Privacy Policy
Effective: 17 August 2026
This Privacy Policy explains how Carbon Circuit LLC, a New Mexico limited liability company, doing business as NeoLuxe Studio (“we”, “us” or “our”), handles personal information when you visit or use neoluxe.studio, our product-image and copy tools, or related integrations (the “Service”).
For personal information used to operate your account and the Service,Carbon Circuit LLC is the business or controller. Some providers, including Stripe and Google, may also act as independent controllers for parts of their services under their own privacy notices.
1. Personal information we collect
| Category | Examples |
|---|---|
| Account and profile | Name, email address, account identifier, authentication details, profile photo, plan, credit balance and account settings. If you use Google Sign-In, we receive the basic profile details you authorise Google to provide. |
| Inputs and outputs | Product photographs, prompts, scene direction, briefs, keywords, audience notes, generated images and generated product copy. |
| Generation metadata | Requested style, angle, quality, aspect ratio, model and scene choices, automatically detected product type, name or colour, moderation and quality results, job status and credits used. |
| Purchases | Stripe customer identifier, plan, billing period, purchase and invoice status, transaction identifiers and payment history. We do not receive or store your complete payment-card number. |
| Shopify connection | Store domain, installation status, approved API scopes, server-side Shopify session credentials, link status, product identifiers, product titles and images you select, and records of images added to products. We do not request Shopify customer or order data. |
| Communications | Your name, email, message and related correspondence when you use the contact form, request support, report content or exercise a privacy right. |
| Device, usage and diagnostics | IP address, approximate location derived from it, browser, device, operating system, referring page, visited routes, timestamps, feature interactions, performance measurements, error data and security logs. |
Please do not submit government identifiers, payment-card details, health records, precise location, children’s information or other sensitive data in a prompt, photograph or support message. We do not use faces in images to identify or authenticate people.
2. Where information comes from
We collect personal information:
- directly from you when you create an account or submit material;
- automatically from your browser, device and use of the Service;
- from services you connect, such as Google Sign-In, Stripe and Shopify; and
- from automated analysis of the material you submit, such as product attributes, moderation results and quality checks.
3. How and why we use information
| Purpose | EEA/UK legal basis, where applicable |
|---|---|
| Create and secure accounts; generate, save, enhance and deliver images and copy; provide requested Shopify actions | Performance of our contract with you |
| Process purchases, subscriptions, renewals, cancellations, credits, invoices and taxes | Contract; legal obligation |
| Moderate content, prevent fraud and abuse, enforce our Terms, protect accounts and investigate security events | Legitimate interests in protecting users and the Service; legal obligation where applicable |
| Diagnose failures, measure reliability and understand which features work so we can maintain and improve the Service | Consent for optional browser analytics; legitimate interests in essential server reliability, security and error diagnostics |
| Respond to support, legal and privacy requests | Contract; legal obligation; legitimate interests |
| Send transactional messages about your account, purchases, security or material Service changes | Contract; legitimate interests; legal obligation |
| Establish, exercise or defend legal claims | Legitimate interests; legal obligation |
We do not currently use account data for promotional email. If we add optional marketing, we will provide the notice and choice required by applicable law.
4. AI processing
We send the photographs, text instructions and related settings needed for a request to Google’s Gemini API. Google returns generated material and may also perform moderation, image analysis and quality checks. We do not use your inputs or outputs to train an AI model of our own.
Google’s retention and use of API data are governed by the Gemini API terms. Google states that prompts and responses submitted through its paid services are not used to improve its products, but it may retain limited data for security, abuse prevention and legal purposes. Do not submit information that you are not comfortable having processed by this provider.
A new source photograph uploaded from your device is held by us only long enough to validate and complete the request; we do not save it as a separate source file. Generated images are saved to your private library. If you use an existing library image as a source, that existing image remains saved until you delete it.
5. When we disclose information
We do not sell personal information. We do not share it for cross-context behavioural advertising or use it for targeted advertising. We disclose information only as described below:
| Recipient | Purpose and information involved |
|---|---|
| Supabase | Authentication, account database, private generated-image storage and public-by-link profile-image storage |
| Gemini AI processing and, if selected, Google Sign-In | |
| Stripe | Checkout, payment processing, invoices, subscription management, tax and fraud prevention |
| Shopify | Connect an authorised store, retrieve selected product data and publish an image when you direct us |
| Vercel | Website hosting and server logs; optional cookie-free page analytics and anonymous performance measurements after you allow analytics |
| PostHog, if enabled | Optional product analytics after you allow analytics. Automatic click capture and session replay are not enabled. See our Cookie Policy. |
| Sentry, if enabled | Error diagnostics used to find and repair failures. Performance tracing and session replay are disabled by default. |
| Professional advisers and authorities | Legal, accounting, insurance, audit, compliance and valid legal process |
We may also disclose information in a financing, merger, acquisition, reorganisation or sale of assets, subject to appropriate confidentiality and notice where required. Providers receive only the information reasonably needed for their role and may process it under contracts and their own legal obligations.
6. Retention
| Information | Typical retention |
|---|---|
| Account, profile and saved output | While your account is open. Individual renders and copy are removed when you delete them. Account deletion removes the account and associated saved content from active systems, subject to limited backups and legal exceptions. |
| New source-photo uploads | Transiently for the request on our systems; provider-side handling follows the Gemini API terms described above. |
| Render jobs, moderation and generation metadata | While the account is open or as reasonably needed for support, security, credit reconciliation and abuse prevention. |
| Billing and transaction records | For the period required by tax, accounting, chargeback and anti-fraud obligations, commonly up to seven years. |
| Contact and legal correspondence | For as long as reasonably needed to resolve the matter and keep an appropriate business or legal record. These records are not necessarily erased when an account is deleted. |
| Shopify data | While the app is installed or the store is connected. The access token is revoked on uninstall, and remaining shop-specific records and stored Shopify renders are erased when Shopify sends its required shop-erasure request, normally about 48 hours later. |
| Security, analytics and error logs | For a limited period set according to operational need and the applicable provider’s settings, then deleted or aggregated. |
Deletion from active systems may not immediately remove encrypted backup copies. Backups are isolated, expire on a limited cycle and are not used for ordinary business purposes. We may retain information longer where required by law, necessary to resolve a dispute, or reasonably needed to prevent fraud or enforce our agreements.
7. International transfers
We are based in the United States, and providers may process information in the United States and other countries whose laws differ from yours. Where EEA, UK or Swiss transfer rules apply, we use a recognised transfer mechanism where required, such as an adequacy decision, the EU Standard Contractual Clauses, the UK Addendum, or another valid safeguard. You may contact us for more information about applicable safeguards.
8. Security
We use measures designed to protect personal information, including transport encryption, access controls, row-level database rules, restricted server-side storage for Shopify session credentials and private storage with expiring links for generated images. No system is perfectly secure. You are responsible for protecting your login details and for downloading independent copies of work you cannot afford to lose.
9. Your choices and privacy rights
You can:
- edit your name and profile photo from Profile;
- delete individual renders and generated copy from your Library;
- disconnect a linked Shopify account from Profile;
- allow or refuse optional browser analytics through Cookie settings in the footer, and manage browser storage as described in our Cookie Policy;
- permanently delete your account and saved content from Profile. Cancel an active subscription first if you also want to stop future charges.
Depending on where you live and whether the relevant law applies to us, you may have rights to know or access personal information, correct it, delete it, receive a portable copy, restrict or object to processing, withdraw consent, and appeal a denied request. You may also have the right to opt out of sale, targeted advertising or certain profiling; we do not conduct those activities as described above.
To exercise a right, email contact@neoluxe.studio or use our contact form. Tell us the right you want to exercise and the email on your account. We may need to verify your identity and authority. We will not discriminate against you for making a request. An authorised agent may submit a request where local law permits, but we may require proof of authority and direct verification.
EEA residents may complain to their local data protection authority, and UK residents may complain to the Information Commissioner’s Office. California and other US state residents may appeal a denied request by replying to our decision with the subject “Privacy appeal”.
10. Automated processing
Automated systems generate output, analyse images, moderate submissions, detect abuse and help prevent payment fraud. They may block a request or affect whether a transaction is accepted, but we do not use them to make decisions that produce legal or similarly significant effects about eligibility for employment, housing, credit, insurance or essential services. Contact us if you believe an automated check was wrong.
11. Children
The Service is for people aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has submitted information, contact us so we can investigate and delete it where appropriate.
12. Other websites and services
Links and integrations may take you to services we do not control. Their privacy practices are governed by their own notices. This policy does not cover information a Shopify merchant independently collects from its customers or information you publish in a product listing.
13. Changes to this policy
We may update this policy as the Service, providers or law changes. We will post the revised policy with a new effective date and provide additional notice where a change materially affects your rights or applicable law requires it.
14. Contact us
Carbon Circuit LLC, a New Mexico limited liability company, doing business as NeoLuxe Studio
8206 Louisiana Blvd NE, Ste A #10082, Albuquerque, New Mexico 87113, USA
contact@neoluxe.studio