CarStudio privacy policy

The controller of your account data is João Carlos Bacalhau, NIF (Portuguese tax number) 251842991, Rua do Príncipe, 18, 2100-174 Coruche. Data protection questions can be sent to apoio@carstudio.pt.

For the photos you process, CarStudio acts on your behalf, as a processor. What happens to them, where they go and how long they are kept is in the Terms of use.

• Account: name, email address, password (stored only as an irreversible cryptographic hash), phone number if you give one, and district and municipality.
• Signing in with Google: your Google account identifier, name, email and the profile photo Google shares.
• Photos and branding: the photos you upload, the images and videos produced from them, the texts you write on posters, and the text and logos you save to use on them.
• Purchases: the credits bought, the amounts, the dates and the billing details you provide.
• Help requests: what you write in the help form or by email, and the technical browser data the form attaches for diagnosis.
• Reports and checks: in a report, your name, email and what you write, kept in the support inbox to handle it and reply to you; an image you send us to be checked is used only for that check.
• Technical data: IP address, browser and device type, and access and error logs.

The sign-up details are needed to create the account, except the phone number, which is optional.

• Performance of the contract: creating and managing your account, processing the photos you ask for and delivering the results, selling and recording credits, and sending service emails, such as the account confirmation, purchases and the notice before photos are deleted.
• Legal obligation: keeping billing and accounting records for 10 years and answering lawful requests from the authorities.
• Legitimate interests: preventing abuse and fraud, including the anti-bot check at sign-up and in the help form, protecting the infrastructure, diagnosing errors and measuring, in aggregate, how the site is used. You can object to this processing at any time.
• Consent: if you choose it at sign-up or on the Account page, we email you news and offers from CarStudio and our other services, always from the same controller. You can stop them at any time on that page; withdrawing consent does not affect processing carried out before.

We do not sell personal data or hand it to third parties for their own use. We rely on providers that process data on our behalf, only to provide the service:

• Hosting of the servers and the database.
• Delivery and protection network, file storage, anti-bot check and aggregate visit statistics, with no cookies.
• Email delivery.
• Technical error monitoring, processed in the European Union.
• Artificial-intelligence providers: photos in Scene mode, the Poster and 360 spin are sent whole to produce the image or video requested, without your name, email or phone number.
• Payment and invoicing providers, when you buy credits.
• Authorities, when the law requires it, or to establish or defend legal claims.

Some of these providers process data outside the European Economic Area, notably in the United States: file storage, email delivery, signing in with Google and the artificial-intelligence models. These transfers rely on the European Commission's Standard Contractual Clauses and on supplementary measures: encryption in transit, sending only the data needed and access limited to what is essential. You can ask for a copy of the safeguards at apoio@carstudio.pt.

• Photos, images, videos and poster texts: deleted after 90 days, with an email notice a week before. You can delete them earlier from your History. A shared spin stays until you take it down, and the photo of a custom scene until you delete the scene.
• Account: while it is active. When you confirm its deletion, your personal data and photos are deleted straight away. Only an irreversible code derived from the email address is kept, for 2 years, so the free welcome photos are not given again to a new account. Backup copies, kept only to restore the service, delete themselves within 30 days.
• Purchases and billing: 10 years, as tax law requires. If you delete your account, the link to your profile is cut, but the elements the law requires are kept.
• Help requests and reports: for as long as needed to handle them and to answer a complaint about them.
• Technical logs: only as long as needed for security and diagnosis.

You can ask for access to your data, its rectification, erasure, portability and the restriction of processing, and object to processing based on legitimate interests.

On the Account page you can correct your name and email, ask for a copy of your data and delete your account. For anything else, or if you can no longer sign in, write to apoio@carstudio.pt from the account's email address. We reply within 30 days.

You can also lodge a complaint with the Portuguese data protection authority (CNPD), Av. D. Carlos I, 134 - 1.º, 1200-651 Lisboa, geral@cnpd.pt, www.cnpd.pt.

All traffic is encrypted (TLS). Passwords are never stored, only an irreversible cryptographic hash. Internal access is limited and administrative actions are logged. We make regular backups.

CarStudio only uses cookies and browser storage that are strictly necessary for the site to work or that remember choices you made. None of them needs consent. They are:

• Session and sign-in security, to keep you signed in.
• Language, so the next pages open in the same language.
• Bot protection, by Cloudflare, which delivers and protects the site.
• Choices kept in your browser: the editor's last options and your logo, the photos you are taking with your phone, until you close the tab, and that you have seen the cookie notice.

We may update this policy. The date at the top shows the version in force, and we announce significant changes by email or in CarStudio itself.

For privacy questions or to exercise your rights, write to apoio@carstudio.pt.