1. What we collect
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address and password (stored hashed by our authentication provider) | Create and secure your account, contact you about it, tell waitlist members when we open | Contract |
| Product links, product photos and text you import or upload | Generate your content | Contract |
| Generated images and videos | Show them in your library and let you download them | Contract |
| Credit balance, usage history, plan | Run credits and billing, prevent abuse | Contract; legitimate interest (fraud prevention) |
| Billing details (name, address, payment method), handled by Stripe | Take payments, issue invoices, meet tax and accounting duties | Contract; legal obligation |
| Technical data: IP address, browser, request logs, error logs | Security, abuse limits, debugging | Legitimate interest |
We do not sell your personal data, we do not use advertising trackers, and we do not use your content to train AI models. We do not knowingly collect data from anyone under 18.
2. Who we share it with
Only with the providers that run the Service for us, under contracts that oblige them to protect it:
| Provider | Role | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, security | Global network, data stored in the United States |
| Supabase, Inc. | Account sign-up and sign-in | United States |
| Higgsfield AI | AI image and video generation (receives the photos and instructions needed for each generation) | United States |
| Stripe, Inc. / Stripe Payments Europe | Payments and invoices | United States / Ireland |
We may also disclose data when the law requires it, or to protect our rights and users.
3. International transfers
Some providers are in the United States. Where data leaves the European Economic Area, transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
4. How long we keep it
- Account data, imported products and generated content: while your account is open. When you ask us to delete your account, we delete them within 30 days, except backups which roll off within 30 more days.
- Waitlist accounts never activated: deleted 12 months after sign-up unless you sign in again.
- Invoices and payment records: 10 years, as required by French accounting law.
- Security logs: up to 12 months.
5. Your rights
You can ask to access, correct, delete or export your data, object to or restrict some processing, and withdraw any consent you gave. Write to support@tryadfactory.app; we answer within one month. If you are in the EU, you can also complain to your data protection authority (in France, the CNIL, cnil.fr).
California residents
You have the right to know what personal information we collect, to delete it, to correct it, and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioral advertising. To use your rights, email support@tryadfactory.app.
6. Security
Data is encrypted in transit (HTTPS). Access to your content is limited to your account. Generation and spending are protected by limits and server-side checks. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as the law requires.
7. Cookies
We only use cookies that are strictly necessary to keep you signed in. See our Cookie Policy.
8. Changes
We will post updates here and notify you of material changes by email or in the app.
Contact
Arnaud Debare EI, France. Privacy questions: support@tryadfactory.app.