Privacy policy

• We store your email, your business details, your photos and the pieces you make.
• Your photos are sent to two artificial intelligence providers so they can be described and searched. It is explained below, with names and purpose.
• Your logo is not sent to any AI. It is processed in your browser and goes straight to storage.
• We do not sell your data. If you arrived by tapping one of our ads on Instagram or Facebook, we tell Meta when you sign up or start the trial, without your email or your name. If not, Meta learns nothing.
• You can ask for a copy or for everything to be deleted by writing to one email address. It gets done.

The data controller is Geronimo Bergter, based in San Juan, Argentina. For anything to do with personal data, including exercising your rights, write to b2studiomarketing@gmail.com.

For your account. Your email address, your name if you signed in with Google or Apple, and the language. We do not store passwords: authentication is handled by Supabase.

About your business. The name, the industry, who you sell to, your value proposition, the city, your links and any constraints you wrote down. It is what gives the model the context to write in your voice.

Your brand kit. Colours, typefaces, layout preferences and samples of your tone of voice. It is stored by versions, so an old piece can still be explained even if you changed the colours afterwards.

Your images. The photos in your library, your logo and any reference pieces you uploaded. Alongside each photo we store what was measured from it: dominant colours, a grid of how busy each area is, the focal point, a text description, tags, whether it already has text on it, and a numeric vector that lets it be searched by similarity.

What you make. The topic you asked for, the resulting copy, which template and which photo were used, and the token usage of each call. That last one is what lets us count your quota and know what a piece actually costs.

The bare minimum about billing. Your plan, the subscription status, the renewal date and the identifiers used by whichever processor applies to you. We never see your card: payment details are handled end to end by Dodo Payments or Mercado Pago and never pass through our servers.

• The PNGs you download. The final piece is assembled in your browser and downloaded from there. It never goes up to a server: we store the copy and which photo was used, not the finished image.
• Card details. None, at any point.
• Advertising profiles. There are no Meta pixels, no Google Analytics, no third-party trackers on the page. All Meta learns is what is explained under “Who we share with”, and only if you arrived through one of its ads.

With the providers the service needs to work, none of which is allowed to use your data for their own purposes. And with Meta, only if you arrived by tapping one of our ads: see the end of this section.

Supabase: authentication, database and file storage. It is where everything lives. Images sit in a private bucket: there is no public URL, and every access uses a short-lived signed link.

Anthropic (Claude): writes the copy and describes your photos. It receives: your business details and your brand kit, the topic you type, your photos scaled down to 768 px when they are tagged on upload, and your reference pieces if you use brand reading. Anthropic does not train its models on what is sent through its API.

Voyage AI: turns each photo into a vector so it can be searched by similarity. It receives the scaled-down photo and its description, once, on upload.

Dodo Payments: charges and invoices purchases made from outside Argentina. In those cases it is the seller of record, so it handles your payment data as a controller in its own right, under its own policy.

Mercado Pago: processes purchases made from Argentina. There we are the seller and it is the payment method, so it receives what it needs to charge and to prevent fraud, under its own policy.

Meta (Instagram and Facebook): only if you arrived by tapping one of our ads on its networks. In that case we tell it, from our server, three things: that you arrived, that you signed up and that you started the trial. Each notice carries the identifier Meta gave that click, your browser details and, when we know it, your IP address. It does not carry your email, your name or anything about your business. Meta uses it to tell us which ad worked and to show it to similar people, under its own policy. If you arrived any other way, we send it nothing.

These providers are outside Argentina, mainly in the United States and the European Union. By using the service you accept that international transfer, which relies on each provider’s standard contractual clauses.

• Performance of the contract: everything needed to provide the service to you: your account, your kit, your photos, making the pieces.
• Legal obligation: billing records, which have to be kept for as long as tax rules require.
• Legitimate interest: counting usage to apply the quotas and to detect abuse.
• Legitimate interest: knowing which of our ads brought you, when you arrived by tapping one, so we stop paying for the ones that do not work.
• Consent: if we ever send you something that is not operational. We do not do that today.

• While you have an account, everything you uploaded stays there, with or without an active plan.
• If you close the account, you have 30 days to download whatever you want. After that everything is deleted: photos, kits, pieces.
• Billing records are kept separately for as long as tax law requires, even after you close the account. They do not include your photos or your content.

• Everything travels encrypted over HTTPS, and at rest it is encrypted in Supabase.
• Isolation between accounts lives in the database, not in the application: every table has row-level rules tying each record to its owner. A programming mistake on one screen is not enough to expose someone else’s data.
• Images live in a private bucket. Each file’s path includes the business identifier, and that path is what the permission check verifies.

No system is infallible. If a breach affecting your data were to happen, we tell you by email within 72 hours of detecting it, with what we know and what we are doing about it.

By writing to a single email address you can:

• Ask for a copy of everything we hold about you.
• Correct anything that is wrong.
• Ask for complete deletion.
• Take your data away in a format another application can read.
• Object to a specific processing activity.

At b2studiomarketing@gmail.com, from your account’s email address. We reply within 10 business days.

You can also complain to the data protection authority where you live. In the European Union that is your national supervisory authority; in Argentina it is the Agencia de Acceso a la Información Pública, the authority for Law 25.326 on Personal Data Protection.

We use strictly necessary ones: the ones that keep your session open. Without them you would have to sign in on every page.

There is one more, and only if you arrived by tapping one of our ads on Instagram or Facebook: _fbc, which keeps the identifier of that click for 90 days so we can tell Meta which ad brought you. We set it, not Meta, and we set it for no one else. You can delete it from your browser whenever you like.

There are no third-party analytics or social network cookies, and no Meta or Google code runs on the page.

Whichever processor applies to you (Dodo Payments or Mercado Pago) may set its own during payment, needed to process it and to prevent fraud.

The service is not aimed at anyone under 18 and we do not knowingly collect their data. If we find an account belonging to a minor, we close it and delete the data. If you are a parent or guardian and you think this has happened, write to us.

If we change something substantial (a new provider, a new use of your data) we tell you by email 30 days in advance. Minor changes are published here with the date above updated.