This Privacy Policy explains how remastr.studio ("the Studio", "We", "Us") collects, uses, stores, and protects personal data in connection with our services and website. We are committed to handling your data with care and in full compliance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and other applicable privacy legislation. This policy was last updated on 3 September 2026.
1.1. Data Controller: The data controller responsible for your personal data is remastr.studio, operating as a creative technology studio providing generative product photography services.
1.2. Contact: For all privacy-related enquiries, please contact us at: hello@remastr.studio. We aim to respond to all requests within 30 days.
2.1. Business Contact Data: When you request a quote, sign up for a project, or communicate with us, we collect information such as your name, job title, company name, email address, and phone number. This is the primary data we process.
2.2. Project and Content Data: To deliver our services, you upload product images and related creative briefs to our secure platform. These files are processed as described in Section 4 and are treated as confidential business data.
2.3. Payment Data: We do not store payment card details directly. Payments are processed by certified third-party payment providers. We retain only transaction references and invoice records for accounting and legal compliance purposes.
2.4. Communication Records: We retain records of email correspondence, project feedback, and approval exchanges for the duration of our business relationship and for the period necessary to resolve any disputes.
2.5. Website Usage Data: When you visit remastr.studio, we may collect technical data such as your IP address, browser type, pages visited, and time spent on the site. See Section 9 for details on cookies.
3.1. Service Delivery: To manage your project, communicate with you about progress, deliver final assets, and process invoices.
3.2. Business Communication: To send quotes, project updates, and responses to your enquiries. We do not send unsolicited marketing communications without your explicit consent.
3.3. Legal and Contractual Obligations: To comply with applicable law, including tax, accounting, and AI transparency obligations under the EU AI Act.
3.4. Service Improvement: To analyse how our services are used in aggregate, in order to improve our workflows and client experience. This analysis does not involve profiling individuals.
3.5. Portfolio and Promotion: Where permitted under our Terms and Conditions, to showcase completed Imagery in our portfolio. We will always seek written confirmation before featuring any image publicly.
4.1. How AI Is Used: Your product images are processed through our proprietary AI-driven workflows to produce the Remastered Product Imagery described in our Terms and Conditions. This processing is the core of our service and takes place on secure, access-controlled infrastructure.
4.2. No Training on Your Data: Your source images and project materials are not used to train, fine-tune, or otherwise improve any AI model — whether operated by us or any third-party model provider — without your prior, explicit written consent. This is a firm commitment.
4.3. AI Watermarking: Every image we produce is embedded with an invisible, machine-readable watermark identifying it as AI-generated content, in compliance with Article 50(4) of the EU AI Act. This processing is a legal obligation and forms part of the service. The watermark does not contain personal data.
4.4. Third-Party AI Infrastructure: Certain processing steps may involve third-party cloud AI infrastructure (e.g. GPU compute providers). Where this occurs, we ensure contractual data processing agreements are in place. Your images are processed only for the purpose of fulfilling your project and are not retained by these providers beyond the processing window.
5.1. Contract Performance (Article 6(1)(b) GDPR): The majority of data processing is necessary to fulfil the contract between you and the Studio — including managing your project, processing payments, and delivering final assets.
5.2. Legal Obligation (Article 6(1)(c) GDPR): Certain processing is required by law, including retention of financial records, compliance with the EU AI Act, and responses to lawful requests from regulatory authorities.
5.3. Legitimate Interests (Article 6(1)(f) GDPR): We process website usage data and maintain communication records based on our legitimate interest in operating a reliable, secure business. We have balanced these interests against your rights and determined they are proportionate.
5.4. Consent (Article 6(1)(a) GDPR): Where we process data for purposes beyond the above — such as marketing communications or portfolio use — we will ask for your explicit consent, which you may withdraw at any time.
6.1. No Sale of Data: We do not sell, rent, or trade your personal data to any third party.
6.2. Service Providers: We work with carefully selected processors who act on our instructions, including: cloud storage providers, payment processors, project management tools, and AI compute infrastructure. All processors are bound by data processing agreements consistent with GDPR requirements.
6.3. Legal Disclosure: We may disclose data to competent authorities where required by applicable law or a valid legal order.
6.4. Business Transfers: In the event of a merger, acquisition, or sale of the Studio, personal data may be transferred to the successor entity, subject to equivalent privacy protections.
7.1. Client Project Data: Source images and project files are retained on our secure platform for a period of 12 months following project completion, after which they are securely deleted unless you request earlier deletion or extended retention.
7.2. Business and Financial Records: Invoice data, payment records, and contractual correspondence are retained for 10 years in accordance with Czech accounting legislation.
7.3. Communication Records: General project communications are retained for 3 years after the end of the business relationship, sufficient to address any potential disputes.
7.4. Website Analytics: Anonymised or pseudonymised website usage data is retained for up to 26 months and then automatically deleted or further anonymised.
8.1. Processing Location: We aim to process data within the European Economic Area (EEA). Where we engage third-party processors located outside the EEA — for example, AI compute infrastructure — we ensure transfers are protected by appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission.
8.2. Adequacy Decisions: Where an adequacy decision exists for the recipient country under Article 45 GDPR, we rely on that decision. Otherwise, we apply SCCs or other approved transfer mechanisms.
9.1. Essential Cookies: Our website uses cookies that are strictly necessary for its operation — such as session and security cookies. These cannot be disabled without affecting site functionality.
9.2. Analytics Cookies: With your consent, we use privacy-respecting analytics tools to understand how visitors use our website. These tools do not fingerprint individual users and do not share data with advertising networks.
9.3. No Advertising Trackers: We do not use third-party advertising cookies or cross-site tracking technologies on our website.
9.4. Managing Cookies: You can control cookie preferences via your browser settings or through any cookie consent mechanism displayed on our site. Withdrawing consent for analytics cookies will not affect your ability to use the site.
10.1. Right of Access: You have the right to request a copy of the personal data we hold about you and information about how it is processed.
10.2. Right to Rectification: You may ask us to correct inaccurate or incomplete personal data without undue delay.
10.3. Right to Erasure: In certain circumstances, you may request deletion of your personal data ("the right to be forgotten"). This right is subject to our legal obligations to retain certain records.
10.4. Right to Restriction: You may request that we restrict processing of your data — for example, while a dispute is being investigated.
10.5. Right to Data Portability: Where processing is based on consent or contract performance and is carried out by automated means, you may request your data in a structured, machine-readable format.
10.6. Right to Object: You may object at any time to processing based on our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
10.7. Rights Related to Automated Decision-Making: We do not subject individuals to solely automated decisions with legal or similarly significant effects. Our AI workflows are always reviewed by human professionals before delivery.
10.8. How to Exercise Your Rights: Send your request to hello@remastr.studio. We will respond within 30 days. We may ask you to verify your identity before processing the request. Exercising your rights is free of charge.
10.9. Right to Lodge a Complaint: If you believe we have not handled your data correctly, you have the right to lodge a complaint with the relevant supervisory authority. In the Czech Republic, this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, UOOU) at uoou.cz.
11.1. Technical Measures: We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, or destruction. These include encryption of data in transit and at rest, access controls, and regular security assessments.
11.2. Breach Notification: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and notify you directly where required by applicable law.
12.1. We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will update the "last updated" date at the top of this page and, where appropriate, notify active clients by email.
12.2. We encourage you to review this page periodically. Continued use of our services following the posting of changes constitutes acceptance of the updated policy.