Privacy Policy

Controller

Johan Guerrero, SIRET 988 078 572 00019, is the controller for the processing described here. Contact: dreamshare803@gmail.com. Registered business address: Aix-en-Provence, France. No data protection officer has been appointed.

1. Delivering a transformation

Data: the uploaded photograph, the transformation prompt, the generated preview and HD image, the transformation status and technical metadata (model used, date, estimated cost).

Purpose: producing the image you asked for. Legal basis: performance of the contract, or pre-contractual steps for the free trial.

Recipients: the AI provider that performs the transformation (Lovable AI Gateway, using Google Gemini image models), and our hosting and storage providers.

Retention: files are stored with a 30 day expiry and are deleted automatically after that period; the generation record (prompt, status, dates, no image) is kept for account history and accounting traceability.

2. Account and authentication

Data: email address, Google account identifier used to sign in, account creation date, role.

Purpose: giving you access to your paid space and history. Legal basis: performance of the contract. Recipients: our authentication and database provider (Supabase, part of Lovable Cloud).

Retention: for the life of the account, then deleted on request or on account deletion.

3. Subscription and payment

Data: email, plan, amount, subscription and payment status, Stripe customer and subscription identifiers, period dates. Card numbers are never received or stored by LARPIT; they are handled by Stripe.

Purpose: managing the subscription, quotas and invoicing. Legal basis: performance of the contract, and legal obligation for accounting records.

Recipients: Stripe (payment service provider), our database provider.

Retention: subscription records are kept for the duration of the relationship, then for the statutory accounting retention period (10 years in France).

4. Order and consent evidence

Data: the accepted version of the terms, the express request for immediate performance of the service, date, locale, a hashed technical identifier and the browser user agent.

Purpose: proving the pre-contractual information given and the consents collected. Legal basis: legal obligation and legitimate interest in proving the contract.

Retention: 5 years from the order.

5. Security, quotas and abuse prevention

Data: anonymous session identifier, hashed IP address, coarse device signals, counters per time window.

Purpose: enforcing free trial limits and quotas, and preventing abuse and automated attacks. Legal basis: legitimate interest in protecting the service and controlling costs.

Retention: rate limit counters are short lived (rolling windows); abuse related identifiers are hashed and kept no longer than 12 months.

6. Audience measurement and affiliate attribution

Data: anonymous session identifier, funnel events (page seen, generation started, checkout started), referral code, hashed IP for click deduplication.

Purpose: measuring the funnel and attributing affiliate commissions. Legal basis: legitimate interest and, for non essential measurement, your consent given in the cookie banner. Affiliate attribution is stored only when you arrive through a referral link.

Retention: events are kept up to 25 months, affiliate attribution 30 days on your device.

7. Photographs and AI

Photographs may show faces and are treated as personal data. Only the image needed for the requested transformation is processed; images are resized and re-encoded before being sent to the AI model, which minimises the data transmitted.

Storage: originals, HD results and previews are held in private buckets that are not publicly readable. Access is only possible through short lived signed links generated server side after an access check.

AI provider: transformations are executed through the Lovable AI Gateway on Google Gemini image models. Processing may take place outside the European Union, in particular in the United States, under the transfer mechanisms used by those providers.

We have not independently verified whether the model provider may use submitted images for model training. This must be confirmed against the provider's current terms and settings before commercial launch, and this policy updated accordingly.

8. Retention and automatic deletion

Every generation carries a 30 day expiry date. A scheduled server side job deletes the original, the preview and the HD file from storage once that date is passed, and clears the corresponding file references.

You can request earlier deletion at any time at dreamshare803@gmail.com.

9. International transfers

Some processors operate outside the European Union, in particular the AI provider and Stripe. Such transfers rely on the mechanisms implemented by those providers, typically the European Commission's standard contractual clauses. Copies of the relevant guarantees can be requested at dreamshare803@gmail.com.

10. Your rights

You have the right of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent at any time where processing is based on consent.

Write to dreamshare803@gmail.com. We answer within one month. You may also lodge a complaint with the CNIL (www.cnil.fr) or your local supervisory authority.

11. Cookies and local storage

See the Cookie policy for the exact list of trackers, their purpose and how to change your choice.