What we keep,
what we never touch.
The short version: your photos, brand kits, trained models, and generated frames are yours. We store them on our servers in Germany, we never train shared models on them, and we delete them within 30 days of you closing your atelier. The long version is below.
1. Who we are
2. What we collect, and why
Account data: your email, your house name and your password (stored only as a bcrypt hash, never readable). Used to let you sign in and to issue invoices.
Product data: photos you upload, brand kits you build, models you create, frames and clips you generate. Used only to deliver the product to you.
Billing data: handled by Stripe · we never see your card. Used to process payments.
The Journal newsletter: your email, when you subscribed and confirmed, and a one-way hash of your IP address as proof of consent. Used only to send the monthly letter; every letter has a one-click unsubscribe.
Contact form: your name, email, company and message. Used only to answer you.
Free tools: the marketplace image checker and the image resizer run in your browser and never upload your image. The background remover sends the image to our processing provider for the cut-out; we do not store it.
Telemetry: server logs and error traces. Used to keep Atelier Noir running. Retention 30 days.
3. Where it is processed, and by whom
Our servers and database are at Hetzner Online GmbH in Nuremberg, Germany. The providers below process data on our behalf, each only for the task listed:
- Replicate, Inc. (United States) — runs the image and video models; the photos needed for a generation are sent to it and deleted by Replicate automatically after about an hour.
- OpenAI (United States) — describes the garment in your photo and checks each finished frame for defects.
- Stripe — payments and invoices.
- Brevo (France) — sends account emails and the Journal newsletter.
- Migadu (Switzerland) — hosts our mailboxes, so it holds the emails you send us.
- Google Ireland — Google Analytics 4, only if you accept analytics cookies.
Transfers to the United States rely on the safeguards of Chapter V of the GDPR offered by these providers, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. Virus scanning of uploads runs on our own server.
4. What we never do
We never train shared foundation models on your data. Period.
We never sell, rent, or share your data with third parties for marketing.
We never use your generated frames in our own marketing without explicit written consent.
We never use ad-tech tracking on ateliernoir.ai. No Meta pixel, no Google Ads pixel, no third-party retargeting.
5. Your rights
6. Retention
7. Cookies & analytics
8. Children
9. Changes to this notice
10. Complaints
11. The mobile app and virtual try-on
The Atelier Noir app for iPhone and Android uses the same account and the same data as the studio on the web. On the phone we also keep: a sign-in token (stored in the phone's secure storage, only its hash is on our servers), the phone's name and system, your language, and — only if you allow notifications — a push token used to tell you when your frames are ready (sent through Expo's notification service and Apple or Google).
The camera and your photo library are used only when you take or choose a photo, and only that photo is uploaded. Saving to Photos happens only when you tap it. The app has no advertising and no tracking, and it does not collect your location or contacts.
Virtual try-on uses a photo of a person — including their face and body — to show them wearing a product. It is for adults only (18+) and only with the person's consent, which you confirm each time. The photo is stored in a private folder that is never publicly reachable, is used only to create that one image, and is deleted together with the result after 24 hours. It is never used to identify anyone, never used to train models and never shared for any other purpose.
To create the try-on, the person's photo and the product photo are sent to Replicate, which runs Google's image model; before that, a small copy is sent to OpenAI for an automatic check that the person looks 18 or older. The measurements tool and the post text for social media also use OpenAI. We never use these images to train models.
You can delete your account at any time, in the app (Account → Delete account) or in the studio (Settings → Danger zone). Deleting it cancels any subscription first, then removes your account, your atelier, every campaign, clip and file straight away; only invoices are kept, as tax law requires.