Legal

Privacy Policy

Effective Feb 1, 2026 · UAE DIFC / DPL aligned

1. What we collect

  • Account data: email, name, hashed password.
  • Content: photographs you upload and the AI-staged outputs we generate from them.
  • Usage: IP address, User-Agent, session timestamps — used for security (rate limiting, abuse detection) and billing.
  • Payments: handled by our processor (PayPal). We never see or store your card or wallet details.

2. How we use it

  • To generate and deliver your staged images.
  • To send transactional email (verification, login codes, password resets, purchase receipts) via Resend.
  • To prevent abuse and meet legal obligations.

We do not sell your data. We do not use your photographs to train AI models.

3. Sub-processors

  • Google (Gemini) — image generation. Photos are sent for processing and discarded by Google per their data-processing terms.
  • MongoDB Atlas — account + metadata storage.
  • Resend — transactional email delivery.
  • Cloudflare Turnstile — bot protection on signup / login.
  • PayPal — payment processing.
  • Kendal AI (admin connectors only) — only if you connect a Kendal account.

4. Retention

Account data is kept for the life of your account. Generated images are kept per your storage plan (Free: 30 days · Starter / Pro / Studio / Agency: retained until you delete them or downgrade). If you exceed your plan's storage capacity, the most recent items are kept for 7 days unless you upgrade. Originals are retained alongside edits and deleted on the same schedule so we can always show before/after pairs.

Payment metadata (transaction id, amount, pack, status) is retained for 7 years to satisfy UAE corporate tax and VAT record-keeping. Card details are never stored on our servers — those live exclusively on PayPal.

Webhook audit trails (PayPal events, admin actions) are retained for 18 months and then automatically purged.

You may request deletion of any non-financial record at any time.

5. Your rights (DPL / GDPR-aligned)

  • Access — download your data.
  • Correction — fix anything wrong.
  • Deletion — wipe your account and all generated images.
  • Portability — receive your data in a machine-readable format.
  • Withdraw consent — turn off non-essential processing.

Email hello@stagingstudio.app to exercise any of these. We respond within 30 days.

6. Cookies

We use only essential cookies (your login session) plus an optional analytics cookie that you can decline via the consent banner. No advertising cookies.

7. Security

Passwords are bcrypt-hashed (cost 12). Sessions are JWTs with 24-hour expiry, device-bound, rotated on every sign-in. All data is encrypted in transit (TLS) and at rest. We rate-limit logins and require email verification.

8. Contact

Data controller: Stage Studios (UAE)
Email: hello@stagingstudio.app

← Back to home