Privacy Policy

The data controller is Obidowski Company Sp. z o.o., registered at Pasieczna 8/12/139, 91-362 Łódź, Poland (VAT: PL9471986146). Correspondence address: Szafranowa 17, 05-500 Zamienie, Poland. For privacy questions or to exercise your rights, contact us at [email protected].

Information from your store, when you connect it:

• Store details: store name, domain, platform, and the access token or API keys that let VizStage read and update your products. Keys are stored encrypted.
• Product data: the titles, types, descriptions and product photos of the products you choose to stage.

VizStage only asks for access to products. It does not request or store your customers' names, addresses, orders or payment details.

Information you provide:

• Account data: for WooCommerce and web accounts, your email address, which you use to sign in with a one-time code. For Shopify stores, the store owner email and store details that Shopify shares when you install the app.
• Creative settings and briefs: the style, mood and palette you choose, and any scene briefs you write or edit.
• Payment information: Shopify bills packs bought in the Shopify app; Stripe processes payments on the web. We never see or store full card numbers. We keep records of what you bought and your render balance.
• Communications: messages and attachments you send to us.

Information collected automatically:

• Technical data such as IP address, browser and device type, pages viewed and timestamps, used to operate and secure the Services.
• Usage data such as batches run, images approved and renders used, used to provide and improve the Services.

• Providing the Services (performance of a contract): connecting your store, writing scene briefs, generating images, publishing the images you approve, keeping your render balance, and support.
• Security and abuse prevention (legitimate interest): rate limiting, fraud detection and protecting the Services.
• Improving the Services (legitimate interest; consent for analytics): understanding aggregate usage so we can fix problems and prioritize features.
• Product news (consent): emails you opt in to, each with an unsubscribe link.
• Legal compliance (legal obligation): tax, accounting and lawful requests from authorities.

To make an image, we send the product's photos and details to our AI providers (currently fal.ai and Google). Google analyzes the product and helps write its scene brief; fal.ai generates the image. The resulting images are stored so you can review them and publish them to your store.

We do not use your product photos, product data or generated images to train or fine-tune our own or any third party's AI models. We use our AI providers under terms that do not permit them to use your content for model training.

We do not use your products or images in our own marketing unless you explicitly agree.

We do not sell personal data. We share it only with providers who help us run the Services, under data processing agreements:

• Supabase: database, sign-in and file storage.
• Vercel: hosting for our website and app, and routing of requests to our AI providers.
• fal.ai: AI image generation.
• Google: AI analysis of product photos and details for scene briefs.
• Stripe: payments on the web.
• Ahrefs: website analytics, used only with your consent.

Shopify and WooCommerce hosts are not our sub-processors: they are the platforms your store runs on, and their own privacy policies apply to your store. Shopify bills packs bought in the Shopify app. We may also disclose data where the law requires it or to protect our legal rights.

We operate from the European Union, and some providers process data in the United States. Where data leaves the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

• Generated images and copies of product photos: deleted from our storage 90 days after the batch they belong to closes. Images you published stay in your store, which keeps its own copy.
• Account, store and product data: kept while your account or store connection is active.
• Shopify stores: when you uninstall the app, we stop all work and delete the store's access token. When Shopify asks us to erase the store's data, about 48 hours after uninstall, we delete its records and stored files.
• WooCommerce and web accounts: deleted within 30 days of account closure and purged from backups within 90 days. Disconnecting a store removes its keys at once.
• Payment and invoicing records: kept as long as tax and accounting law requires (up to 5 years).
• Analytics data: kept in aggregated or pseudonymized form for up to 24 months.

We use strictly necessary cookies to keep you signed in and to secure the Services. Analytics run only after you consent, and you can withdraw consent at any time in your browser settings. The VizStage app inside Shopify uses no third-party cookies.

We protect data with encryption in transit (TLS) and at rest, encrypted storage of store credentials, access controls on all systems and least-privilege internal access. Payments are handled by Shopify or Stripe, both PCI-DSS certified. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.

If you are in the EEA or the UK, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing based on legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, without affecting earlier processing.

To exercise these rights, email [email protected]. We respond within one month. You can also complain to your local supervisory authority; ours is the President of the Personal Data Protection Office (UODO) in Poland.

Shopify store owners can also send requests through Shopify, which forwards them to us. Because VizStage holds no data about your customers, a customer data request through Shopify returns no customer records from VizStage.

If you live in California, you have the right to know what personal information we collect, to ask us to delete or correct it, and to opt out of its sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising. We will not discriminate against you for using these rights. We respond to verified requests within 45 days, extendable by a further 45 days.

The Services are for businesses and are not directed at children under 16. We do not knowingly collect their personal data; if you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as the Services change. We will announce material changes by email to account holders and on this page at least 14 days before they take effect. The date at the top always shows the current version. See also our Terms of Service.

Obidowski Company Sp. z o.o.
Pasieczna 8/12/139, 91-362 Łódź, Poland
Correspondence: Szafranowa 17, 05-500 Zamienie, Poland
VAT: PL9471986146
Email: [email protected]