Privacy policy Version: 2026-10-09-v9 How unseenframes.studio processes personal data. 1. Controller Fahad Fuad, Müllerstraße 128, 13349 Berlin, Deutschland Email: kontakt@unseenframes.studio Phone: +49 176 32704906 2. Hosting and security Cloudflare delivers and secures this website and provides its database and video storage. It may process IP addresses, request times and URLs, browser and device information, and security and error records. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in reliable, secure operation. Providing contractual features also relies on Article 6(1)(b) GDPR. 3. Accounts and sign-in Supabase handles authentication, including your email address, account identifier, registration time, optional name, and session and security information. Our protected customer administration additionally stores your verified account email, optional display name and last studio visit for support and account management. We do not receive a list of plain-text passwords. The bases are Article 6(1)(b) GDPR for your account and Article 6(1)(f) for security. Supabase sends account verification and password-reset messages through Resend (Plus Five Five, Inc.). Resend receives recipient and sender addresses, necessary message content including confirmation links, and delivery information. The bases are Article 6(1)(b) and (f) GDPR. If you choose Google sign-in, Google provides the identity information you authorize, including email and possibly name. Email sign-in is an alternative. 4. Video generation and uploads We process your prompts, generation settings and uploaded references to fulfill your generation request. Necessary inputs are sent to fal (Features & Labels, Inc.) and the model services used for the selected generation. Inputs may contain personal information if you include it. The basis for processing your own data to deliver the service is Article 6(1)(b) GDPR. You must have an appropriate legal basis for providing another person’s data. Jobs, prompts, status, credit accounting and generated videos are associated with your account. Studio access to videos requires an authorization check. Uploading a reference does not create an additional public reference-image gallery on our website. Upload only content you may lawfully use and avoid particularly sensitive personal information where its processing has not been clarified. 5. Payments and credits Stripe Checkout processes payments. We transmit the product, amount, internal order and account identifiers, and where needed your email for confirmation. Stripe and your selected payment provider process payment information. Available methods depend on your device and the enabled checkout methods. Full card details are not stored in our studio database. We store order identifiers, products, amounts, payment and subscription status, credit allocations, refunds and contractual records. Historical direct PayPal payments remain recorded for administration and documentation. The bases are Article 6(1)(b) GDPR and Article 6(1)(c) where retention is required by law. 6. Contact, support and contractual requests For contact, support, withdrawal and cancellation requests we process your contact information, request, receipt and handling status. Internal support reports also include your account and affected job or order identifier, time and a technical status snapshot. These records are available only in protected administration and are used for handling the request and investigating errors. The bases are Article 6(1)(b) and (c) GDPR and Article 6(1)(f) for other legitimate support and security purposes. Zoho Mail operates our kontakt@unseenframes.studio mailbox using European mail servers. Resend sends automated purchase, withdrawal and cancellation confirmations, receiving addresses, required message content and delivery information. Messages remain in an outbox if automatic delivery is unavailable or fails. The bases are Article 6(1)(b) and (c) GDPR. Resend describes processing in the United States. European mail servers do not imply that all support or subprocessors operate exclusively within the EU. 7. Cookies, referrals and optional analytics Authentication cookies support the session you request. Your chosen language is stored locally. These necessary functions rely on Section 25(2)(2) TDDDG. External checkout pages have their own privacy and storage settings. A referral cookie is set only after you consent on an invitation page. It contains a signed referral code and time, expires after 30 days and is not used for advertising on other sites. Its bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can revoke consent at /cookies. Registration remains available without consent. After an attributed registration, we retain relevant account identifiers and qualifying order information to administer the referral program and prevent abuse. Completed attributions and required accounting records remain subject to their applicable retention periods. Referrers see aggregate counts, not names, emails or order details. Our optional usage analytics is off by default. Only after consent at /cookies do we use a random visitor identifier and source information in browser session storage and record visits and interactions such as checkout clicks. For signed-in customers, source information may be linked to the account. Analytics data is kept for up to 90 days. A cookie stores your choice for up to one year. The bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can revoke consent at /cookies at any time for the future. No external advertising pixels are used. 8. Service and marketing emails Necessary account, purchase and factual service messages use your verified account or purchase email where required for the contract or supported by a legitimate interest in clear service communication. They are not treated as consent to advertising. Optional discount and new-feature emails require your express consent. You may choose them at registration or at /account#email-preferences; account access does not depend on this choice. At registration the choice becomes active after account identity confirmation. We store account identifier, choice, source, language, consent-text version and timestamps. You can revoke consent in account settings; each marketing email links there. The basis is Article 6(1)(a) GDPR alongside applicable marketing law. Resend sends these messages. Protected administration stores subject, message, audience, recipient snapshot, sending status and delivery identifiers. Consent is checked again before sending. Uncertain delivery attempts are not blindly resent. 9. International processing Providers and their subprocessors may process data outside the EU/EEA, particularly in the United States and other countries where international services operate. Transfers require an applicable basis under Articles 44 onward GDPR, such as an applicable adequacy decision or safeguards including EU standard contractual clauses. Contact us for details of recipients and transfer bases applicable to your data and copies of applicable safeguards. We do not promise exclusively European processing. 10. Retention We process account data and stored generations to provide your account. You can request deletion. Where legal duties or establishing, exercising or defending claims require retention, the retained information is restricted to those purposes. Referral cookies expire after 30 days; analytics records after up to 90 days. Contact, withdrawal, cancellation and contract records are kept for handling, legally required evidence and applicable claim periods. Tax-record retention depends on document type and applicable law. Security and error records are needed to investigate technical issues and abuse. There is no single retention period for all records. 11. Your rights Subject to applicable requirements, you may request access, correction, erasure, restriction and portability. In My Studio you can update account details, download a JSON copy of key studio data and submit or withdraw a pending account-deletion request. For deletion requests we store account identifier, email, request identifier, status and timestamps while processing and required retention are checked. You may revoke consent for future processing and object on grounds relating to your situation to processing based on legitimate interests. You may object to direct marketing at any time. You may complain to a data protection authority, particularly where you live, work or where an alleged infringement occurred. The Berlin Commissioner for Data Protection and Freedom of Information is relevant to our Berlin operation: https://www.datenschutz-berlin.de/ Information necessary for accounts, payments and generation is required for those services. Referrals and analytics are optional. Our application does not make solely automated decisions producing legal or similarly significant effects within Article 22 GDPR. Provider privacy information Cloudflare: https://www.cloudflare.com/privacypolicy/ Supabase: https://supabase.com/privacy fal: https://fal.ai/legal/privacy-policy Stripe: https://stripe.com/privacy Zoho: https://www.zoho.com/privacy.html Resend: https://resend.com/legal/privacy-policy Google, if selected: https://policies.google.com/privacy