | Retention |
| --- | --- |
| Account | Until you delete it, then up to 30 days in encrypted backups |
| Generated content, uploads, brand kits | Until you delete them, or until your account is closed |
| Prompts | Stored with their generation; deleted with it |
| Invoices and accounting records | 10 years — French Commercial Code art. L.123-22 |
| Product analytics events | 25 months maximum, per the CNIL's recommendation for audience measurement |
| Error reports and session replays | 90 days |
| Rate-limiting IP records | 24 hours at most, then purged |
| Sales enquiries | 3 years from our last contact |
| Unsuccessful job applications | 2 years from our last contact, then deleted — CNIL recruitment guidance |

## 6. Your rights

Under Articles 15 to 22 GDPR you can, free of charge:

- **Access** the data we hold about you, and get a copy.
- **Correct** anything inaccurate — most of it directly in your profile settings.
- **Delete** your account and its content. Account Settings → Delete Account does this immediately and also cancels your subscription so you are not charged again.
- **Export** your data in a structured, machine-readable format. Email privacy@flashlystudio.com and we deliver it within 30 days.
- **Object** to processing based on our legitimate interest, including our first-party analytics.
- **Restrict** processing while a dispute about accuracy or lawfulness is resolved.
- **Withdraw consent** at any time, for anything we asked consent for — via [Cookie settings](/cookies), with no effect on what was lawful before you withdrew it.
- **Set instructions** for what happens to your data after your death (French Data Protection Act, art. 85).

To exercise any of these, email **privacy@flashlystudio.com**. We may ask you to confirm your identity if the request does not come from your account's email address — only to make sure we are not handing your data to someone else.

If you think we have mishandled your data, you can complain to the French supervisory authority, the **CNIL** (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — [cnil.fr](https://www.cnil.fr/)), or to the authority of your own EU country. We would rather you told us first, but it is your right either way.

## 7. Cookies and similar technologies

Flashly sets no advertising or cross-site tracking cookie. What we do store on your device — and what needs your consent before it is stored — is set out in full in our [Cookie Policy](/cookies).

## 8. Security

- TLS 1.3 for everything in transit, AES-256 at rest.
- Row-level security on every database table, so one account cannot read another's rows.
- Signed, time-limited URLs for stored files.
- Passwords hashed with bcrypt; we never see them.
- Least-privilege service roles, and secrets held outside the codebase.

No system is perfect. If we suffer a breach that is likely to put your rights at risk, we will notify the CNIL within 72 hours and tell you directly, as Articles 33 and 34 require.

Found a vulnerability? Please tell us at **security@flashlystudio.com**. We will not pursue anyone who reports in good faith and does not access other users' data.

## 9. Children

Flashly is not directed at children and we do not knowingly hold data about anyone under 16. If you believe a child has created an account, write to privacy@flashlystudio.com and we will delete it.

## 10. Changes

We will post any change here and move the "last updated" date. If a change materially affects your rights, we will email active users at least 30 days before it takes effect, so you can object or leave.