Privacy Policy

Zavara Studio Inc. ("we", "us", "our") is committed to protecting your privacy. This policy explains what data we collect, why, and how we handle it.

1. Data We Collect

Account data

When you sign up, we collect your email address and, optionally, your name and business name. This information is stored securely via our authentication provider (Supabase Auth).

Project & client data

You may store project details, client names, email addresses, design files, revision images, and AI-generated content. This data is stored in our database and file storage systems.

Payment data

We do not store credit card numbers. Payment processing is handled entirely by Stripe. We store Stripe customer and subscription identifiers to manage your account.

Usage data

We collect anonymous usage data such as page views, feature usage counts, and browser type to improve the Service. We do not use third-party tracking or advertising scripts.

2. How We Use Your Data

• To provide and maintain the Service
• To process your subscription payments via Stripe
• To send transactional emails (magic links, project notifications) via Resend
• To generate images using OpenAI when you use creative studio features
• To enforce usage limits and quotas per your subscription plan
• To improve the Service based on aggregate, anonymised usage patterns

3. Third-Party Services

We share data with the following third-party processors, only as needed to provide the Service:

Each provider has their own privacy policy. We encourage you to review them.

4. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where retention is required by law (e.g. financial records).

Project files and images uploaded by you are deleted when you delete the related project or account.

5. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of your data
• Rectification — correct inaccurate personal data
• Erasure — request deletion of your data
• Portability — receive your data in a structured format
• Objection — object to certain processing of your data

To exercise any of these rights, contact us at privacy@zavarastudio.com.

6. Data Security

We use industry-standard security measures including encryption in transit (TLS), encryption at rest, and access controls. All file storage uses signed URLs with time-limited access. Authentication uses secure, HTTP-only cookies.

7. Cookies

We use essential cookies only — specifically for authentication sessions. We do not use advertising, analytics, or third-party tracking cookies. No cookie consent banner is required as we only use strictly necessary cookies.

8. Children's Privacy

The Service is not intended for use by individuals under 18 years of age. We do not knowingly collect data from children.

9. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or a notice within the Service. Continued use after changes constitutes acceptance.

10. Contact

For privacy-related questions or requests, contact us at privacy@zavarastudio.com.