Privacy policy

1. Who we are

Byte Shift Ltd, registered in England and Wales under company number 13244292, registered office Office 408, Screenworks, 22 Highbury Grove, London, N5 2ER, is the controller of the personal data described here. Write to us about anything on this page at support@fashionstudioapp.com.

This policy covers FashionStudio and this website. We are not required to appoint a data protection officer and have not appointed one; the address above reaches the people responsible.

2. Two different roles

For your account data, we are the controller: we decide what is collected and why, and this policy explains it.

For personal data inside the photographs you upload, for example the face of a model in a photograph you own, you are the controller and we act as your processor. We handle that material on your instructions, which you give by using the service. Our data processing agreement sets out those terms, and you must have your own lawful basis and the necessary consent for that material before you upload it.

3. What we collect, why, and for how long

If you write to us through a contact form, we keep what you typed (your name, email address, company or shoot name if given, and the message), the address it was sent from and your browser type, so we can answer you and recognise abuse, and whether the sender was signed in to an account. Contact messages are kept for two years after the last reply and then deleted. The forms are protected by Cloudflare Turnstile, which checks that the sender is a person by looking at signals from your browser rather than asking you to solve a puzzle; Cloudflare processes those signals as our processor and does not learn what you wrote.

If you sign in with Google, Google sends us your email address, your name and a stable identifier for your Google account, which we keep so we can recognise you next time. Google records the sign in under its own privacy policy, as an independent controller.

We do not collect special category data deliberately. A photograph of a person can reveal characteristics such as ethnicity, and we process it as ordinary image data on your instructions rather than to infer anything about anyone. Do not upload health, biometric or other sensitive material: the service is not designed for it.

4. AI, and what we do not do with your photographs

We do not use your uploads, your product descriptions or your generated photographs to train, fine tune or evaluate any AI model, ours or a third party's. There is no opt out because there is nothing to opt out of.

To produce your photographs we send them to the AI providers listed in our subprocessor list. We use their business or enterprise arrangements, under which submitted content is not used to train their models. Providers may retain content briefly to run abuse detection, and we keep the list current so you can see exactly who is involved.

We record the fact and cost of each AI call, the model used and the account it belonged to, so we can bill correctly and detect abuse. Those records contain no image data.

5. Who else sees your data

We do not sell personal data, and we do not share it for anyone else's advertising. We share it only with:

• the processors in our subprocessor list, each under a contract that restricts them to our instructions;
• Stripe, who take payment: for the card details you enter into their form and for fraud prevention, Stripe acts as an independent controller under its own privacy policy;
• professional advisers, and a buyer of our business if it is sold, in which case this policy continues to apply until you are told otherwise;
• the authorities, where we are legally required to, or where it is necessary to establish, exercise or defend legal claims.

6. Sending data outside the UK

Some of our processors are outside the United Kingdom. Where that happens we rely on UK adequacy regulations where they exist, and otherwise on the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with an assessment of the safeguards in the destination country. Ask us and we will tell you which applies to a given provider.

7. How we protect it

Passwords are stored only as bcrypt hashes and are never recoverable, by us or by anyone else. Session tokens are stored hashed and expire automatically. Your uploaded and generated images are served only through authenticated routes scoped to your own account, never from a public folder. Administrative access uses a separate system with separate credentials from customer accounts, and administrators cannot read your password.

No service is perfectly secure. If a breach affects your rights we will tell the Information Commissioner's Office within 72 hours where required, and tell you without undue delay where the risk to you is high.

8. Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate;
• delete your data, which for most of it means closing your account;
• restrict or object to processing we carry out under legitimate interests;
• send your data to you or another provider in a portable form;
• withdraw consent, where we relied on it, without affecting processing before you withdrew.

Write to support@fashionstudioapp.com. We answer within one calendar month, and usually much sooner. There is no charge unless a request is manifestly unfounded or excessive.

You can also complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right.

9. Cookies

This website sets no cookies unless you accept analytics. If you do, Google Analytics sets two to count visits and see which pages are read; it loads only after you say yes, advertising features are off, and the choice can be changed from the footer at any time. Visits are also counted in aggregate by Cloudflare Web Analytics, which sets no cookie and cannot tell one visitor from another, so it needs no consent. The application sets one strictly necessary cookie to keep you signed in, and stores your light or dark preference in your own browser. When you open the payment form on the billing page, Stripe sets two cookies of its own to prevent card fraud. There is no advertising, profiling or cross site tracking. The cookie policy lists each one.

When you create an account we also keep a note of how that visit reached us: the campaign parameters in the link you followed, if any, the site that referred you and the page you landed on. It is written once to your account, never updated, stored nowhere on your device beforehand, and used only to learn which of our own efforts bring customers.

10. Children

The service is for adults. It is not directed at children, we do not knowingly collect data about anyone under 18, and we delete such an account if we discover one.

11. Changes to this policy

We update this policy as the service changes. The date at the top of this page always reflects the current version, and we will tell you by email before a change that materially affects your rights takes effect.