Privacy Policy

The data controller is the operator of the service, AGR, the trade name of the sole-trader business operated by Axel Guillouard, registered with the Registre National des Entreprises (RNE) under SIREN number 953 002 508 (SIRET main establishment: 953 002 508 00018), with its registered office at Being updated — available on request at contact@mannequinia.com.

For any question about your data or to exercise your rights, you may contact our data-protection point of contact: contact@mannequinia.com. A Data Protection Officer (DPO) is not mandatory for our activity and has not been appointed.

Account data

Email address, display name, password (hashed) or authentication-provider identifier, language and preferences.

Images and content you upload

The product, garment or reference photos you upload to generate visuals, together with the related instructions (prompts) and settings.

Generated visuals

The images produced by the service from your content and instructions, stored in your gallery.

Billing data

Purchase history, credits, invoices and customer identifier. Payment-card details are handled directly by our payment provider (Stripe) and do not pass through our servers.

Technical and usage data

Connection logs, IP address, browser type, and events strictly necessary for operation, security and abuse prevention.

We process your data for the following purposes, each relying on a legal basis under Article 6 of the GDPR:

• Providing the service (account creation, visual generation, gallery) — performance of the contract (Art. 6(1)(b)).
• Billing and credit management — performance of the contract and legal obligation (accounting, Art. 6(1)(b) and 6(1)(c)).
• Security, fraud and abuse prevention — legitimate interest (Art. 6(1)(f)).
• Improvement and support (incident diagnosis, assistance) — legitimate interest (Art. 6(1)(f)).
• Service-related communications (transactional emails) — performance of the contract. Any marketing communication would rely on your consent (Art. 6(1)(a)), which you can withdraw at any time.

To deliver the service we rely on processors that act on our instructions and with whom a Data Processing Agreement (DPA) is in place. The main ones are:

Fal.ai — Features and Labels, Inc. (AI inference platform, United States — SCC)

The AI inference gateway to which your product visuals and prompts are transmitted for image generation and prompt reformulation. This is the direct processor with whom a Data Processing Agreement (DPA) is in place; transfers outside the EU are governed by the European Commission's Standard Contractual Clauses (SCC).

Google LLC / Alphabet (underlying AI model provider, United States — SCC)

The AI models used by the service are provided by Google and served through Fal.ai (as a sub-processor): Nano Banana for image generation and Gemini 2.5 Flash for prompt reformulation. Your data is not sent directly to Google by our application; processing takes place through Fal.ai's infrastructure.

Stripe (payments)

Processes payments and billing. Stripe acts as a separate controller for payment data.

Brevo (email)

Delivers transactional emails and, where applicable, communications you have consented to.

Vercel (hosting and compute, United States — DPA in place)

Application hosting and runtime infrastructure (Edge Network, serverless functions). Data may transit through servers outside the EU, governed by the European Commission's Standard Contractual Clauses.

Cloudflare Turnstile (anti-bot protection)

CAPTCHA-challenge solution used at sign-up to prevent automated abuse. Cloudflare may receive the IP address and browser metadata for verification purposes.

PostHog EU (navigation analytics)

Audience measurement and behavioural analytics, hosted on PostHog's European instance (EU Cloud). Enabled only with your consent via the cookie banner; off by default.

Hosting provider

Hetzner Online GmbH (image storage, Germany) and Neon Inc. (database, United States). Cross-border transfers governed by the European Commission's Standard Contractual Clauses.

Some of these providers may process data outside the European Union. Where this is the case, such transfers are governed by appropriate safeguards (the European Commission's Standard Contractual Clauses or an equivalent mechanism), in accordance with Articles 44 et seq. of the GDPR.

• Account data: for the lifetime of the account, then deleted or anonymised within a reasonable period after closure.
• Uploaded images and generated visuals: for as long as your account is active; you can delete them at any time from your gallery.
• Billing data: kept for the period required by applicable accounting and tax obligations (in France, up to 10 years).
• Technical logs: kept for a limited period for security purposes, generally a few months.

Under the GDPR you have the following rights over your data:

• Right of access and information (Art. 15);
• Right to rectification (Art. 16);
• Right to erasure / the "right to be forgotten" (Art. 17);
• Right to restriction of processing (Art. 18);
• Right to data portability (Art. 20);
• Right to object, in particular to processing based on legitimate interest (Art. 21);
• Right to withdraw consent at any time, without retroactive effect (Art. 7(3)).

To exercise these rights, write to contact@mannequinia.com. We respond within one month. You also have the right to lodge a complaint with the French data-protection authority (CNIL, www.cnil.fr) or your local supervisory authority.

Our service uses essential cookies required for operation (authentication, security, language preference) — these do not require your prior consent — as well as a navigation analytics tool (PostHog, hosted in the EU). This analytics tracker is subject to your prior consent, collected via our cookie banner; it is off by default (opt-out). We do not use advertising cookies or profiling trackers for commercial targeting.

We implement appropriate technical and organisational measures to protect your data against loss, unauthorised access or disclosure (encryption in transit, access control, logging). As no system is infallible, we cannot guarantee absolute security, but we commit to notifying any data breach as required by the GDPR.

We may update this policy to reflect legal or technical developments. The last-updated date appears at the top of this page. In the event of a material change, we will inform you by appropriate means.