Privacy policy
Last updated: October 27, 2026
This notice describes how we process your personal data when you use the CBOS studio (studio.clothingbrandowners.com), the website clothingbrandowners.com and the shop shop.clothingbrandowners.com.
1. Data controller
The data controller is ClothingBrandOwners (“CBOS”, “we”). For any request regarding your data, write to clothingbrandownersapp@gmail.com.
2. What data we process
a) Account data. Sign-in happens exclusively through Google or Apple (OAuth): we receive your email, display name and an identifier from them. We do not collect or store passwords. We record the account creation date, last sign-in and the provider used.
b) Projects and creative content. Your 2D/3D designs, the images you upload and your moodboards are saved on your device (IndexedDB in your browser or app). With an active Essential or PRO subscription, saved projects, your moodboard (layout, texts and drawing) and the results you generate (AI images, Render HD images and videos, AI 3D models) are also synchronized automatically to your private cloud storage, so they are available on your other devices, within the storage included in your plan (2 GB for Essential, 5 GB for PRO), unless you turn cloud uploads off in Account. Images you upload are synchronized only inside the projects that use them. Cloud files are kept on Cloudflare R2 storage in North America, and the project index and storage usage in our database. On our servers we also keep project metadata (name, type, thumbnail), the 3D files and textures needed to generate renders and completed renders.
c) AI feature data. When you use an AI feature (image generation/editing, 3D model generation, HD renders), the images and prompts you provide are transmitted to the providers that perform the processing (fal.ai, Google Gemini, RunPod). We keep the outcome of the operation and the related token accounting; the intermediate image output of Gemini processing is kept on our systems for a maximum of 48 hours.
d) Purchase and billing data. Purchases may happen on Shopify or through Apple App Store in-app purchase, depending on the purchase route available to you. From Shopify we receive: customer identifier, email, subscription status, paid period and amounts. From Apple/StoreKit we receive signed transaction data such as product id, subscription status, paid period, storefront and transaction identifiers. Payment data (cards) is handled exclusively by Shopify or Apple and never passes through our systems.
e) Usage, security and service-reliability data. Logs of AI operations (service, outcome, token cost), service usage events, logs of administrative actions and technical data for request rate limiting (including IP address). When our branded sign-in address is blocked, a connectivity report may also include an incident reference, provider and technical cause, public IP address, approximate country/region/city and time zone, browser/device data, and the account email/user ID when verified by a valid session or voluntarily supplied. It never includes a password or creative content.
f) Marketing and attribution data. To measure the effectiveness of our campaigns we collect: landing page, referrer, UTM parameters, advertising click identifiers (e.g. fbclid), IP address, user agent, estimated country/region/city, browser language, time zone, device type, visitor and session identifiers, and a hash (SHA-256) of your email.
g) WhatsApp contacts. If you contact us on WhatsApp through the buttons on the site (for example for production requests), the conversation takes place on the WhatsApp platform (Meta) under its own privacy notice. We may record your phone number and an identifying label in our system to manage the business relationship.
h) Service emails. We send only billing emails: confirmation of the first purchase and renewals, plus a reminder before renewal. They are sent through the provider Resend and contain your email address and strictly necessary billing data (plan, amount, and renewal date).
i) Technical diagnostics. Support diagnostics require explicit activation. New app versions do not record your work session or design canvas.
3. Why we process your data and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and managing the account, providing the studio, the token wallet, AI features and purchases | a, b, c, d, e | Performance of the contract (Art. 6(1)(b) GDPR) |
| Security, service reliability, troubleshooting, abuse prevention and internal audit | a, e | Legitimate interest (Art. 6(1)(f)) |
| Billing emails (purchase/renewal confirmations and pre-renewal reminder) | a, d, h | Performance of the contract |
| Measuring advertising campaigns and sending conversion events to Meta | f | Consent (Art. 6(1)(a)) |
| Support diagnostics activated on request | i | Consent (Art. 6(1)(a)) |
| Tax and accounting obligations | d | Legal obligation (Art. 6(1)(c)) |
Providing account data is necessary to use the studio; processing based on consent is optional and can be withdrawn at any time.
4. Cookies and similar technologies
Essential (always active):
| Name | Type | Duration | Purpose |
|---|---|---|---|
| sb-*-auth-token | localStorage | session (max 72 hours) | Keeping you signed in |
| i18nextLng | cookie/localStorage | persistent | Interface language |
| IndexedDB databases (GraphicsStudio*, pixi_model_cache) | IndexedDB | until you delete them | Local storage of projects, assets and caches |
| Functional keys pixi_* / cbos* / atelier-* | localStorage | persistent | Editor preferences, work recovery, onboarding |
Statistics and attribution:
| Name | Duration | Purpose |
|---|---|---|
| visitor_id, session_id, session_count, session_started_at, attribution | persistent/session | Recognizing visits and attributing conversions to campaigns |
Marketing:
| Name | Duration | Purpose |
|---|---|---|
| _fbp, _fbc | 90 days (domain .clothingbrandowners.com) | Measuring and optimizing Meta campaigns |
You can manage non-essential cookies through the consent banner and, at any time, from your browser settings.
5. Who we share data with
We rely on the following providers, which process data on our behalf or as independent controllers:
| Provider | Role | Data involved |
|---|---|---|
| Supabase | Authentication and database | Account data, billing, wallet, project metadata |
| Vercel | Website and API hosting | All traffic (incl. IP) |
| OAuth sign-in; AI image processing (Gemini) | Account identity; images and prompts of AI operations | |
| Apple | OAuth sign-in; App Store in-app purchases | Account identity; App Store transaction and subscription data |
| fal.ai | AI image generation/editing, 3D generation | Images and prompts of AI operations |
| RunPod | High-definition 3D rendering | 3D files, textures and render settings |
| Cloudflare (R2/Workers) | Asset, render and cloud project storage | 3D files, textures, completed renders, synchronized projects, moodboard and generated results |
| Shopify | Payments, subscriptions, top-ups | Customer and order data |
| Meta (Facebook/Instagram, WhatsApp) | Advertising and conversion measurement; WhatsApp messaging | Conversion events with email/phone/name/address in hashed form (SHA-256), plus IP and user agent; WhatsApp conversations |
| Resend | Sending service emails | Email and message content |
We do not sell your personal data. We may disclose it to authorities when required by law.
6. Transfers outside the European Union
Some providers (Meta, Google, Apple, fal.ai, RunPod, Cloudflare, Vercel, Resend, Shopify) may process data in the United States or other third countries. In these cases the transfers are based on adequacy decisions (including the EU-US Data Privacy Framework, where the provider adheres to it) or on the Standard Contractual Clauses of the European Commission.
7. How long we keep your data
| Data | Retention |
|---|---|
| Account data, wallet, projects on our servers | While the account is active; deleted when the account is closed |
| Intermediate outputs of AI processing (Gemini) | 48 hours |
| Checkout link tokens | 7 days |
| Email/event dispatch queues | 14 days |
| Technical rate-limiting data | 24 hours |
| Sign-in connectivity incident logs | Up to 30 days |
| Completed renders | Until you delete them or the account is closed |
| Marketing and attribution data | Maximum 24 months from collection |
| Tax and accounting documents (with Shopify/App Store and our accounting) | Statutory terms (up to 10 years) |
| Projects stored locally (IndexedDB) | They remain on your device until you delete them; we do not control them |
| Cloud copies of projects, moodboard and generated results | While your subscription is active. Items you delete are removed from all your devices and kept for 5 days for support recovery only. After a subscription ends they remain readable and exportable for 90 days and may then be deleted; copies on your devices are not removed |
8. Your rights
You have the right to request: access to your data, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interest and withdrawal of any consent given. To exercise them, write to clothingbrandownersapp@gmail.com: we reply within 30 days. Deleting the account results in the erasure of the data listed in section 7, subject to statutory retention obligations.
If you believe the processing violates the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it) or with the authority of your country of residence.
9. Security
We adopt appropriate technical and organizational measures: encryption in transit (TLS), row-level access control on the database, mandatory two-factor authentication for administrative access, short-lived signed tokens for access to project files, hashing of the identifying data sent for advertising measurement, masking of sensitive fields in session recordings.
10. Minors
The service is available from age 13. Users aged 13 to 17 may use CBOS and make purchases only with the permission of a parent or legal guardian. AI features provided through third parties are reserved for adults (18+). We do not knowingly collect personal data from children under 13; if you believe a child under 13 has provided us with personal data, contact us and we will delete it. Where applicable law requires parental consent for processing a minor’s personal data, that consent is required.
11. Changes to this notice
We may update this notice; in case of substantial changes we will inform you through the site or by email. The current version is always available on this page, with the date of last update at the top.
12. Contact
ClothingBrandOwners — Email: clothingbrandownersapp@gmail.com