Privacy notice

We record browser sessions

Every session on this site is recorded and sent to Sentry, our error-tracking provider. That is one hundred per cent of sessions, not a sample. A recording is a replay of what happened in your browser: the pages, the layout, the text on them, what you clicked and in what order.

What is left out: everything you type into a field is masked before it leaves your browser, and the two places we print your own email address or name carry a mask as well. Query strings are stripped from recorded URLs. Your product photographs and renders cannot load inside a replay, because the image route requires your own session.

What is in: the shape of the pages you visited, including a studio page showing a product you have not released yet — the page structure and its visible text, though not the picture itself.

We record at this rate because the product is new and watching a handful of real sessions is the only way to see where it fails. We will turn it down as soon as the aggregate numbers become readable. If you would rather not be recorded, tell us and we will say what we can do.

What we collect

• Your email address, and a name if you gave one when you signed in.
• The photographs you upload, and every render made from them.
• What you told us about the product: its name, its height, its colourways.
• Your plan, your billing period, how many shoots you have used, and the identifiers Stripe gives us for your customer and subscription. We never see your card number.
• For a visitor with no account: a random session id in a cookie, plus a salted hash of your IP address and, if your browser sent one, a salted hash of a device fingerprint. We also record which site sent you and any campaign tags in the link.
• Which steps you reached, recorded on our own server against your account or your anonymous session: that a photograph was prepared, that a shoot started, that the pictures appeared on your screen, that you hit a limit, that you downloaded. No third party is involved in this and it is not used for advertising.
• Errors and browser session recordings (above), and a random id in your browser's storage that joins one browser's recordings together.

The IP and fingerprint hashes are one-way and salted with a secret only our server holds, so we cannot read your IP address back out of them. They are still about you, and we treat them as personal data: they exist to stop one person taking the free preview a hundred times, which costs us real money each time.

Why we are allowed to use it

• To deliver what you asked for — your account, your shoots, your downloads, and the free preview. This is the contract between us.
• To take payment and keep the records a business must keep. This is our legal obligation and our contract with you.
• To stop abuse of the free preview and of the rate limits, to find and fix faults, and to understand how the product is used. This is our legitimate interest, and we have tried to take the least data that answers the question.

What we store in your browser

• ps_anon — a signed session id, set as an HttpOnly cookie, kept for a year. It is what lets us hand you back the preview you just made without an account. It is strictly necessary to deliver the thing you asked for, which is why there is no cookie banner on this site.
• ps_journey — a random id in your browser's local storage, kept until you clear your site data. It joins one browser's error reports and session recordings into one journey, which matters because signing in by emailed link usually opens a new tab. It is not strictly necessary; we keep it on our legitimate interest in diagnosing faults, and we are telling you about it here rather than burying it.

There is nothing else. We set no advertising cookies and no cross-site trackers, and we use no analytics company at all — what we know about a visit is what our own server wrote down while answering it.

Who else sees it

We use these companies to run the service. Each sees only what it needs.

• Stripe — payments and subscriptions. Sees your email address and your payment details, which go to it directly and never through us.
• Resend — sends your sign-in link, your automatic top-up receipts, and the “your images are ready” email if you ask for one. Sees your email address.
• Sentry — errors, logs and the browser session recordings described above. Sees your session as recorded, masked as described.
• Google — its Gemini models remove backgrounds, read your photograph to estimate the product, and check finished frames. Sees your product photographs and your renders.
• OpenAI — its image models render most of the sets. Sees your product photographs and the renders it produces.

Our hosting and database providers will be named here once they are chosen. They are not named yet, and naming a guess would be worse than the gap.

We do not sell your data, and we do not share it for anyone else's advertising.

Where it goes

Stripe, Resend, Sentry, Google and OpenAI are United States companies, so data we send them is processed outside the EU and the UK. Each of them publishes the safeguards it relies on for those transfers, and our agreements with them rest on those safeguards.

How long we keep it

• Your products, photographs and renders: until you delete them, or until you delete your account.
• Your account: until you delete it.
• The anonymous session record and its hashes: a year, which is the life of the cookie, and they are cleared when an account is deleted.
• Billing records: as long as tax and accounting law requires, which is longer than your account lives. Stripe keeps its own copy of what it processed.
• Session recordings and error reports: for as long as Sentry's retention holds them, which is measured in weeks, not years.
• The record that a shoot happened and what it cost: kept permanently, with your identifier removed when you delete your account (below).
• The record that we emailed you about a set: kept permanently, with your identifier removed in the same way. It holds no address and no message — only that one went out, which is what stops it being sent twice.

Deleting your account

You can delete your account yourself, from your studio. It happens immediately and cannot be undone.

Deleted: your products, your colourways, your uploaded photographs, every render made from them, your email address and name, and the hashes on any anonymous session that became your account. Any active subscription is cancelled.

Kept, with every identifier removed: the rows recording that a shoot happened, what it cost us, what was paid, and that we emailed you about a set. They no longer say who, and cannot be traced back to you. We keep them because a business has to be able to say what it earned and spent last quarter, and because a deletion must not quietly rewrite its own accounts. Stripe also keeps its record of the payments it processed, as its own controller, for accounting.

Also kept: the empty room photographs we rendered in advance. They are ours and they contain nothing of yours.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to the uses we base on legitimate interest, and complain to your data protection authority.

Two of those you can do yourself, from your studio, without asking: download your account data as a file, and delete your account. For anything else, or if the download does not answer your question, write to us.

We have not published an address for these requests yet.

Children

This is a tool for people selling things. It is not for children, and we do not knowingly collect anything from them.

Changes

This notice carries a version number and the date it took effect, both at the top of the page. When it changes, the new version appears here with a new number.