Privacy Policy

We collect information you provide directly: email address, username, display name, and payment information (processed securely by Stripe and PayPal).

When you upload images for stencil generation, we temporarily process them on our servers. Generated stencils are stored in your account for your access.

• To provide and improve our stencil generation service
• To process payments and manage your credits
• To send transactional emails (order confirmations, magic links)
• To provide customer support

When you purchase credits, we collect the information required to issue an invoice: first and last name (or company name), full address, Italian tax code (codice fiscale, for private individuals resident in Italy) and VAT number (where applicable), along with your email address.

• Purpose: issuing invoices and complying with tax and accounting obligations.
• Legal basis: legal obligation under Article 6(1)(c) GDPR, in compliance with Italian invoicing regulations.
• Retention: 10 years from the date of the document, as required by Italian civil and tax law.
• Recipients: this data is shared with our electronic invoicing provider and with our payment processors (Stripe, PayPal), which process it for their respective purposes.

If, after downloading a stencil, you tick the "Tips for cutting this stencil" box, we send you up to three emails over the following days: how to cut it, which machine to use (they may contain links to partner products, including affiliate links) and some ideas. Without that box we do not send you emails of this kind.

• Purpose: sending you tips and promotional messages related to the stencils you downloaded.
• Legal basis: your consent, under Art. 6(1)(a) GDPR. We keep proof of consent (the text shown, date and time, language and an encrypted fingerprint of your IP address).
• Withdrawal: you can withdraw your consent at any time using the unsubscribe link in every email or by writing to us; withdrawal does not affect earlier emails.
• Retention: the data used for these emails is kept while your consent is active; after withdrawal we keep only your address on a suppression list, so that we never write to you again.

Your data is stored on servers in France, in the European Union. Connections to the site are encrypted (HTTPS/TLS) and access to the servers is restricted to the service's administrators. Uploaded images are processed and stored securely. We do not sell your images: we share them only with the artificial intelligence providers listed below, and only when you use the AI features.

Images uploaded without an account are kept on our server for 60 days from upload and are then deleted automatically, together with the processed files. Only a technical record without the image remains (file name and processing data). We keep them longer only if you made them public, used credits on them, or they are needed for an order, an invoice or a support request.

When you use the AI features, your image and any instructions you write are sent for processing to our providers: OpenAI and, for some features, fal and Replicate. These companies are based in the United States, so the data is transferred outside the European Union. OpenAI does not use data received through its API to train its models and normally keeps it for up to 30 days for abuse monitoring. fal processes the data only according to our instructions, under a data processing agreement that includes the European Commission's standard contractual clauses.

We use essential cookies for login, security and your preferences; these are always active. Everything else is loaded only after you give consent in the cookie banner, separately for analytics and marketing.

• Analytics — Google Analytics 4 (Google Ireland Ltd): aggregated traffic statistics. Cookies: _ga*.
• Analytics — Microsoft Clarity (Microsoft Ireland Operations Ltd): session recordings and heatmaps showing how pages are used (clicks, taps, scrolling, mouse movements and pages visited), so we can find and fix what doesn't work. Recordings show the text of our pages as it appears on screen, including the name of a file you upload. What you type into form fields and drop-down menus is always masked, and so are the images you upload or generate and the email and name shown in your account menu; the admin area, account settings, support tickets and the AR camera page are never recorded. We also tell Clarity which steps of the stencil maker you reach (for example file selected, method chosen, stencil created) and the method you pick; these signals never contain file names or identifiers. Data is stored on Microsoft Azure; recordings are kept for 30 days (a random sample, and recordings we mark as favourites, for up to 9 months). Cookies: _clck, _clsk; Microsoft may also set its own cookies (e.g. MUID, CLID).
• Marketing — Meta Pixel (Meta Platforms Ireland Ltd): measures the effectiveness of our ads. Cookies: _fbp, _fbc. Only if you have given marketing consent, when you register, make a purchase or reach a limit that requires an account or credits, we also send Meta, from our server, the event together with pseudonymised identifiers (for example your email address in hashed form) through the Meta Conversions API. Without consent this does not happen: so that our server also respects your choice, we store it in a technical cookie (sv_consent).

You can change or withdraw your consent at any time from the “Cookie preferences” link at the bottom of every page; when you withdraw it, we delete the related cookies.

Under GDPR, you have the right to access, rectify, delete, and export your personal data. You can delete your account and all associated data at any time from your settings page.

For privacy-related inquiries, contact us.