Privacy Policy

Zansen Studio Oy
Business ID: 3630838-1
Sompasaarenlaituri 10, 00540 Helsinki, Finland
Email: info@zansenstudio.com
Website: zansenstudio.com

The data controller decides on the purposes and means of processing personal data. All privacy-related contacts, requests and exercising of rights take place through the contact details above.

We process the following data, which the user provides or which accumulates through use of the service:

Account data

• Email address
• Password hash (never the plain-text password)
• Username, full name (optional)
• Avatar image (optional)
• Account creation time and last sign-in

Company data (optional, for B2B customers)

• Company name
• Business ID or equivalent company identifier
• Postal address, postcode, city, country
• Phone number

Service usage data

• Original photographs uploaded by the user
• AI-finished images (the output of the service)
• Gallery names and creation times
• Image processing event logs
• Monthly usage and quotas
• Watermark settings (logo, position, opacity)

Subscription and payment data

• Subscription status (trial / active / cancelled)
• Subscription period end date
• Stripe customer ID and subscription ID
• We do not process payment card details ourselves — Stripe processes them as a separate data controller

Technical data

• IP address (logs, abuse prevention)
• Browser type and operating system
• Session cookie (maintaining sign-in)

We process personal data for the following purposes and on the following GDPR legal bases:

Most data is received directly from the user during registration and use of the service. In addition:

• Payment-related confirmations are received from Stripe (for example payment success, subscription status).
• Technical log data accumulates automatically through server usage.

We do not sell or rent personal data to third parties. We use carefully selected service providers who process data on our behalf under a data processing agreement (DPA):

In addition, data may be disclosed to authorities where required by law.

Some of our processors are located in the United States. In those cases transfers are based on the Standard Contractual Clauses (SCC, 2021/914) approved by the European Commission, as well as the processors’ technical and organisational safeguards (including encryption at rest and in transit, access control and breach notification obligations).

We actively aim to keep user-uploaded photographs within the EU (Supabase Frankfurt). OpenAI calls, however, take place in the contractual partner’s infrastructure, where an individual image is processed temporarily — we do not store images permanently on OpenAI’s servers.

Main principle: the user’s images and galleries are retained for as long as the user has access to the service. When the user account is deleted or access ends, the user’s material is removed from our systems.

The user may delete an individual gallery or their entire account at any time from the settings of the service. After account deletion, data is removed within 30 days with the exception of subscription and payment history, whose retention is based on the Finnish Accounting Act.

Under the EU General Data Protection Regulation you have the following rights:

Exercising your rights: send a request to info@zansenstudio.com. We respond to your request within 30 days at the latest. We may ask for additional information to verify your identity.

Office of the Data Protection Ombudsman (Finland): tietosuoja.fi/en

Cookies in the browser

We use only cookies that are strictly necessary for the service to function:

• Session cookie — maintaining sign-in. Persists for the duration of the session.
• Supabase auth cookie — authentication token. Persists for at most 7 days from the last sign-in.
• CSRF protection — secure handling of forms.

We do not use analytics or marketing cookies without your separate consent. If this changes, we will update the privacy policy and request new consents.

Email tracking

Our email service (Resend) uses the following statistical metrics:

• Open tracking — a small transparent image in the message body notifies us when the message is opened. Apple Mail Privacy Protection and similar features may show opens that did not actually happen.
• Click tracking— links in messages pass through Resend’s redirect, which counts the number of clicks.

The data is used to develop the service’s communication (for example which subjects and content are read the most). Tracking data about individual persons is not disclosed to third parties for advertising.

Legal basis: legitimate interest (GDPR 6.1.f) for transactional emails; consent (6.1.a) for marketing messages — consent is given when the user registers for the service or joins the waiting list.

We implement appropriate technical and organisational safeguards to protect personal data:

• Traffic between the browser and the server is encrypted (TLS 1.2+).
• Row-level access control in the database (Row Level Security) — a user only sees their own data.
• Passwords are stored as cryptographic hashes, never in plain text.
• Payment card details are not stored on our own servers.
• Administrative access is restricted to personnel who need it to perform their duties.
• In the event of a data breach we notify the supervisory authority within 72 hours and the affected data subjects if the breach poses a high risk.

We use OpenAI’s AI-based image processing model to process images, which is an action expressly requested by the user. We do not make automated decisions based on personal data that would have significant legal or similar effects on the user (GDPR 22).

We update this policy as needed in connection with changes in legislation, changes to the service offering or the introduction of new processors. We notify users of material changes by email at least 30 days before the change takes effect. The date of the latest update is shown at the top of this page.