Privacy Policy

We collect and process the following categories of personal data:

• Account data, your name, email address, and password (stored only as a one-way bcrypt hash; we never store plaintext passwords).
• Authentication data, Google OAuth identifier (if you sign in with Google) and, if you enable two-factor authentication, a 2FA secret (stored encrypted).
• Billing data, your Stripe customer identifier and subscription/price identifier. We do not store payment card numbers; card data is collected and processed directly by Stripe (a PCI-DSS Level 1 processor).
• Technical and security data, session IP addresses and browser user-agent strings, and authentication logs (including the email address used on failed sign-in attempts), used for security, abuse prevention and fraud detection.
• User-generated content, campaign briefs and other text you author, and media you upload (images, video, PDF).
• Provider API keys, if you connect your own image or video generation account, we store that key encrypted, together with a masked form of it (for example "••••••••a3f2") so you can recognise which key is connected.
• Invitation data, if you invite someone to the Service, we store the email address you give us until the invitation is accepted or expires, or until your account is deleted.
• Service journey records: if you have an account, the days you visit the Service while signed in, and when you start a checkout, complete one, or one fails to open (with Stripe's reference for that checkout). Our server records these from the requests your browser already makes while you are signed in; no new cookie or other storage is placed on your device for this purpose. No page history, IP address, browser details or content is included.
• Waitlist and enquiry data, if you join the waitlist or request a trial before creating an account, we store the email address, and the name where you give one.

We do not intentionally collect special category data (e.g. data revealing racial or ethnic origin, health, religious beliefs, or biometric data) and ask that you do not submit it through the Service.

We process your personal data for the following purposes and on the following legal bases:

• To provide the Service (create and authenticate your account, generate creative direction, store your projects)performance of a contract (Art. 6(1)(b)).
• To take payment and manage subscriptions via Stripeperformance of a contract (Art. 6(1)(b)).
• To secure the Service (rate limiting, fraud and abuse prevention, auth logging)legitimate interests (Art. 6(1)(f)) in keeping the Service and its users safe.
• To send service emails (email verification, password reset, essential account notices)performance of a contract and legitimate interests.
• To comply with legal obligations (e.g. tax, accounting, responding to lawful requests)legal obligation (Art. 6(1)(c)).
• To improve and analyse the Service using privacy-friendly, aggregated metricslegitimate interests (Art. 6(1)(f)); where any non-essential cookie or tracking is used, on the basis of your consent (Art. 6(1)(a)). See our Cookie Policy.
• To understand where the Service works and where people get stuck: we look at the journey of each account (when it signed up, verified its email, wrote a trial brief, made its first campaign, was last active, came back, and started or completed a checkout), using the records above and data we already hold to run your account. Legitimate interests (Art. 6(1)(f)) in understanding and improving our own service. Only our two founders can see it. It shows steps and dates, never what you wrote, and shows email addresses only in part. It is never used for advertising or to decide whom to contact, never shared or sold, and no decision about you is made from it. People who wrote a trial brief but have no account appear only as a numbered, dated entry. You can object at any time by writing to studio@houseofessenzi.com; we will delete your journey record, stop recording it, and remove you from that view.

Where we rely on legitimate interests, you have the right to object (see Section 8). Where we rely on consent, you may withdraw it at any time.

We share personal data with the following sub-processors, each acting under contract and appropriate data-protection terms. A current list is maintained in our Data Processing Agreement.

• Anthropic, AI generation; brief text is sent to its API.
• Apify, gathers public news headlines for the Studio Journal, from search terms we set; nothing you submit is sent to it.
• Cloudflare R2, storage of files you upload (images, video, PDF), and the encrypted weekly copy of our database (European Union).
• GitHub, runs our weekly database backup, holding the copy unencrypted for a few minutes while it is checked and encrypted (GitHub, Inc., United States).
• Stripe, payment processing (PCI-DSS); we store no card data.
• Google, OAuth sign-in, if you choose to authenticate with Google.
• Resend, delivery of verification, password-reset and account emails (United States). Where Resend is not configured we fall back to an SMTP provider.
• Vercel (hosting), hosting and infrastructure (United States / global edge); Service traffic passes through this platform.
• Vercel Analytics and Speed Insights, privacy-friendly, cookieless aggregate usage and performance measurement (United States / global edge). Both are loaded only after you accept non-essential cookies.
• Sentry, application error and performance monitoring, including optional session replay for diagnosing faults (United States). Session replay is enabled only after you accept non-essential cookies.
• Image and video generation providers, fal.ai, Replicate, Runway, Higgsfield and OpenAI (United States), and Stability AI (United Kingdom). The prompt our engine builds from your brief, and any reference image you attach to that generation, are sent to whichever provider renders the model you chose.
• Neon, the managed PostgreSQL database that holds your account, briefs, projects and logs (Neon Inc., United States).
• Meta, advertising conversion measurement (Meta Platforms Ireland Limited, with onward processing by Meta in the United States). The Meta Pixel loads only after you accept non-essential cookies. Separately, when you register, start a trial or pay, our server sends Meta an event containing a one-way hash of your email address, your IP address and your browser user-agent, but only if you accepted non-essential cookies. If you declined, or never answered the banner, nothing is sent.
• Google Tag Manager and Google Ads, measurement and advertising tags (Google Ireland Limited, with onward processing by Google in the United States). They load on every visit but run under Google Consent Mode v2 with advertising and analytics storage denied until you accept. See our Cookie Policy.
• Plausible Analytics, cookieless aggregate page-view measurement, with no cross-site identifier (Plausible Insights OÜ, Estonia). Loaded only after you accept non-essential cookies.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Rectification of inaccurate or incomplete data;
• Erasure ("right to be forgotten") in certain circumstances;
• Restriction of processing in certain circumstances;
• Data portability, to receive your data in a structured, commonly used, machine-readable format;
• Object to processing based on legitimate interests, and to withdraw consent at any time where processing is based on consent.

You can exercise three of these yourself, without asking us. In Settings → Account → Your data you can download a copy of the personal data we hold about you as JSON, covering both access and portability, and stating what it contains and what it leaves out, and you can delete your account. The deletion flow offers you the download first.

For anything else: rectification, restriction, objection, withdrawing consent, or a question about the copy you have downloaded, contact studio@houseofessenzi.com (or studio@houseofessenzi.com). We will respond within the timeframes required by law (generally one month under the GDPR). You also have the right to lodge a complaint with a supervisory authority, in the UK, the Information Commissioner's Office (ICO, ico.org.uk); in the EU, your local Data Protection Authority. We would appreciate the chance to address your concerns first.

If you are a California resident, you have the right to: know what personal information we collect, use and disclose; access and obtain a copy of it; request correction; request deletion; and not be discriminated against for exercising these rights.

Do Not Sell or Share My Personal Information. We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA. Accordingly, no "Do Not Sell or Share" opt-out is required, though you may still contact us with any request. To exercise your California rights, contact studio@houseofessenzi.com; you may use an authorised agent, and we will verify your request as required by law.

We retain personal data only as long as necessary for the purposes set out above:

• Account, profile and user-generated content (briefs, projects), retained for the life of the account. When you delete your account, or we act on a valid erasure request, the records are deleted at that point in a single database transaction. They are not anonymised and kept. They remain only in our database backups until those expire, after at most 30 days (see Database backups below), and nothing else is archived, save where a longer period is required by law (see billing records below).
• Database backups: so that the Service can recover from a failure or a mistake, our database keeps a continuous history for 7 days and a daily snapshot kept for 14 days, both held by our database provider in London. In addition, once a week we also keep an encrypted copy of the database with Cloudflare, stored in the European Union and kept for 4 weeks before it is deleted automatically. It is encrypted before it is stored and only our founders hold the keys, so Cloudflare cannot read it; the copy is made and checked on a computer run for us by GitHub, which holds it unencrypted only for the few minutes that takes. Backups are used only to restore the Service, never for any other purpose, and they expire automatically. Anything you delete, or that the periods in this section remove, leaves the history within 7 days, the last daily snapshot holding it within 14 days and the last weekly copy holding it within 30 days. If we ever have to restore from a backup, we delete again anything that had been deleted since that backup was taken, before the Service is used.
• Uploaded media, retained while associated with your account, and deleted from our storage in the same operation that deletes the records, not on a later schedule. If our storage provider is unreachable at that moment the records are still deleted and the files are recorded for deletion separately; that record holds a storage location and nothing about you.
• Authentication and security logs (session IPs, user-agent strings, failed sign-in records), authentication logs are deleted 90 days after they are written, and session records 30 days after the session was last active. A daily job does both.
• Support correspondence, support and enquiry emails are retained for 24 months from the last contact, then deleted.
• Billing records, invoices and transaction records are retained for 6 years from the end of the relevant financial year, as required by UK tax and accounting law.
• Trial briefs written without an account, if you use the free trial, the brief you write and the direction the Engine returns are stored against the email address you give, so that they are waiting for you if you later open an account with that address. They are released to an account only once that address has been verified. If nobody claims a trial brief it is deleted 45 days after it was written, by the same daily job. Once claimed, it becomes part of your account content and follows the account-retention period above.
• Service journey records: deleted 12 months after each one is recorded, by the same daily job; deleted at once if you delete your account, and at once if you object.

House notes is an optional feature that is off unless you switch it on in Settings.

This section applies to House of Essenzi, a trading name of Essenzi Media Ltd (company number 16144272).

What we collect. When it is on, we record the edits you make to your own projects (which section and field changed, the value before and after, and when) and the patterns we find in them, such as your usual lens, light or budget tier. We also keep a record of when you switched the feature on or off and the wording you saw.

Why. To suggest your usual choices. You confirm every suggestion before it is used, and your brief always comes first. We do not make automated decisions about you.

Lawful basis. Your consent. You can withdraw it at any time by switching house notes off in Settings. Switching it off does not affect any other feature.

What we do not use. Your clients' personal data, contact details, payment details or any special category data.

Who can see it. Only you, when signed in to your account. It never appears on client links, client documents or shared pages.

Who processes it for us. Vercel (hosting), Neon (database) and Anthropic (AI processing). These providers may process data in the United States. We protect these transfers with the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement.

How long we keep it. While the feature is on. We delete it within 30 days of you switching it off, 24 months after your last activity, or when you delete your account. Your consent lasts two years, after which the feature switches itself off and asks you to switch it on again.

Your rights. You can access, export, correct or delete this data, and withdraw consent, in the product or by emailing studio@houseofessenzi.com. We acknowledge complaints within 30 days. You can also complain to the Information Commissioner's Office at ico.org.uk.