Privacy Policy

1. Who We Are

Diablo Atelier SRL ("we", "us", "our") operates SlabStudio at slabstudio.diabloatelier.com. We are the data controller for personal data collected through the Service.

Contact: hello@diabloatelier.com

2. Data We Collect

Data you provide

• Account data: Name, email address, password (hashed — we never store plain-text passwords)
• Payment data: Billing is handled by Stripe. We receive only a customer reference ID — never card numbers
• Designs and templates: Vessel configurations and saved shapes you create in the tool

Data collected automatically

• Usage data: Number of templates generated per month (for plan enforcement)
• Session data: IP address, browser user-agent (for security and fraud prevention)
• Log data: Server-side logs retained for up to 30 days

Data we do NOT collect

• We do not use third-party analytics (no Google Analytics, Mixpanel, etc.)
• We do not track you across other websites
• We do not read the contents of your generated template files

3. How We Use Your Data

• To provide and maintain the Service
• To process payments and manage your subscription
• To send transactional emails (account confirmations, password resets)
• To enforce plan limits and prevent abuse
• To comply with legal obligations

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), UK, and similar jurisdictions:

• Contract: Processing necessary to provide the Service you subscribed to
• Legitimate interests: Security, fraud prevention, service improvement
• Legal obligation: Tax and accounting records
• Consent: Marketing emails (you can unsubscribe at any time)

5. Data Sharing

We share your data only with:

• Stripe: Payment processing (Stripe Privacy Policy)
• Supabase: Database hosting in AWS Singapore (Supabase Privacy Policy)
• Railway: Server infrastructure (Railway Privacy Policy)
• SendGrid: Transactional email (SendGrid Privacy Policy)

We never sell your personal data. We never share it for advertising purposes.

6. International Transfers

Your data is stored on servers located in Singapore (AWS ap-southeast-1). By using the Service, you consent to this transfer. We ensure appropriate safeguards through Standard Contractual Clauses with our sub-processors where required.

7. Data Retention

• Account data: Retained while your account is active + 30 days after deletion
• Payment records: 7 years (legal/tax requirement)
• Server logs: 30 days
• Designs and templates: Deleted immediately upon account deletion request

8. Your Rights

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data (editable in Account Settings)
• Erasure: Delete your account and all associated data
• Portability: Export your designs in JSON format
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Unsubscribe from marketing at any time

To exercise these rights, email hello@diabloatelier.com. We will respond within 30 days.

EEA/UK users may also lodge a complaint with their local data protection authority (e.g., the ICO in the UK at ico.org.uk, or the CNIL in France at cnil.fr). A list of EU supervisory authorities is available at edpb.europa.eu.

9. Security

We implement industry-standard security measures: passwords are hashed with bcrypt, data is transmitted over TLS, and access tokens use short-lived JWTs. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

10. Children

The Service is not directed at children under 13 (or 16 in the EEA). We do not knowingly collect data from children. If you believe a child has provided us data, contact us immediately.

11. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete: Request deletion of your personal information (subject to certain exceptions)
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale: We do not sell personal information. We do not share personal information for cross-context behavioral advertising
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise your rights, email hello@diabloatelier.com with the subject "California Privacy Request". We will respond within 45 days.

Categories of personal information collected in the past 12 months: Identifiers (name, email), internet activity (usage data, session tokens), commercial information (subscription status). Purpose: Service provision, security, legal compliance. Disclosed to: Service providers (Stripe, Supabase, Railway, SendGrid) under written contracts that prohibit use for any other purpose.

12. Brazil — LGPD

If you are located in Brazil, your data is processed in accordance with the Lei Geral de Proteção de Dados (LGPD). You have rights equivalent to those described in Section 8, including the right to confirmation of processing, access, correction, anonymization, portability, deletion, and information about sharing. Contact hello@diabloatelier.com to exercise these rights.

13. Australia

If you are located in Australia, we handle your personal information in accordance with the Australian Privacy Act 1988 and the Australian Privacy Principles. You have the right to access and correct your personal information and to make a complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

14. Changes

We will notify you of material changes to this policy by email at least 14 days before they take effect.

15. Contact & DPO

Privacy questions: hello@diabloatelier.com
Diablo Atelier SRL, Miraflores, Lima, Peru