Privacy Policy

Effective 6 September 2026. What we store, why, and who else touches it.

This document is a draft. The highlighted values are unfilled and it has not been reviewed by a lawyer. It must not be relied on until both are done.

[LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS], is the data controller for Parti. This policy says what we hold, why, who else touches it, and what you can ask us to do about it. Data-protection requests: privacy@partiatelier.com.

1. What we collect

  • Account details — email address, display name, profile photo if you sign in with Google, and the workspaces and projects you belong to.
  • Your content — the images, 3D models and site files you upload, the prompts you write, and the images generated from them.
  • Usage and billing records — every generation run with its model, tool, timestamp and credit cost; every credit grant; and the subscription state mirrored from Paddle. We do not receive or store card numbers.
  • Product analytics — pages viewed and actions taken, tied to your account identifier so we can see where the product fails people.
  • Technical logs — request metadata and errors, kept to operate and secure the Service.

2. Why we hold it, and on what basis

  • To provide the Service — storing your projects, running generations, keeping the credit ledger accurate. Basis: performance of our contract with you.
  • To take payment — subscription and credit records. Basis: contract, and legal obligation for tax and accounting records.
  • To improve the product and prevent abuse — analytics, rate limiting, fraud checks. Basis: our legitimate interest in a working, sustainable service, balanced against your interest in not being tracked more than necessary.

We do not sell personal data, and we do not use your content to train models. We do not run advertising and we do not share your content with anyone except the processors below, who act on our instructions.

3. Who else processes it

Running the Service means sending some data to other companies. These are all of them, and what each one gets:

  • Google Firebase — Authentication, database, and file storage for your account, projects and images. (Google Cloud, per the project's configured region)
  • fal.ai — Runs the image generation models. Receives the images and prompts you submit for a run. (United States)
  • Paddle.com Market Ltd — Merchant of record for every payment. Handles card details, tax and invoicing; we never see a card number. (United Kingdom / European Union)
  • OpenAI — Powers the assistant features where they are enabled on your workspace. (United States)
  • Cloudflare — Serves the web application. (Global edge network)
  • PostHog — Product analytics: which features are used, and where people get stuck. (United States or European Union, per the configured host)
  • Hetzner Online GmbH — Hosts the application server that queues and runs generation jobs. (Germany)

Some of these are outside the European Economic Area. Where that is so, transfers rely on the European Commission's standard contractual clauses or an equivalent mechanism in the provider's own terms.

What a model provider receives. When you run a generation, the source image, any reference images and the prompt are sent to the provider you selected so it can produce the result. We contract for that material not to be used for training. It is not associated with your name or email at the provider.

4. How long we keep it

  • Account, projects and images — until you delete them, or 30 days after you delete your account.
  • Credit ledger and billing records — retained after account deletion for as long as tax and accounting law requires, typically six to ten years. These are financial records and cannot be erased on request.
  • Analytics and technical logs — a rolling window, currently no more than 12 months.

5. Your rights

Depending on where you live you may have the right to access your data, correct it, delete it, restrict or object to processing, withdraw consent, and receive a portable copy.

  • Access and portability — download your profile, credit ledger and project list as a JSON file from your account settings, at any time, without asking us.
  • Deletion — request account deletion from your account settings. We confirm and complete it within 30 days, subject to the billing records above.
  • Anything else — write to privacy@partiatelier.com. We answer within one month.

If you think we have handled your data badly, you may complain to the data-protection authority where you live or work.

6. Cookies and local storage

We use browser storage for things the Service cannot work without: your sign-in session, which workspace and project you last opened, your theme, and whether you dismissed a notice. Analytics uses a cookie to recognise a returning browser. We do not use advertising or cross-site tracking cookies.

7. Security and children

Access to projects is enforced at the database layer, not only in the interface: a project is readable by the accounts attached to it and no others. Credit balances and subscription state can only be written by our servers. Transport is encrypted throughout.

The Service is not for children. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.

8. Changes and contact

We will post any change here and, if it is material, tell you before it takes effect. General questions: support@partiatelier.com. Privacy requests: privacy@partiatelier.com. See also the Terms of Service.