Privacy Policy

This describes what Unelma collects, why, who helps us process it, and the choices you have. It applies to everything you do on unelma.dev. Unelma is currently a private platform: accounts are opened by invitation. Unelma is the controller of the personal data described here. Reach us at privacy@unelma.dev.

What we collect

• Requests for access — when you ask for private access: whether you asked as a brand or as a manufacturer, your name, work email address, company, role, country, team size, website, what you make and anything else you tell us. Your network address and browser user-agent are recorded with it, not because we need them to answer you but to stop the form being abused — the form allows ten requests an hour from one connection. Afterwards we add our own notes about the request, who reviewed it and when.
• Account — your name, email address and sign-in details. Accounts are opened by us from an approved request or an invitation; you sign in with an email address and either a password or a code we email you.
• Content — the prompts, sketches, reference pictures, designs and messages you create or upload, including photographs of people if you choose to upload them.
• Orders and payments — what you bought and when. Card details go to Stripe and never reach our servers.
• Usage — pages viewed, the country, region and city your network address maps to, the site that referred you, your device type and language. Our own visitor count sets no cookie, stores nothing in your browser and does not keep your network address.
• Messages — what you write to support, to manufacturers and to the Unelma Agent.

Why we use it, and the legal basis

• To answer a request for access: steps taken at your request before entering into a contract. The network address and user-agent stored with it are there to keep the form from being abused, which is our legitimate interest rather than a step taken at your request.
• To provide the studio, your team workspace and manufacturing requests: performance of our contract with you.
• To keep the platform secure, prevent abuse and enforce fair use: our legitimate interests.
• To understand how the site is used, without cookies: our legitimate interests.
• To keep accounting records and answer lawful requests: legal obligation.

Artificial intelligence

Your prompts, sketches and reference pictures are sent to AI model providers so they can produce the render, the brief or the spec sheet you asked for. We do not use your content to train our own models without asking you first.

Who processes data for us

We share personal data only with the providers that run the service, under data processing agreements: Cloudflare (hosting, database, file storage and AI models), Supabase (sign-in, in the EU), Stripe (payments), Resend (email) and Google (AI models and sign-in). When you send a manufacturing request, the manufacturers it is routed to receive your spec sheet, your name and your messages. We do not sell your personal information, and we do not share it for advertising. We run no advertising trackers.

Transfers outside the EU

Some providers process data in the United States. Those transfers rely on the EU-US Data Privacy Framework or on Standard Contractual Clauses.

Retention

We keep your account and content while your account is open. When you delete your account, your personal data is erased or made anonymous within 30 days, except records the law requires us to keep, such as invoices, which are kept for the statutory period. Visitor statistics are deleted after 90 days.

A request for private access is kept for 12 months if we do not invite you, and for as long as the account exists if we do — it is the record of why the account was opened. Ask us and we will delete it sooner.

Your rights

You can access, correct, export, restrict or delete your data, and object to processing based on our legitimate interests. That includes the notes we write about a request for access. If you have an account you can delete it yourself in Settings, and you can do that even if your access has ended. If you asked for access and never got an account, write to us and we will delete the request. For anything else write to privacy@unelma.dev; we answer within one month. California residents have the right to know, delete, correct and to opt out of sale or sharing; we do not sell personal information, and we honour Global Privacy Control. We do not discriminate against anyone for using these rights.

Children

Unelma is not for children. You must be at least 16 to open an account, and we do not knowingly collect personal data from anyone younger. If you believe a child has given us personal data, write to privacy@unelma.dev and we will delete it.

Changes

When this policy changes in a way that matters, we say so on the site or by email before the change takes effect.