Privacy Policy

1. Introduction & Data Controller

At Smasher Studio ("we," "our," or "us"), we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered content generation platform.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, username, and password when you register.
• Profile Information: Name, company name, and profile photo if you choose to provide them.
• Payment Information: Billing details processed securely through our payment provider (Stripe).
• Content: Images, product photos, and other files you upload for AI processing.
• Communications: Messages you send to our support team.
• Launch Waitlist: If you join the Collection Launch list, we record your email address, the launch price displayed to you (which is locked for you), the page where you joined, and the time of registration, so we can notify you at launch and honor your locked price.

2.2 Information Collected Automatically

• Usage Data: Features used, generation history, and interaction patterns.
• Device Information: Browser type, operating system, and device identifiers.
• Log Data: IP address, access times, and pages viewed.
• Cookies: Session cookies and preferences (see Section 6).

2.3 Company Purchases and Invoicing

When you buy for a business, we collect the information we need to issue a lawful invoice and to meet our tax obligations: the legal name of the business, its address, its VAT identification number, and the result of our check of that number on the European Commission's VIES system (validity, the name and address returned where available, the date and time of the check and, where issued, the consultation reference). The legal name, address and VAT number of a company are not personal data; they are personal data when the buyer is a sole trader, and the name of the person who places the order always is.

Purpose and legal basis. We use this information to issue and keep your invoices, to apply the correct VAT treatment, and to file the returns the law requires, including the monthly European statement of services for sales to businesses in other EU Member States (Article 289 B of the French General Tax Code). This processing is necessary to comply with our legal obligations (GDPR Article 6(1)(c)) and to perform our contract with you (GDPR Article 6(1)(b)).

Recipients. Your VAT number is sent to the VIES system, operated by the European Commission with the tax authorities of the Member States, to check it. Invoices are created and stored through our payment provider Stripe, acting on our behalf. The VAT number of an EU business customer and the amounts invoiced to it are reported to the French tax administration in the European statement of services, and our invoices and records are disclosed to the French tax administration when it asks for them under its right of communication. We do not use this information for marketing.

Retention. Invoices, VIES check results and the related billing records are kept for ten years from the date of the invoice, together with our accounting records. The legal minimum is six years (French Book of Tax Procedures, Article L102 B); we keep them for ten years so that our records stay complete for any later audit or dispute. They are kept even if you delete your account, because the law requires it.

2.4 Accounts created at payment

If you buy a pack of credits on a tool page without an account, you ask us, in the box you tick before paying, to create a Smasher Studio account for the email address you give at payment. We use that address, and the first name you give our payment provider if you give one, to create the account, add your credits, sign you in on the device you paid from, and send your receipt and a sign-in link. The images you made on that device before paying are kept with the new account on that device. This is necessary to carry out your order (GDPR Article 6(1)(b)). If the address already has an account, we add the credits to that account and send a sign-in link to the address: the device you paid from is not signed in to it, and the images made before paying join that account only when it is opened on the device you paid from. If you did not give this address, write to support@smasher.studio. We send no marketing to this address without your consent. The account and its data are kept as described in Section 9, and you can delete it at any time.

2.5 Showcase (optional).

If you choose to share an image on our website, we process that image and, if you add them, your words and the name you type, on the basis of your consent. They are shown until you stop sharing, which you can do at any time in one tap. We then keep a short record of your consent, without your words or name, for 5 years as proof.

3. How We Use Your Information & Lawful Basis

We use your information to:

• Provide, maintain, and improve the Service.
• Process your AI generation requests and deliver results.
• Process payments and manage your subscription.
• Send service-related notifications and updates.
• Respond to your inquiries and provide customer support.
• Analyze usage patterns to improve our AI models and features.
• Detect, prevent, and address fraud and abuse.
• Comply with legal obligations.

Lawful Basis (GDPR Article 6):

• Contract (Art. 6(1)(b)): Processing necessary to provide the Service — account management, AI generation, payment processing, credit allocation.
• Legitimate Interest (Art. 6(1)(f)): Security monitoring, fraud prevention, service improvement, and analytics. We balance these interests against your rights.
• Consent (Art. 6(1)(a)): Marketing communications and optional product updates, and the Meta and TikTok advertising pixels (Section 6). You can withdraw consent at any time via your notification settings, or for the pixels through "Cookie settings" at the bottom of every page.
• Emails to existing customers about our own service (Art. 6(1)(f), and art. L34-5 of the French Postal and Electronic Communications Code): if you have an account, we may send you one short reminder when a payment you started was not completed, and one when you made photos and have not come back for two days. Each is sent at most once. It is based only on account events (a payment started, your credit history, the date of your last visit), never on the content of your conversations or your images. Every such email has an unsubscribe link, and you can object at any time; we never send it to visitors without an account.
• Legal Obligation (Art. 6(1)(c)): Tax records, billing data, and regulatory compliance.

4. Your Data & AI Training

No Training on Your Inputs: Smasher Studio does not use your inputs or outputs to train any model. To produce your results, your content is sent to the AI providers named in our Sub-Processor List, and each of them handles it under its own terms. Some of those providers may retain your inputs and outputs to improve their own models, under their own terms.

Storage: the photos you upload and the content generated for you are stored on Storj, a decentralized storage network. Our servers hold the keys that read these files, so that the studio can show them to you and send them to the AI providers when you ask for a result.

Photos and files you upload: we store the photos and files you upload, so that the studio can work from them and show them to you again. We send them to the AI providers listed in Section 5 only to produce what you ask for. Section 9 says how long each kind is kept.

Generated Content: AI-generated images, videos, and tech packs are stored in your account library for your access. You can delete this content at any time.

4a. GDPR, EU AI Act Compliance & Right to Erasure

Smasher Studio is committed to compliance with both the General Data Protection Regulation (GDPR) and the EU AI Act (Regulation 2024/1689). We process your data lawfully and transparently, and we are evaluating content provenance measures as anticipated under the EU AI Act's transparency obligations for AI-generated content (Article 50).

If you are in the European Economic Area (EEA), UK, or other jurisdictions with similar data protection laws, you have the right to:

• Full Data Export: Request a complete export of all your data in a machine-readable format.
• Right to Erasure: Request permanent deletion of all your data, including generated assets, account information, and usage history.
• Processing Basis: We process your data based on contractual necessity (to provide the Service) and legitimate interest (to improve the Service). We never rely on consent alone for core processing.
• Right to Object to Automated Decision-Making: Under GDPR Article 22, you have the right not to be subject to decisions based solely on automated processing that significantly affect you. AI content generation is a tool you direct — it does not make decisions about you.

To request data erasure, email privacy@smasher.studio. We will process your request within one month of your verified request, as required by GDPR Article 17.

Right to Lodge a Complaint: If you believe your data protection rights have been violated, you have the right to lodge a complaint with the French data protection authority: Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

4b. Content Provenance & AI Transparency

Every image and every video generated through the Service carries a C2PA (Coalition for Content Provenance and Authenticity) manifest embedded in the file, marking it as artificially generated. The signing happens on our servers at the moment the asset is stored, so the mark travels with the file. Where the engine that produced a file has already signed it with its own Content Credential, we keep that signature rather than replacing it with ours. You can read either of them in any C2PA reader.

This metadata contains no personal information about you. It records that the asset was created by a trained algorithmic system, the name of this platform, and a timestamp. It does not record your account, your email address, your prompt, or the identity of the model that produced the asset.

When you upload a reference photograph, we keep the colour profile and the XMP block of your file when we prepare it for the model, so that provenance your own camera or editing software wrote into it is carried through rather than destroyed. We deliberately do not carry the EXIF block, because that is where location data lives and it has no reason to leave our systems.

5. Sharing Your Information & Sub-Processors

We do not sell your personal data. We share information with the following sub-processors to operate the Service:

All sub-processors process data under contractual data processing agreements. For transfers outside the EEA, Standard Contractual Clauses (SCCs) apply where required. We regularly review our sub-processors and will update this list as providers change.

We may also share information in the following circumstances:

• Legal Requirements: When required by law or to protect our rights.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.

6. Cookies and Tracking

We use cookies and similar technologies to:

• Keep you signed in to your account.
• Remember your preferences (like dark mode).
• Understand how you use the Service.
• Improve and personalize your experience.
• Only if you accept marketing cookies: let Meta and TikTok know, through their pixels, that you visited, viewed a tool, signed up, or started or completed a payment, so we can show you our ads on their platforms and measure them. Nothing is loaded from Meta or TikTok before you accept, and you can withdraw at any time through "Cookie settings" at the bottom of every page. Meta and TikTok act as joint controllers with us for this collection and transmission (CJEU, Fashion ID, C-40/17), then under their own privacy policies.
• Attribute signups to marketing campaigns: when you arrive via a campaign link, a first-party cookie (__smasher_utm) stores the campaign parameters from that link for 30 days. It is never shared with third parties.
• One free account per device. If another account was already created on the same device, the new account starts without free credits; paid plans and bought credits are never affected. The marker is kept as long as your account exists. When you delete your account, we keep the coded marker alone, without your name, email or any other detail, until the date your free credits would next have renewed and for 30 days at most, so that a new account opened on the same device in that time starts without free credits. It is then erased. If you share a device, write to support@smasher.studio and a person will review it.

You can control cookies through your browser settings. Note that disabling cookies may affect the functionality of the Service. For a complete list of cookies used, see our Cookie Policy.

7. Data Security

We implement industry-standard security measures to protect your data:

• Encryption of data in transit (HTTPS/TLS).
• Encryption of data at rest.
• Secure password hashing.
• Regular security audits and monitoring.
• Access controls and authentication requirements.

While we strive to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

8. Your Rights

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data.
• Correction: Update inaccurate or incomplete data.
• Deletion: Request deletion of your data ("right to be forgotten").
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to certain processing of your data.
• Restriction: Request limited processing of your data.

To exercise these rights, contact us at privacy@smasher.studio

9. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specific retention periods:

• Account data (email, profile, preferences): kept for the duration of your account. Erased at once when you delete your account. We keep for five years a record that the deletion took place, under a code, without your name or your email address.
• Generated content (images, videos, tech packs): kept for the duration of your account. Erased at once when you delete your account.
• Studio conversations (your messages and the results shown with them): kept until you delete them or delete your account.
• Payment, billing and invoicing records (including VAT numbers and VIES check results): 10 years from the date of the invoice. After you delete your account they are kept under a code, without your name, except on the invoices themselves, which must name the buyer. French tax law requires at least 6 years (Livre des procédures fiscales, Article L102 B); we keep them for 10 years with our accounting records. See Section 2.3.
• Server logs (IP addresses, access logs): 90 days.
• Launch waitlist records (email, locked price, registration page): retained until launch, then through the 30-day price-honor window, plus 12 months as proof of the commitment.
• Photos you attach in the studio: kept until you delete your account.
• Photos you give to a tool page: kept for 30 days, then deleted. If you order a pattern from one of them, a copy is kept with your order until you delete your account.
• Brand kit photos and logo: kept until you delete your account.
• One free account per device. If another account was already created on the same device, the new account starts without free credits; paid plans and bought credits are never affected. The marker is kept as long as your account exists. When you delete your account, we keep the coded marker alone, without your name, email or any other detail, until the date your free credits would next have renewed and for 30 days at most, so that a new account opened on the same device in that time starts without free credits. It is then erased. If you share a device, write to support@smasher.studio and a person will review it.

Export before you delete: deleting your account takes effect at once and cannot be undone. There is no waiting period. If you want a copy of your data, export it from your account settings before you delete your account.

Pattern makers. When a pattern maker deletes their account, we close it at once and erase their profile, availability, payout details and sign-in details as soon as any work in progress and any money we owe them are settled, and within 30 days at the latest. We keep, for ten years and under a code instead of their name, the invoices and records of payments we made to them, because French tax law requires it (Livre des procédures fiscales, article L102 B). Patterns they delivered belong to the clients who paid for them and are not deleted. We also keep, for five years, a record that the deletion took place, without any name or contact detail.

Backup copies of our database are kept for 14 days and then deleted. Data you delete can remain in those copies until they expire.

10. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place to protect your data:

• Storj (decentralized storage, US-based): Data is encrypted, split, and distributed across independent nodes. Protected by Standard Contractual Clauses (SCCs) under GDPR Article 46(2)(c).
• AI providers (Anthropic, Black Forest Labs, Google, FAL, US-based): They receive your content to produce your results, and each of them handles it under its own terms.
• Stripe (payment processing, US-based): PCI DSS Level 1 certified. Adequacy decision and SCCs apply.
• Heroku/Salesforce (hosting, US-based): EU-US Data Privacy Framework certified.

10a. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights, we will notify the French supervisory authority (CNIL) within 72 hours of becoming aware, as required by GDPR Article 33. Where the breach is likely to result in a high risk to you, we will notify you directly without undue delay (GDPR Article 34).

11. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the Service. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related questions or to exercise your rights, contact us at: