Privacy Policy

We collect and process the following categories of personal data:

• Account data — your name, email address, and password (stored only as a one-way bcrypt hash; we never store plaintext passwords).
• Authentication data — Google OAuth identifier (if you sign in with Google) and, if you enable two-factor authentication, a 2FA secret (stored encrypted).
• Billing data — your Stripe customer identifier and subscription/price identifier. We do not store payment card numbers; card data is collected and processed directly by Stripe (a PCI-DSS Level 1 processor).
• Technical and security data — session IP addresses and browser user-agent strings, and authentication logs (including the email address used on failed sign-in attempts), used for security, abuse prevention and fraud detection.
• User-generated content — campaign briefs and other text you author, and media you upload (images, video, PDF).
• DNA-extraction inputs — brand copy you paste, or public website URLs you submit for brand-DNA analysis, and the public page text fetched from those sources (processed transiently; see Section 4).
• Provider API keys — if you connect your own image or video generation account, we store that key encrypted, together with a masked form of it (for example "••••••••a3f2") so you can recognise which key is connected.
• Invitation data — if you invite someone to the Service, we store the email address you give us until the invitation is accepted or expires, or until your account is deleted.
• Waitlist and enquiry data — if you join the waitlist or request a trial before creating an account, we store the email address, and the name where you give one.

We do not intentionally collect special category data (e.g. data revealing racial or ethnic origin, health, religious beliefs, or biometric data) and ask that you do not submit it through the Service.

We process your personal data for the following purposes and on the following legal bases:

• To provide the Service (create and authenticate your account, generate creative direction, store your projects) — performance of a contract (Art. 6(1)(b)).
• To take payment and manage subscriptions via Stripe — performance of a contract (Art. 6(1)(b)).
• To secure the Service (rate limiting, fraud and abuse prevention, auth logging) — legitimate interests (Art. 6(1)(f)) in keeping the Service and its users safe.
• To send service emails (email verification, password reset, essential account notices) — performance of a contract and legitimate interests.
• To comply with legal obligations (e.g. tax, accounting, responding to lawful requests) — legal obligation (Art. 6(1)(c)).
• To improve and analyse the Service using privacy-friendly, aggregated metrics — legitimate interests (Art. 6(1)(f)); where any non-essential cookie or tracking is used, on the basis of your consent (Art. 6(1)(a)). See our Cookie Policy.

Where we rely on legitimate interests, you have the right to object (see Section 8). Where we rely on consent, you may withdraw it at any time.

We share personal data with the following sub-processors, each acting under contract and appropriate data-protection terms. A current list is maintained in our Data Processing Agreement.

• Anthropic — AI generation; brief and DNA-extraction text is sent to its API.
• Apify — fetches public page text from website URLs you supply for DNA extraction.
• Cloudflare R2 — storage of files you upload (images, video, PDF).
• Stripe — payment processing (PCI-DSS); we store no card data.
• Google — OAuth sign-in, if you choose to authenticate with Google.
• Resend — delivery of verification, password-reset and account emails (United States). Where Resend is not configured we fall back to an SMTP provider.
• Vercel (hosting) — hosting and infrastructure (United States / global edge); Service traffic passes through this platform.
• Vercel Analytics and Speed Insights — privacy-friendly, cookieless aggregate usage and performance measurement (United States / global edge). Both are loaded only after you accept non-essential cookies.
• Sentry — application error and performance monitoring, including optional session replay for diagnosing faults (United States). Session replay is enabled only after you accept non-essential cookies.
• Image and video generation providers — fal.ai, Replicate, Runway, Higgsfield and OpenAI (United States), and Stability AI (United Kingdom). The prompt our engine builds from your brief, and any reference image you attach to that generation, are sent to whichever provider renders the model you chose.
• Neon — the managed PostgreSQL database that holds your account, briefs, projects and logs (Neon Inc., United States).
• Meta — advertising conversion measurement (Meta Platforms Ireland Limited, with onward processing by Meta in the United States). The Meta Pixel loads only after you accept non-essential cookies. Separately, when you register, start a trial or pay, our server sends Meta an event containing a one-way hash of your email address, your IP address and your browser user-agent — but only if you accepted non-essential cookies. If you declined, or never answered the banner, nothing is sent.
• Google Tag Manager and Google Ads — measurement and advertising tags (Google Ireland Limited, with onward processing by Google in the United States). They load on every visit but run under Google Consent Mode v2 with advertising and analytics storage denied until you accept. See our Cookie Policy.
• Plausible Analytics — cookieless aggregate page-view measurement, with no cross-site identifier (Plausible Insights OÜ, Estonia). Loaded only after you accept non-essential cookies.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Rectification of inaccurate or incomplete data;
• Erasure ("right to be forgotten") in certain circumstances;
• Restriction of processing in certain circumstances;
• Data portability — to receive your data in a structured, commonly used, machine-readable format;
• Object to processing based on legitimate interests, and to withdraw consent at any time where processing is based on consent.

You can exercise three of these yourself, without asking us. In Settings → Account → Your data you can download a copy of the personal data we hold about you as JSON — covering both access and portability, and stating what it contains and what it leaves out — and you can delete your account. The deletion flow offers you the download first.

For anything else — rectification, restriction, objection, withdrawing consent, or a question about the copy you have downloaded — contact studio@houseofessenzi.com (or studio@houseofessenzi.com). We will respond within the timeframes required by law (generally one month under the GDPR). You also have the right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ICO, ico.org.uk); in the EU, your local Data Protection Authority. We would appreciate the chance to address your concerns first.

If you are a California resident, you have the right to: know what personal information we collect, use and disclose; access and obtain a copy of it; request correction; request deletion; and not be discriminated against for exercising these rights.

Do Not Sell or Share My Personal Information. We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA. Accordingly, no "Do Not Sell or Share" opt-out is required, though you may still contact us with any request. To exercise your California rights, contact studio@houseofessenzi.com; you may use an authorised agent, and we will verify your request as required by law.

We retain personal data only as long as necessary for the purposes set out above:

• Account, profile and user-generated content (briefs, projects) — retained for the life of the account. When you delete your account, or we act on a valid erasure request, the records are deleted at that point in a single database transaction. They are not anonymised and kept, and there is no archive behind them (save where a longer period is required by law — see billing records below).
• Uploaded media — retained while associated with your account, and deleted from our storage in the same operation that deletes the records, not on a later schedule. If our storage provider is unreachable at that moment the records are still deleted and the files are recorded for deletion separately; that record holds a storage location and nothing about you.
• Authentication and security logs (session IPs, user-agent strings, failed sign-in records) — authentication logs are deleted 90 days after they are written, and session records 30 days after the session was last active. A daily job does both.
• Support correspondence — support and enquiry emails are retained for 24 months from the last contact, then deleted.
• Billing records — invoices and transaction records are retained for 6 years from the end of the relevant financial year, as required by UK tax and accounting law.
• DNA-extraction source material — the brand copy you paste and the public page text fetched from website URLs you submit is processed transiently and is not stored; only the derived creative brief is retained, and it follows the account-retention period above.