Privacy Policy

Effective 13 October 2026

This Policy explains how Shoodio processes personal data, including data used for asset and shoot compliance checks. It should be read with our Terms of Service and Ethical AI standards.

1. Controller and contact

The controller is Puristo GmbH, Waldbach 51, 4816 Gschwandt bei Gmunden, Austria, commercial register FN 346897v, Landesgericht Wels.

• Privacy enquiries and data-subject requests: info@shoodio.ai
• Safety and model-identity reports: safety@shoodio.ai
• Austrian supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria

2. Scope and roles

This Policy applies to the Shoodio website, account, Studio, Help Center, billing and compliance portal. For ordinary account and platform operations, Puristo GmbH is the controller. If an organisation uses Shoodio to process personal data on its own instructions, the contractual data-processing terms determine whether Shoodio acts as processor for that activity.

Shoodio catalogue model identities are synthetic and AI-generated; no real person is depicted. Should a real partner ever be represented, it happens only under contractual rights. An image that represents a real partner can be personal data even if the production process is generative. We therefore protect identity material regardless of the technical production method.

3. Data we process

Account and organisation data

• email address, display name, language, profile settings and any profile image you upload;
• password verifier, authentication identifiers, sessions and MFA status;
• organisation, freelancer or business-verification details;
• workspace membership, roles and audit events.

Production data

• uploaded product, apparel, accessory and location images;
• prompts, product metadata, canvas configuration and selected model, pose or action;
• generated images and videos, thumbnails, file hashes and provenance;
• support communications and feedback.

Compliance and safety data

• asset category, visible-text/OCR facts and policy reason codes;
• platform, production and product eligibility;
• location viability, perspective, lighting and scene-safety facts;
• shoot manifests, compliance decisions, policy versions and confidence status;
• strikes, Security Holds, appeals, user statements, admin revisions and report evidence.

We classify submitted content and requested use. We do not infer or store a user’s political opinion, religious belief or other special-category trait merely because an uploaded item contains a slogan or symbol.

Billing and technical data

• plan, credit balance, transaction references, invoices and tax information received from the merchant of record;
• IP address, device/browser information, timestamps, security events, error logs, request IDs and service performance;
• the country derived from your IP address by our hosting provider, passed on as a two-letter country code only, to determine the currency in which prices are shown and charged; the IP address itself is not stored for this purpose;
• cookie consent, language preference and pricing region.

We do not receive or store full payment-card details.

4. Purposes and legal bases

Where we rely on legitimate interests, we balance platform, brand and model protection against the user’s rights. You may object as described below. Consent can be withdrawn at any time without affecting earlier lawful processing.

Referral and partner programmes. A personal referral link or unique partner campaign code attributes an account and its eligible payments to the referrer or partner, including registrations without a subscription (legitimate interests, Art. 6(1)(f) GDPR). Personal referrers see your first name and surname initial unless you hide them in account settings; partners receive masked registration identifiers, dates, campaign source and payment/commission status, never your raw email address. A partner code is not a subscription discount. A first valid link uses a 30-day browser attribution cookie shared between the website and app. Filtered campaign clicks use a random token whose digest is stored, not an IP address or user-agent in the campaign ledger; these are not guaranteed unique people. Separately, an attributed prospect can voluntarily allow a fixed Shoodio reminder requested by their partner (consent, Art. 6(1)(a) GDPR). This choice is off by default, independent of credits and withdrawable through account settings or info@shoodio.ai; consent, its version and withdrawal are recorded. The current consent and recipient address are checked again before dispatch. The partner receives no email address and cannot supply arbitrary message content. Limits are one reminder per prospect every 14 days and 25 per partner in 24 hours. Required partner bank/tax details, frozen settlement calculations and actual transfer references are processed for contract and accounting obligations, with restricted admin access; accounting evidence is generally retained for seven full years from calendar-year end, longer for relevant proceedings or documented historical retention. Unnecessary identifiers are minimised separately.

Region and currency. When you open the website or the app, our hosting provider derives the country from your IP address and passes on only the two-letter country code. We use it to show and charge prices in euro for customers in those EU countries that we bill in euro, and in US dollars elsewhere (legitimate interests in correct regional pricing and billing, Art. 6(1)(f) GDPR). The country code is kept in your browser for the duration of the session and, when you start a purchase, is sent to our checkout service in signed form; it is not stored on our servers, and the IP address is not retained for this purpose. Where a billing address is stored in your Stripe customer account, the country of that address determines the currency instead. If a currency binding already exists for your customer account at our payment provider, that binding determines the billing currency of a subscription; for credit packs and custom credits without a running subscription, the country code — or the country of your Stripe billing address — continues to determine the currency.

4a. Trial accounts, eligibility and personalised messages

We use trial start/end, entitlements and payment status to deliver and administer the agreed trial and its retention deadline. Factual expiry and closure notices rely on GDPR Article 6(1)(b), or Article 6(1)(f) for business contacts who are not themselves the contracting party: our legitimate interest in administering the customer relationship and providing necessary information.

A separate keyed digest of the confirmed email address records when a trial was actually granted and when another may start. It is pseudonymous personal data, not an anonymous identifier. Our legitimate interest under Article 6(1)(f) is fair limitation of free trials and prevention of repeated use within 90 days. The record contains no images or production account and is retained only until 90 days after the last granted trial began, including after earlier account erasure. Login, re-registration or a refused request does not extend it. Confirmed address changes can carry the remaining window. Matching prevents only another free trial during that window, not registration or membership. It is separate from lawful abuse/security records. Objections and corrections can be raised free at info@shoodio.ai.

Promotional messages about our own similar services use the existing-customer exception under section 174(4) Austrian TKG 2021 only where its conditions have been verified for the collection route: an address obtained in connection with the customer service, a clear free opt-out at collection and in every message, and no applicable objection, including the ECG list. Registration or acceptance of terms alone is not blanket consent. Otherwise suitable recorded consent under Article 6(1)(a) is required. You may object or withdraw at any time through the unsubscribe link, account settings or info@shoodio.ai, without affecting the trial or statutory rights. Necessary factual account notices are separate. An enabled default switch cannot replace a valid basis.

Where permitted, we select ideas using the existing categories of your approved products and the relationship to your own shootings, matching published scenes and available Quick Shoot or photo-series functions. We do not infer sensitive traits, build cross-service profiles or score willingness to pay. For this limited personalised selection we rely, where lawful after balancing interests, on Article 6(1)(f), otherwise appropriate consent. An advertising objection also stops this selection. This does not authorise arbitrary new image analysis, transfer to AI providers, public advertising or general model training.

Promotional emails may show reduced previews of your own approved results and clearly identified catalog examples. Original files and account credentials are not sent. Time-limited image links permit display, including by email-provider proxies; those providers can transmit IP addresses and technical request data and cache copies. We do not use image requests for individual opening tracking in this trial sequence. Forwarding may expose previews to other recipients; copies already stored outside our systems cannot be recalled.

For accounts covered by the agreed trial rule, verified account closure and erasure start 60 days after trial end, in consecutive 24-hour days. Account data, personal workspace content, uploads, results, variants, previews including mail derivatives, and temporary production/export files are covered. Login and new uploads do not extend it. For a new account registered during the 90-day waiting period without a new trial, the separately disclosed deadline is 60 days after creation; an expressly started eligible trial replaces it with 60 days after its end. A valid membership permanently ends the trial-erasure sequence; later cancellation does not restart it. Existing customer/team rights, unresolved payments, justified support/rights requests and other holds are checked before irreversible steps, with revised deadlines communicated where needed. The account displays its current deadline; no image-quality or purchase-probability score determines closure. Free human review remains available.

Required accounting, legal-claim and security records are retained separately, with restricted access for their own purposes and applicable periods; this does not justify keeping all creative files. Delivery and consent evidence is retained only as required for delivery, proof and concrete complaints; a minimal objection record may prevent renewed unwanted advertising. Such records are separate from the 90-day eligibility register. Erasure includes active storage, necessary CDN cleanup and processors; failed steps are retried. Isolated encrypted backups expire through rotation, are not used for account or marketing activity and have prior erasures reapplied after restoration. Copies in your mailbox are outside our control. Statutory access, portability and applicable release rights require no paid membership or credits. A timely relevant request pauses affected erasure where needed; statutory exceptions and individual review of objections remain available. A statutory data copy is not automatically a commercial licence. Existing accounts do not receive retroactive expired deadlines; changes need advance information and a valid basis.

5. How automated compliance review works

The system evaluates an uploaded asset and, at Shoot, the exact intended context. It may use the image, visible text, asset and model metadata, selected pose/action, location and final prompt. Deterministic policy rules and visual-language analysis produce approval, product-only, adult-only or rejection. The decision is bound to the exact file and context.

The expected consequences are a blocked upload or shoot, a usage restriction, a T2 strike, or—in narrowly defined zero-tolerance cases—an immediate Security Hold pending authorised review. An uncertain automated result by itself does not create a serious strike or permanent ban.

Eligible asset restrictions can receive an Enhanced Review using the unchanged asset and the user’s statement. Security Holds, account terminations and similarly significant access decisions have a free human correction route. You can express your view, contest the result and obtain an authorised review. We provide meaningful reasons while withholding detection details that would undermine security.

We do not automatically inspect every resulting image or video after an approved generation. The customer reviews final outputs before publication.

6. Recipients and processors

We disclose data only as necessary to:

• cloud database, authentication and hosting providers;
• encrypted media storage and content-delivery providers;
• image/video generation, asset-processing and compliance-analysis providers;
• payment and merchant-of-record services;
• transactional email, customer support and security-monitoring services;
• professional advisers, authorities or courts where legally required;
• a successor in a merger, financing or sale subject to appropriate confidentiality.

Generation and analysis providers receive only the assets, prompts and parameters needed for the requested operation. Cost records contain identifiers and amounts, not prompt, OCR or image content. We do not sell personal data.

We do not use customer uploads, prompts or outputs to train general-purpose AI models, and we configure contracted processors not to use service data for their own model training where the service permits such controls.

7. International transfers

We prefer European processing where commercially and technically available. Some processors may operate in the United Kingdom, United States or other countries. Transfers outside the EEA rely on an adequacy decision, approved Standard Contractual Clauses and, where appropriate, supplementary technical and organisational safeguards. Contact us for relevant transfer information or a copy of applicable safeguards, subject to redaction of confidential security terms.

8. Retention

We keep data only as long as necessary for the stated purpose:

Hash-based records may be retained without the underlying image where needed to prevent repeated evasion. Deletion from active systems may be followed by limited encrypted backup retention until routine overwrite.

9. Cookies and local storage

Essential technologies keep you signed in, protect sessions, store language and consent choices and the pricing region, prevent fraud and remember the Landing theme. Optional analytics or marketing technologies are used only under the consent settings shown to you. Payment checkout may set essential anti-fraud cookies. You can change non-essential choices through Cookie Settings; browser blocking of essential cookies may prevent sign-in or payment.

10. Security and access controls

We use encryption in transit, encryption at rest where supported, row-level data controls, least-privilege service roles, short-lived signed media access, MFA for sensitive capabilities, append-only compliance history, audit logs, rate limits and incident procedures. Sensitive rejected assets are separated from the normal library. No security method guarantees absolute protection.

Admin access to compliance evidence is restricted by role and, for sensitive actions, MFA. Admin decisions and revisions are logged. Dangerous previews are not loaded into general-purpose lists.

11. Your rights

Subject to the GDPR and applicable exceptions, you can request:

• access to and a copy of your personal data;
• correction of inaccurate data;
• deletion or restriction of processing;
• portability of data you provided where applicable;
• objection to processing based on legitimate interests;
• withdrawal of consent;
• information about and human intervention in a qualifying automated decision.

Use account export/deletion tools or email info@shoodio.ai. We may verify identity and authority before responding. We normally respond within one month. You may complain to the Austrian Data Protection Authority or the authority where you live or work.

These privacy rights are separate from the paid Enhanced Review of an asset. Exercising a GDPR right or contesting a significant account restriction through the human channel does not cost a credit.

12. Children

The service is not offered to account holders under 16 and we do not knowingly collect their account data. If you believe a child has submitted personal data, contact us for prompt investigation.

13. Legal notices and safety reports

When you report misuse, we process your contact details, the reported URL or files, statement and evidence to investigate and communicate the outcome. We may disclose necessary details to the affected rights holder, service provider or authority, but avoid revealing the reporter where law and fair process permit. Do not include unrelated personal data.

14. Changes

The version and effective date are shown above. We will give reasonable notice of material changes where possible. Material changes to contractual compliance processing may require renewed acceptance before Studio use; legal information, export, deletion and logout remain available.

Questions or requests: info@shoodio.ai · Safety reports: safety@shoodio.ai