Emeric Durand, trading as Shotinger, a sole trader registered in France under SIREN 829 227 578, business address 320 rue Fra Angelico, 34000 Montpellier, France, is the data controller for the personal data described in this policy. We operate shotinger.com and app.shotinger.com (the “Service”).
Questions, or to exercise your rights: contact@shotinger.com.
This policy explains what personal data we process when you visit our website, create an account, or use the Service, why we process it, on what legal basis, who we share it with, and how long we keep it.
| Category | Examples |
|---|---|
| Account data | name, email address, password hash, language, account settings |
| Billing data | plan, subscription status, invoices, billing country, VAT number. Card details go directly to our payment provider — we never see or store them. |
| Content you upload | source photographs, product images, reference material, prompts |
| Generated content | the images and videos the Service produces for you |
| Support data | messages, attachments, and the correspondence history |
| Category | Examples |
|---|---|
| Technical data | IP address, browser type and version, operating system, device type |
| Usage data | pages viewed, features used, generations started, credits consumed, timestamps |
| Security logs | authentication events, error traces, abuse-detection signals |
We infer an approximate country from your IP address for tax, security, and language purposes. We do not use precise geolocation.
We do not knowingly collect special categories of data under Article 9 GDPR. Do not upload identity documents, health information, or biometric material.
| Purpose | Data used | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Create and manage your account | account data | Contract — Art. 6(1)(b) |
| Run generations and deliver outputs | uploaded and generated content, usage data | Contract — Art. 6(1)(b) |
| Process payments, subscriptions, invoicing | billing data | Contract — Art. 6(1)(b) |
| Keep statutory accounting records | invoices, billing data | Legal obligation — Art. 6(1)(c) |
| Provide customer support | support data, account data | Contract — Art. 6(1)(b) |
| Keep the Service secure, prevent fraud and abuse | technical data, security logs | Legitimate interests — Art. 6(1)(f) |
| Moderate content and enforce our Terms | uploaded and generated content, account data | Legitimate interests — Art. 6(1)(f), and Legal obligation where the DSA applies |
| Maintain and improve the Service using aggregated, de-identified metrics | usage data | Legitimate interests — Art. 6(1)(f) |
| Send service and transactional emails | account data | Contract — Art. 6(1)(b) |
| Send product news, where you have opted in | account data | Consent — Art. 6(1)(a) |
Where we rely on legitimate interests, we have balanced them against your rights and concluded that our processing does not override them. You may object at any time — see section 10.
Where we rely on consent, you may withdraw it at any time, as easily as you gave it. Withdrawal does not affect processing carried out beforehand.
We do not sell your personal data. We share it only with the processors below, each bound by a written data-processing agreement under Article 28 GDPR.
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| Stripe, Inc. | payment processing, subscription billing, fraud prevention | name, email, billing data, and card data collected directly by Stripe | European Union and United States |
| AI image and video generation, authentication, and storage of uploaded and generated content | uploaded content, prompts, generated outputs, account identifier | European Union and United States | |
| Vercel Inc. | hosting of the website and application | technical data, security logs | European Union (Paris region) and United States |
We may also disclose data to professional advisers, to law-enforcement or regulatory authorities where legally required, and to an acquirer in the context of a transfer of the business — in which case we will inform you.
We require our AI processors not to retain your content for their own model training. We do not use your content to train general-purpose models — see section 6.
We do not run analytics or advertising trackers on our website or in the application. There is no Google Analytics, no Meta Pixel, no advertising SDK, and no third-party behavioural tracking.
We do not build advertising profiles, we do not carry out cross-context behavioural advertising, and we do not sell or share personal information as those terms are defined by the California Consumer Privacy Act.
The only cookies we set are those strictly necessary to operate the Service — see our Cookie Policy.
Your content is not training data. We do not use your uploaded images, generated outputs, or prompts to train, fine-tune, or evaluate general-purpose or foundation AI models, and we do not license them to third parties for that purpose.
| Data | Retention |
|---|---|
| Account data | for the life of the account, then deleted within 30 days of closure |
| Uploaded and generated content | for the life of the account, then deleted within 30 days of closure; you can delete individual items at any time |
| Invoices and accounting records | 10 years from the end of the financial year (article L123-22 of the French Code de commerce) |
| Support correspondence | 3 years after the last contact |
| Security and server logs | 12 months |
| Abuse and moderation records | 12 months, or longer where needed to defend a legal claim or comply with a legal obligation |
| Marketing consent records | 3 years after the last contact, or until you withdraw consent |
After these periods, data is deleted or irreversibly anonymised. Backups are rotated and expire within 30 days.
We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access control on a need-to-know basis, credential hashing, logging of administrative access, and regular review of our processors.
No system is perfectly secure. If a personal-data breach is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and inform you where the law requires it.
Some of our processors handle data outside the European Economic Area, in particular in the United States.
Where that happens, we rely on the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), combined with a transfer impact assessment and supplementary technical measures — encryption in transit and at rest, and data minimisation — and, where a processor is certified, on the EU-US Data Privacy Framework.
You may request a copy of the safeguards in place by writing to contact@shotinger.com.
Under the GDPR you have the right to:
To exercise a right, write to contact@shotinger.com from the address registered on your account. We respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month.
If you consider that we have not complied, you may lodge a complaint with your local supervisory authority, or with the French authority:
CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr
The Service generates images automatically, but we do not take decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing.
Automated filters may flag or block content that appears to breach our Terms. Where such a measure affects your account, you may contest it and obtain human review by writing to contact@shotinger.com.
If you are a California resident, you have the right to know what personal information we collect and why, to request deletion or correction, to obtain a portable copy, and not to be discriminated against for exercising these rights.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We therefore offer no “Do Not Sell or Share” mechanism, because there is nothing to opt out of. We do not use or disclose sensitive personal information beyond the purposes permitted by section 7027(m) of the CCPA regulations.
To make a request, write to contact@shotinger.com. We will verify your identity through the email address registered on your account.
The Service is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, write to contact@shotinger.com and we will delete it.
We may update this policy. We will post the new version with a revised effective date and, where the change is material, notify you by email or in the app before it takes effect.
Emeric Durand, trading as Shotinger
320 rue Fra Angelico, 34000 Montpellier, France
contact@shotinger.com