Privacy Policy

Last Updated: 06.08.2026

This Privacy Policy explains how we collect, use, share, and protect your information when you use the Fash.Studio website, platform, and related services (the “Services”).

The controller of your personal data is StyleUpMe OÜ, a company registered in Estonia with its registered address at Narva mnt 5, Kesklinna linnaosa, Tallinn, Harju maakond, 10117, Estonia. You can reach us about anything in this Policy at info@fash.studio.

Because we serve users worldwide, this Policy is written to cover the European Union and EEA, the United Kingdom, the United States, and other countries. Where a specific regional right applies to you, it is set out in Section 12.

1. Information We Collect

a. Information you give us

• Account information: email address, username, and, where you provide them, first and last name, company name, website address, phone number, and profile image.
• Sign-in information: the one-time codes we send to your email, or, if you sign in with Google, the basic profile information Google shares with us (name, email address, profile picture, and account identifier).
• Content you upload and create: product, garment, and model images and videos, text prompts, model and tool selections, and the results generated for you.
• Billing information: your plan, purchase history, credit balance and credit transaction history, billing country, and the customer and subscription identifiers held by our payment provider. We never see or store your full card number.
• Communications: support requests submitted through our contact form (name, surname, email, subject, message) and any emails you send us.

b. Information collected automatically

• Sign-in and security logs: your IP address, browser user-agent, the email address used, and the time of each sign-in or code request.
• Usage and device data: pages viewed, features and tools used, clicks, approximate location derived from IP address, device and browser type, and referring pages.
• Attribution data: the landing page and source you arrived from, campaign and funnel identifiers, the position of the button you clicked, and which plan you viewed or purchased.
• Session recording and analytics: our analytics tools record page interactions such as mouse movement, scrolling, and clicks, so that we can understand how the product is used. See Section 6.
• Cookies and similar technologies: see Section 6.

c. Information from third parties

We receive information from Google when you sign in with Google, from Stripe about the status of your payments and subscription, and aggregated measurement data from our analytics and advertising tools.

2. How We Use Your Information and Our Legal Bases

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• To provide the Services — creating and running your account, processing your uploads through AI models, storing and displaying your results, tracking and spending credits, and providing support. Legal basis: performance of our contract with you.
• To take payment — processing subscriptions, top-ups, renewals, and refunds. Legal basis: performance of our contract, and compliance with tax and accounting obligations.
• To keep the Services secure — authenticating sign-ins, detecting and preventing fraud, abuse, multi-accounting, and unauthorised access, and enforcing our User Agreement. Legal basis: our legitimate interest in protecting the platform and our users.
• To moderate content — automated screening of uploads, prompts, and results against content safety rules. Legal basis: our legitimate interest in operating a lawful, safe service, and compliance with legal obligations.
• To improve the Services — analysing usage, measuring feature performance, and diagnosing problems. Legal basis: our legitimate interest in improving our product, or your consent where required for analytics cookies.
• To market to you — sending product news, tips, and offers, and measuring advertising. Legal basis: your consent, or our legitimate interest in marketing similar services to existing customers, in each case subject to your right to opt out at any time.
• To comply with the law — responding to lawful requests, keeping records, and handling rights complaints. Legal basis: compliance with a legal obligation.

We do not use your uploads, prompts, or generated results to train our own AI models. How the third-party providers that run the models handle your content is described in Section 3.

3. AI Processing and the Providers We Use

Fash.Studio does not run AI models on its own infrastructure. When you run a tool, the files and prompts you submit are sent to Fal.ai, which routes them to the model provider behind the tool you selected. Those providers currently include Google, ByteDance, Kuaishou (Kling), MiniMax, Alibaba (Wan), xAI, Bria, and Topaz, and the list changes as models are added or retired.

These providers are located in several countries, including the United States and China. They process your content under their own terms and privacy policies. Depending on the provider, they may retain content for a period and may use it to operate, secure, and improve their own services, including model development. We cannot control or guarantee how each provider handles content once it is transmitted.

Please take this into account when deciding what to upload. Do not upload images of people who have not agreed to this processing, and do not upload confidential material you are not willing to have processed by third-party AI providers.

Images of people. Many of our tools work with photographs of people. We use these images only to generate the results you request. We do not use facial recognition, we do not create biometric templates, and we do not attempt to identify anyone from an uploaded image. Our automated safety screening may flag an image as appearing to contain a real person, in which case the request is refused.

4. How We Share Your Information

We do not sell your personal information for money. We share it with the following categories of recipients, who act as our service providers or processors:

• AI processing: Fal.ai and the model providers listed in Section 3.
• Hosting and storage: Amazon Web Services (S3 and CloudFront, primary storage region in Frankfurt, Germany) and Hetzner Online (database and application hosting in Germany).
• Payments: Stripe.
• Email: MailerLite (marketing and lifecycle email) and SendGrid and Google (transactional email such as sign-in codes).
• Analytics and product measurement: Google (Google Analytics and Google Tag Manager) and Microsoft (Clarity).
• Advertising and measurement: Meta (Facebook and Instagram advertising tools).
• Security: Google reCAPTCHA Enterprise, used on our support form to block automated abuse. Its use is subject to Google’s Privacy Policy and Terms of Service.
• Sign-in: Google, if you choose to sign in with Google.

We may also disclose information where required by law or valid legal process, to protect our rights, safety, or property or those of our users, to report unlawful content to the competent authorities, and to a buyer or successor in connection with a merger, acquisition, financing, or sale of assets.

Access by our team. A small number of authorised staff can access account records and, where necessary, uploaded and generated content, to provide support, investigate abuse or security incidents, and operate the platform. Access is limited to those who need it.

5. International Data Transfers

We are based in Estonia and our primary storage and hosting are in Germany. Some of the providers listed in Section 4, in particular the AI model providers, operate in countries outside the EEA and the UK, including the United States and China, where data protection laws may offer a lower level of protection than your own.

Where we transfer personal data outside the EEA or the UK, we rely on an adequacy decision where one exists, or on the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant) together with additional safeguards where appropriate. You can request more information about these safeguards at info@fash.studio.

6. Cookies, Analytics, and Tracking

We and our providers use cookies, local storage, tags, and similar technologies for the following purposes:

• Strictly necessary: keeping you signed in, protecting sign-in and forms against abuse, granting access to your own files on our CDN, and remembering your language and session state. The Services cannot function without these.
• Analytics and product measurement: Google Analytics, deployed through Google Tag Manager, and Microsoft Clarity, which records how pages are used, including mouse movement, scrolling, clicks, and page navigation. Clarity masks text input fields by default. We use these to understand and improve the product.
• Advertising and attribution: Meta tools that measure the performance of our campaigns and help us reach relevant audiences.

You can control cookies through your browser settings, including blocking or deleting them, though blocking strictly necessary cookies will stop the Services from working. You can also opt out of Google Analytics using Google’s browser add-on, opt out of Microsoft Clarity through Microsoft’s privacy settings, and manage advertising preferences in your Meta account settings and through your device’s advertising controls. Where required by law, we will ask for your consent before setting non-essential cookies and you may withdraw that consent at any time.

7. Marketing Communications

We send transactional emails you cannot opt out of while you hold an account, such as sign-in codes, payment receipts, subscription notices, and important service or policy changes.

We also send marketing emails about features, tips, and offers. Every marketing email contains an unsubscribe link, and unsubscribing takes effect for all marketing email. You can also ask us to stop at info@fash.studio. Unsubscribing does not affect transactional email.

8. How Long We Keep Your Information

• Account information — for as long as your account exists, and for a short period afterwards to handle disputes and reinstatement requests.
• Uploads and generated results — for as long as your account exists, so they remain available in your library. Removing an item from your library hides it from your view; a copy may remain on our systems and in backups for a period afterwards before it is deleted.
• Credit and transaction records — for as long as needed to operate your account and, for records that form part of our accounting, for the period required by Estonian tax and accounting law (currently seven years).
• Sign-in and security logs — for as long as needed to detect and investigate fraud, abuse, and unauthorised access.
• Support correspondence — for as long as needed to handle your request and to keep a record of it.
• Analytics and advertising data — according to the retention settings of each tool, typically between 2 and 26 months.

When we no longer need personal data, we delete it or anonymise it. Content already transmitted to AI providers is retained or deleted according to their own policies, as described in Section 3.

9. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, encrypted storage, access controls limiting staff access to what is needed, signed short-lived links that restrict each user’s files to that user, passwordless sign-in with one-time codes, and abuse and rate-limit protections on authentication.

No service can be completely secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority and, where required, you, within the time limits set by applicable law.

10. Children

The Services are for adults. You must be at least 18 to create an account, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, contact info@fash.studio and we will delete it. Uploading images of minors is prohibited under our User Agreement.

11. Automated Screening

Uploads, prompts, and results are screened automatically against content safety rules by us and by our AI providers, and a request may be refused as a result. This screening does not produce legal effects concerning you or similarly significantly affect you, and a human reviews the matter if you contest an outcome. Repeated or serious breaches of our content rules may lead to suspension, which is decided by a person, not automatically.

12. Your Privacy Rights

If you are in the EU, EEA, the UK, or Switzerland, you have the right to: access your personal data and receive a copy; correct inaccurate data; delete your data; restrict or object to processing, including profiling for direct marketing; receive your data in a portable format; and withdraw consent at any time without affecting processing carried out before withdrawal.

If you are in the United States, depending on your state, you may have the right to: know what personal information we collect and how we use and disclose it; access and obtain a copy of it; correct it; delete it; opt out of “sale” or “sharing” of personal information and of targeted advertising; and be free from discrimination for exercising these rights. We do not sell personal information for money. Our use of advertising and analytics tools described in Section 6 may qualify as “sharing” for cross-context behavioural advertising under some state laws; to opt out, use the controls in Section 6 or contact us. We do not knowingly process the sensitive personal information of California residents for the purpose of inferring characteristics.

If you are elsewhere, including Canada, Brazil, Australia, and other countries with data protection legislation, you may have comparable rights under your local law. We will honour valid requests under the law that applies to you.

How to exercise your rights. Email info@fash.studio from the email address on your account, or tell us which account your request concerns. We may need to verify your identity before acting. We will respond within one month, and will tell you if we need longer because your request is complex. Exercising these rights is free unless a request is manifestly unfounded or excessive. You may use an authorised agent where your local law allows it.

Account deletion. To close your account and have your data deleted, email info@fash.studio from your account email address. Deleting your account ends your subscription and forfeits any remaining credits, and it cannot be undone. Some records are retained where the law requires it, as described in Section 8.

Complaints. If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to a supervisory authority, in particular the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), the authority in your country of residence or work, or, in the UK, the Information Commissioner’s Office.

13. Changes to This Privacy Policy

We may update this Policy. When we do, we will post the updated version with a new “Last Updated” date. If the changes materially affect how we use your personal data, we will notify you by email or through the Services before they take effect.

14. Contact Us

If you have questions or concerns about this Privacy Policy or how we handle your data, contact us at:

StyleUpMe OÜ (Fash.Studio)
Narva mnt 5, Kesklinna linnaosa, Tallinn, Harju maakond, 10117, Estonia
Email: info@fash.studio
Website: www.fash.studio