Privacy policy

Last updated 22 October 2026. The Grain Studio, [ADDRESS], is the controller for the data described here, except where it acts as a processor for a studio (section 4). Contact: help@thegrainstudio.app.

1. What we collect about you, the studio

• Your account: email address, name, sign-in events.
• Your studio: its name and settings, what you enter into the service.
• Billing: handled by Stripe; we keep your Stripe customer id and your subscription’s status, never card numbers.
• Technical data: server logs with IP address and browser, kept for 30 days for security.

2. Why, and on what basis

To provide the service you asked for (contract), to keep it secure and to answer you (legitimate interest), to send you the emails the service needs, and to meet legal obligations such as invoicing. We do not sell data and we do not advertise to you.

3. Who helps us

Supabase (database and authentication), Vercel (hosting), Stripe (payments and billing), Resend (email delivery). Each is bound by a data processing agreement; some are outside the EU, with the standard contractual clauses in place.

4. Your clients’ data

When a couple writes to a studio through its form or signs a proposal, their data belongs to that studio, which is the controller; we process it on the studio’s instructions as its processor. A couple who wants to see, correct or delete their data should write to the studio, and we will help the studio do it. On a couple’s proposal page we record the signature details (names typed, time, IP address, browser) as evidence of the agreement, on the studio’s behalf.

5. How long

For as long as the studio exists. When a studio is deleted, its data is deleted within 30 days, except what the law requires us to keep (invoices). Waiting-list emails are kept until the launch and for six months after, then deleted unless you sign up.

6. Your rights

Access, correction, deletion, portability, objection, and a complaint to your supervisory authority. Write to help@thegrainstudio.app.

7. Cookies

The service uses only the cookies it needs to keep you signed in. There is no tracking and no advertising cookie.