Privacy policy

This policy explains which personal data Workbench processes, why, and what rights you have. The controller is [operator], [street], [city], reachable at hello@madeoftales.com.

What we process

• Account data: name, email address, company name, password (stored only as a hash by our authentication provider), team roles.
• Content: product photos, prompts, brand kit texts, creations, ad copy and share links you create.
• Billing data: plan, credit balance and usage, invoices. Card details are handled by Stripe and never reach us.
• Technical data: IP address, browser and time of requests in server logs, and the cookies needed to keep you signed in.

Why and on what legal basis

• To provide the service you signed up for (Art. 6(1)(b) GDPR).
• To keep invoices and tax records (Art. 6(1)(c) GDPR).
• To keep the service secure and prevent abuse, for example rate limits and logs (Art. 6(1)(f) GDPR).

We do not sell your data, do not use it for advertising profiles and do not use third-party tracking in the app.

Processors

• Supabase Inc. (database, file storage, authentication), data stored in Canada (region ca-central-1).
• Vercel Inc. (hosting and delivery of the app).
• Google LLC (Gemini and Veo models via the Gemini API): prompts and reference images are sent to Google to generate your creations.
• Stripe Payments Europe Ltd. (payments and invoices).
• Resend (Plus Five Five Inc.) for account emails such as confirmation, password reset and team invites.

Some of these providers process data outside the EU. Canada has an EU adequacy decision for commercial organisations. Transfers to the USA rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU standard contractual clauses in the providers' data processing agreements.

Cookies

Workbench uses only cookies that are needed to run it: your sign-in session, the workspace you are working in, and unlocked share links. There is no tracking cookie, so there is no consent banner.

How long we keep data

As long as your account exists. After you delete your account, we delete its data within 30 days, except invoices, which we must keep for up to 10 years.

Your rights

You have the right to access, correct, delete, restrict and port your data, and to object to processing based on legitimate interests. Write to hello@madeoftales.com. You can delete your account and all its data yourself in Account settings. You can also complain to a data protection authority, for example the one of the German state you live in.