This Privacy Policy explains how Atelier ("we," "our," or "us") collects, uses, shares, and protects information when you use the Atelier platform and website (the "Service"). If you do not agree with it, please do not use the Service.
1. Our Role
For your own account information, we are the "controller" (or "business") — we decide how it is handled, and this policy explains how.
For personal information you put into the Service about other people — your teammates, your vendor contacts, and any email contact lists you upload — you are the controller and we act as your processor, handling that data on your instructions to provide the Service. You are responsible for having a lawful basis to collect and share that information with us, for telling those people how their data is used, and for honouring their rights. See Section 11.
2. Information We Collect
- Account information. Your email address, password (stored only as a salted hash by our authentication provider — we never see it), display name, and, if you sign in with Google, the basic profile information Google returns.
- Brand and production content. Everything you create in the Service: product records, designs and uploaded images, layered canvas working files, tech packs, measurements and bills of materials, materials, vendor records, RFQs and quotes, samples and photos, production orders, payments you log, notes, comments, and chat messages.
- Payment information. Subscriptions and credit purchases are processed by Stripe. We never receive or store your full card number. We store a Stripe customer identifier, your subscription status and plan tier, and your credit balance and transaction ledger.
- Connected platform data. If you connect a storefront or social account (Shopify, WooCommerce, Etsy, Instagram, TikTok, YouTube and Pinterest), we store the access token that connection issues and the data the connection returns — typically orders, product and stock levels, shop identifiers, and the connected account handle.
- AI inputs and outputs. The prompts, images, and brand context you submit to AI features, and the results returned. See Section 4.
- Technical and usage data. IP address, browser and device type, operating system, timestamps, pages viewed, and error diagnostics collected automatically when you use the Service.
- Communications. Messages you send us for support, feedback, or bug reports submitted in-app.
3. Cookies and Local Storage
We do not use advertising cookies, and we do not run third-party analytics or advertising trackers. We use only what the Service needs to work:
- Authentication tokens stored in your browser by our authentication provider to keep you signed in.
- Local storage preferences held only in your own browser — which brand you last had open, your recently-viewed items, your theme, and which sticky note is expanded. These never reach our servers, which is also why they don't follow you to another device.
Because we set no advertising or cross-site tracking cookies, there is nothing to consent to for those purposes. Clearing your browser storage will sign you out and reset those preferences.
4. Artificial Intelligence
Atelier uses third-party AI providers to power its generation and analysis features. When you use one of those features, the data needed for that specific request is transmitted to the relevant provider over an encrypted connection:
- OpenAI processes every AI feature — image generation and editing, and text generation and analysis (tech packs, vendor extraction, cost estimates, design critique, and the AI assistant) — receiving the text of your request, a summary of the relevant brand data, and any design image you attach.
- Google (Gemini) is a standby provider for text features only. If OpenAI is unavailable, that same request is sent to Google instead so the feature keeps working; in normal operation Google receives nothing. It is never used for image generation.
- Tavily processes web searches for vendor discovery, receiving your search terms only — never your designs.
We do not train any AI model on your content, and we do not permit our providers to use content submitted through our accounts to train their models. We send only what the requested feature needs. We cannot, however, control a provider's own retention practices beyond our agreements with them — providers typically retain request data briefly for abuse monitoring.
Do not submit information to AI features that you are not comfortable transmitting to these providers, including anything you hold under a confidentiality obligation to someone else.
5. The Design Canvas
The in-app design canvas is an embedded third-party editor provided by Photopea, loaded in a frame within your browser. Design files you open, edit, or save on the canvas are processed by that embedded editor. Your saved results are stored by us; the editing session itself takes place in the third-party frame. Photopea's own privacy policy governs its handling of that data.
6. How We Use Information
- To create and operate your account and workspaces, and to deliver the features you use.
- To process payments, manage subscriptions and AI credits, and send billing confirmations.
- To send transactional and service messages — invitations, account notices, and changes to these policies.
- To provide support and respond to your requests.
- To secure the Service — detecting and preventing fraud, abuse, and unauthorized access, and enforcing rate limits and plan entitlements.
- To diagnose errors and improve reliability and performance, using aggregated or technical data.
- To comply with law and to establish, exercise, or defend legal claims.
Legal bases (EU/UK users). We process your data to perform our contract with you (operating the Service and billing), on the basis of legitimate interests (securing and improving the Service, defending claims), to comply with legal obligations (tax and accounting records), and on consent where we ask for it — which you may withdraw at any time.
7. How We Share Information
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done so. We share it only:
- With service providers (sub-processors) who process data on our behalf under contract, listed in Section 8.
- At your direction — with a platform you choose to connect, a recipient you choose to email, or teammates you invite to a workspace.
- For legal reasons — where we reasonably believe disclosure is required by law or legal process, or is necessary to protect the rights, property, or safety of Atelier, our users, or the public.
- In a business transfer — in connection with a merger, acquisition, financing, or sale of assets. We will notify you before your information becomes subject to a materially different privacy policy.
8. Sub-processors
These third parties process data on our behalf so the Service can run:
| Provider | Purpose | Location |
|---|
| Supabase | Database, authentication and file storage (your account, brand data, uploaded designs) | United States |
| Stripe | Payment processing and subscription billing. Card details go to Stripe directly and are never stored on our servers | United States |
| OpenAI | All AI features — image generation and editing (AI Design Studio, silhouettes, patterns, logos) and text generation (tech packs, vendor extraction, cost estimates, chat assistant). Receives the prompt, a summary of the relevant brand data, and any design image attached to that request | United States |
| Google (Gemini) | Standby provider for text generation only. Receives the same request as OpenAI would, but only when OpenAI is unavailable — so in normal operation it receives nothing. Never used for image generation | United States |
| Tavily | Web search used to find and research manufacturers. Receives your search terms, not your designs | United States |
| Photopea | The in-app design canvas is an embedded Photopea editor. Design files you open or save on the canvas are processed in that embedded editor in your browser | Czech Republic / EU |
| Resend | Outbound email — team invitations, vendor outreach and email campaigns you send | United States |
| Sentry | Error monitoring. Receives technical error reports which may include your IP address and the page you were on | United States |
| Railway | Backend application hosting | United States |
| Cloudflare | Frontend hosting and content delivery | Global edge network |
We may update this list as our infrastructure changes; the "Last updated" date above reflects the current version.
9. International Transfers
We operate from, and most of our providers are located in, the United States. If you are in the European Economic Area, the United Kingdom, or Switzerland, your information will be transferred to and processed in countries that may not provide the same level of data protection as your home country. Where required, we rely on appropriate safeguards for those transfers, such as the European Commission's Standard Contractual Clauses in our agreements with providers. You may request more detail at the contact address below.
10. Retention and Deletion
- We keep your account and content for as long as your account is active.
- Deleting an item in the Service removes it from your workspace; residual copies may persist in encrypted backups for up to 30 days before being overwritten.
- If you close your account or we terminate it, we retain your content for 30 days to allow export or recovery, then delete or anonymize it.
- We keep billing and transaction records for as long as required by tax and accounting law, typically seven years, even after account closure.
- We may retain limited information longer where necessary to resolve disputes, prevent abuse, or comply with a legal obligation.
Disconnecting a third-party platform deletes the stored access token for that platform. Data already imported from it remains until you delete it.
11. Teammates, Vendor Contacts, and Email Lists
When you invite a teammate, upload a contact list, or record a vendor's contact details, you are providing us with someone else's personal information. You represent that you are permitted to do so. Those people may contact us at the address below, and we will refer their request to you as the controller and assist you in responding.
If you use the email campaign feature, you — not us — are the sender of those messages, and you are responsible for consent, disclosure, and unsubscribe handling under applicable law.
12. Security
We use administrative, technical, and organizational measures to protect your information, including encryption in transit, row-level security in the database so one brand's data is not readable by another, authentication on every server endpoint that touches your data, scoped credit metering, and rate limiting.
No system is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential and your account access limited to people you trust. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by applicable law and without undue delay.
13. Your Rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you, and receive a copy in a portable format.
- Correct inaccurate information.
- Delete your information, subject to our legal retention obligations.
- Object to or restrict certain processing, and withdraw consent where processing is based on it.
- Not be discriminated against for exercising these rights.
California (CCPA/CPRA). The categories we collect and the purposes are described in Sections 2 and 6, and the categories disclosed to service providers in Sections 7 and 8. We do not sell personal information and do not share it for cross-context behavioural advertising, including of anyone under 16. You may exercise your rights, or use an authorized agent, via the contact below.
EU/UK. You may lodge a complaint with your local supervisory authority. We ask that you contact us first so we can try to resolve it.
To exercise any right, email [email protected] from your account address. We will verify your identity and respond within the period required by law. Much of this is also self-service: you can edit your profile and brand data in the app, export tech packs and reports to PDF or CSV, and delete records directly.
14. Do Not Track and Global Privacy Control
We do not track users across third-party websites, so we do not respond differently to Do Not Track or Global Privacy Control signals — there is no cross-site tracking to disable.
15. Children
The Service is a business tool intended for adults and is not directed to children. You must be at least 18 to hold an account. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.
16. Changes to This Policy
We may update this policy. When we do, we will revise the "Last updated" date above, and for material changes we will provide notice by email or in-app before they take effect. Your continued use after the effective date constitutes acceptance.
17. Contact Us
Questions, requests, or complaints about privacy:
Atelier
Email: [email protected]