Privacy Policy
This Privacy Policy explains how PIXELHUB STUDIO collects, uses, shares and protects your personal data when you use the Sublim.it service (the “Service”), in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).
1. Data controller
The data controller is PIXELHUB STUDIO, SASU, registered office at 60 rue François 1er, 75008 Paris, France (RCS Paris 938 015 286). For any question about this policy or to exercise your rights, contact us at contact@sublim.it. We have not appointed a Data Protection Officer; data requests are handled at the contact address above.
2. Data we collect
- Account data: your email address, your name, and your password (created and stored in hashed form by our authentication provider). If you use Google sign-in, the account identifier provided by Google.
- Your photos: the photographs you upload, the enhanced images produced, and lightweight previews, which are kept in your account history until you delete them or request deletion.
- Usage and billing data: your credits, plan, subscription status, purchase and invoice history. Payment card details are collected and processed directly by our payment provider (Stripe); we do not store your full card number.
- Technical data: IP address, browser and device information, and logs, used to operate and secure the Service.
- Cookies: strictly necessary authentication cookies (see our Cookie Policy).
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and manage your account; enhance your photos; provide your history | Performance of the contract |
| Process payments, manage subscriptions, issue invoices | Performance of the contract and legal obligation |
| Secure the Service, prevent fraud and abuse, improve and debug the Service | Our legitimate interests |
| Send you service-related messages | Performance of the contract |
| Send marketing emails (if any) | Your consent (which you may withdraw at any time) |
4. How your photos are processed by AI
To enhance your photos, they are transmitted to specialised third-party AI image-processing providers located outside the EU (in the United States), which process them and return an enhanced image. These providers process your photos solely to provide their service and, according to their applicable API terms, do not use them to train their models. We do not use your photos to train any model of our own. Your photos are not sold and are not shared for advertising purposes.
5. Who we share data with (sub-processors)
We share data only with service providers who process it on our behalf and under contract, to operate the Service:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and file storage | European Union |
| Vercel | Website and application hosting / content delivery | United States |
| Stripe | Payment processing and billing | European Union / United States |
| AI image-processing providers | AI photo enhancement and image processing | United States |
We may also disclose data where required by law or to protect our rights.
6. International data transfers
Some of our providers are located outside the European Union, in particular in the United States. Where personal data is transferred outside the EU/EEA, the transfer is framed by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and/or the providers’ certification under the EU-US Data Privacy Framework.
7. How long we keep your data
- Account data and photos: kept while your account is active. We delete your account and associated photos within 30 days of your deletion request or of account closure, except where we must keep certain data by law.
- Invoices and accounting records: kept for the legal retention period (10 years under French commercial law).
- Technical logs: kept for a limited period for security purposes.
8. Your rights
In accordance with the GDPR, you have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to withdraw your consent at any time where processing is based on consent. You may also give instructions regarding your data after your death.
To exercise these rights, contact us at contact@sublim.it. You can request deletion of your account and photos at any time, and we will action it within 30 days. We will respond to your request within one month. If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL — www.cnil.fr).
9. Security
We take appropriate technical and organisational measures to protect your data: data is encrypted in transit (HTTPS) and at rest on our providers’ infrastructure, your photos are stored in a private storage area accessible only to your account through short-lived signed links, and access is restricted on a need-to-know basis.
10. Children
The Service is not intended for persons under the age of 18, and we do not knowingly collect data from minors.
11. Changes to this policy
We may update this Privacy Policy from time to time. The “last updated” date above indicates the latest revision; we will inform you of any material change.
12. Contact
For any question about this Privacy Policy or your personal data, contact us at contact@sublim.it.