Privacy Policy

Version 2026-10-14 — Last updated 14 October 2026

1. Controller

The data controller for personal data processed through the Service is Arkadiusz Białecki, a sole trader operating under the CardetStudio brand, ul. Rzeźnicza 11, 62-590 Golina, Poland, tax id (NIP) 6653040315, REGON 389326869 ("we", "us"). Contact for data protection matters: [email protected].

If you use the Service as a business (for example a wrap studio) and store your customers' data in it (for example a customer name attached to a visualization, or a photo showing a person or a license plate), you are the controller of that data and we process it on your behalf under the data processing agreement attached to the Terms of Service.

2. Data we collect

  • Account data: email address, full name, workspace name, password hash (via Supabase Auth) or — when you sign in with Google or Discord — the profile data described in section 3.
  • Billing data: billing country and currency, Stripe customer id, the details you enter in the payment form (name or company, address, tax or VAT id), payment and invoice history. Full payment card details are processed by Stripe only.
  • User Content: vehicle photos, generated visualizations, customer names and car models attached to visualizations, custom colors (with their reference images) and the logo used as a watermark. We strip metadata, including location data, from uploaded photos to the extent the file format allows.
  • Usage data: generations, credit balance and history, plan, activity timestamps.
  • Technical and security data: IP address, browser user-agent, country detected from the IP address (via Cloudflare) and — at sign-up — a device identifier computed in the browser (see section 5).
  • Support data: the content of tickets, complaints and correspondence with us.

3. Sign in with Google and Discord — data we receive

You can create an account and sign in with "Sign in with Google" or "Sign in with Discord". When you do, we receive only the basic profile data you approve on that provider's consent screen.

  • Google (OpenID Connect scopes openid, email, profile): your Google account email address, name, profile picture and Google account identifier.
  • Discord (scopes identify, email): your Discord username, avatar, email address and Discord user ID.
  • What we do not access: we do not access your Gmail, Google Drive, contacts, calendar or any other Google account data, nor your Discord servers, messages or friends list. We never receive your Google or Discord password.

How we use it. Only to create and authenticate your CardetStudio account, to display your name and profile picture in the app, and to send you service emails about your account (for example confirmations, security and billing notices). We do not use it for advertising, profiling, or training AI/ML models.

Storage. This data is stored by our authentication provider, Supabase (EU region — Ireland), for as long as your account exists. It is deleted when you delete your account — using the Delete Account option in your account settings in the app — within the periods described in section 9.

Sharing. We do not sell or share user data received from Google or Discord with third parties. It is processed only by the processors listed in section 7, strictly to provide the Service.

Google API Services User Data Policy. CardetStudio's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How to revoke access. You can revoke CardetStudio's access to your Google account at any time at myaccount.google.com/permissions, and to your Discord account in Discord under User Settings → Authorized Apps. You can delete your CardetStudio account at any time with the in-app Delete Account option.

4. Purposes and legal bases (GDPR art. 6)

  • Contract (art. 6(1)(b)) — running your account, generating visualizations, history, billing, handling tickets.
  • Legal obligation (art. 6(1)(c)) — accounting, tax, invoicing, handling complaints and contract withdrawals.
  • Legitimate interest (art. 6(1)(f)) — preventing abuse of the Free plan (section 5), service security and security logs, establishing and defending legal claims, internal operational notifications for our team.
  • Consent (art. 6(1)(a)) — optional Google Analytics 4 measurement and optional marketing (we do not currently send marketing). You can withdraw consent at any time.

5. Sign-up checks (Free plan protection)

Each person is entitled to one Free plan account. To enforce this, at sign-up we automatically check: a device identifier computed in the browser from its characteristics (no cookies), the IP address, the email domain (including disposable-address domains) and the email address with aliases removed. If the result indicates the Free plan has already been used, the account is created without the free starting credits — everything else, including buying plans and credit packs, works normally. You can ask for the decision to be reviewed by a member of our team at [email protected].

We keep the device identifier and the email address only as cryptographic hashes, together with the IP address, for 24 months — including after the account is deleted.

6. AI processing

To generate a visualization we send the AI model provider only the vehicle photo, the reference image of the selected color and a prompt prepared by the app — never your email address, account name or customer name. We use the paid tier of the Google Gemini API, under which Google does not use submitted data to train its models and keeps it for a limited time solely to detect violations of its policies. If the Gemini API is unavailable, the same request may be routed to the same model through OpenRouter.

We do not use your photos or visualizations to train AI models either. Generated images may carry the model provider's invisible digital watermark (SynthID) marking them as AI-generated.

7. Recipients

Processors (acting on our instructions under data processing agreements):

  • Amazon Web Services (AWS EMEA SARL, Luxembourg) — application server, file storage (S3) and delivery (CloudFront), backups. Region: Frankfurt (Germany); cached copies of files on edge servers in Europe, North America and Israel.
  • Supabase, Inc. (USA) — database and authentication. Region: Ireland (EU).
  • Google LLC (USA) — Gemini API (paid tier), generating visualizations. Processed globally.
  • OpenRouter, Inc. (USA) — fallback access to AI models; forwards the request to the provider of the selected model (Google).
  • Stripe Payments Europe, Ltd. (Ireland) — subscription management, invoicing and tax calculation.
  • Resend, Inc. (USA) — sending emails. Infrastructure region: Ireland (EU).
  • Cloudflare, Inc. (USA) — DNS, traffic proxying and attack protection, Turnstile checks on the sign-in, sign-up and password reset forms, receiving email addressed to us.
  • Google Analytics 4 (Google Ireland Limited / Google LLC) — usage statistics, only with your consent.
  • Discord Inc. (USA) — internal operational notifications for our team (for example about purchases and refunds), containing the account name and id, transaction amounts and ids.

Independent controllers (processing data for their own purposes):

  • Stripe Payments Europe, Ltd. — for executing payments, fraud prevention and legal obligations (including anti-money-laundering).
  • Google and Discord — when you sign in through them (section 3).
  • Banks, card issuers and public authorities — to the extent required by law.

We notify business customers at least 14 days before adding or replacing a processor.

8. Transfers outside the EEA

Some providers are established or process data outside the European Economic Area (in particular in the USA). Transfers rely on a European Commission adequacy decision (the EU-U.S. Data Privacy Framework — for providers certified under it) or on Standard Contractual Clauses approved by the European Commission, together with the additional safeguards described by each provider. You can request a copy of the safeguards at [email protected].

9. Retention

  • Account: for the duration of the contract.
  • Visualizations, source photos, customer names and car models: available in your history for the period set by your plan (Free — no history on our servers, download only within 5 minutes of generation, and the app keeps copies of your last 3 visualizations only in your browser, on your device — we have no access to them; 1 Gear — 30 days; 3 Gear — 60 days; 6 Gear — 2 years; Nitro — for the duration of the contract). After that period they are no longer available and are permanently deleted within 30 days, and from backups within a further 30 days. They are deleted earlier if you delete them in the app.
  • Custom colors and logo: until you delete them or delete your account. Colors above the plan limit after a plan change — 30 days after deactivation.
  • After account deletion: account data and User Content are deleted immediately, and from backups within 30 days. We keep only billing records (5 years from the end of the tax year), data needed to establish or defend legal claims (until the limitation period ends) and the data described in section 5 (24 months).
  • Tickets and correspondence: 3 years from the last message.
  • Technical and security logs: up to 90 days.
  • Google Analytics data: according to the Google Analytics retention setting, no longer than 14 months.

10. Your rights (GDPR)

You can exercise the following rights by writing to [email protected]:

  • access to your data,
  • rectification,
  • erasure ("right to be forgotten") — the in-app Delete Account flow performs this,
  • restriction of processing,
  • data portability — we provide data exports on request, as described in the Terms of Service,
  • objection to processing based on legitimate interest,
  • human review of the automated sign-up check (section 5),
  • withdrawal of consent where consent is the legal basis,
  • complaint to a supervisory authority (in Poland: the President of the Personal Data Protection Office, uodo.gov.pl).

11. Cookies

We use cookies and similar storage that are necessary for authentication, security, billing, and remembering privacy preferences.

On the Free plan the app stores copies of your last 3 visualizations, with their source photos, in your browser storage (IndexedDB) so they stay available even though we keep no history on our servers. This data is never sent to us — clearing your browser data for this site removes it.

With your consent, we use Google Analytics 4 to measure website and application usage. Analytics is off by default, we do not use it for advertising personalization, and page views are sent without URL query strings and with obvious path identifiers reduced.

You can change or withdraw analytics consent at any time in cookie settings.

12. Security

Data in transit is encrypted (TLS), and data at rest is encrypted by our infrastructure providers. Files are served only through short-lived signed links. Passwords are hashed by Supabase. Payment data is handled by Stripe under PCI-DSS. Access to data is limited to authorized personnel. We reasonably, but cannot absolutely, guarantee security.

13. Age

The Service is intended only for people aged 18 or over — this is also required by our AI model provider's terms. If we learn that an account was created by a minor, we will delete it together with its data.

14. Changes

We may update this Policy. We will tell you about material changes in the app or by email.

15. Contact

CardetStudio — [email protected], or via our contact page.