Privacy Policy
Last updated: 7 July 2026
This Privacy Policy explains how Carbon Circuit LLC(“NeoLuxe Studio”, “we”, “us”) collects and uses your personal data when you use NeoLuxe Studio at neoluxe.studio. We are a US-based company but offer the Service to customers in the UK and EU; for those customers we are the “controller” of your personal data and process it in line with the UK GDPR, the EU GDPR and other applicable data protection laws.
1. Data we collect
- Account data: your name and email address, and (if you sign in with Google) the basic profile information Google shares.
- Content you provide: the images you upload and the output images we generate for you, plus related details (for example the chosen look or aspect ratio, and automatically-detected attributes such as garment type and colour).
- Transaction data: records of credits, plans and purchases. Card payments are handled by our payment provider; we do not receive or store your full card number.
- Technical and usage data: information such as your IP address, device and browser type, and logs of how you interact with the Service, collected to keep it secure and working.
2. How we use your data and our legal bases
| Purpose | Legal basis (UK / EU GDPR) |
|---|---|
| Create and manage your account; generate, store and let you download your images | Performance of our contract with you |
| Take payment and manage credits/plans | Performance of a contract; legal obligation (record-keeping) |
| Keep the Service secure, prevent abuse and debug problems | Our legitimate interests in running a safe, reliable service |
| Send service messages (e.g. account or security notices) | Performance of a contract; legitimate interests |
| Send marketing emails (if we offer them) | Your consent, which you can withdraw at any time |
| Comply with legal obligations and handle disputes | Legal obligation; legitimate interests |
3. AI image processing
To generate your studio images, the photos you upload are sent to our third-party AI provider (Google, via the Gemini API) for processing, which may also include automated analysis and quality checks of the image. We send only what is needed to perform the generation you request. The resulting output images are stored in your account until you delete them or close your account.
4. Who we share data with
We do not sell your personal data. We share it only with service providers (“processors”) who help us run the Service, under contracts that require them to protect it:
| Provider | What they do |
|---|---|
| Supabase | Authentication, database and image storage hosting |
| AI image generation/analysis (Gemini API) and Google Sign-In | |
| Stripe | Payment processing (when paid plans are enabled) |
| Our hosting/infrastructure providers | Running and serving the website and application |
We may also disclose data if required by law, to enforce our terms, or in connection with a business sale or reorganisation.
5. International transfers
We are based in the United States, and some of our providers also process data outside the UK and EEA, including in the United States. Where we transfer personal data from the UK or EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Agreement / Addendum to those Clauses, or another lawful transfer mechanism. You can ask us for more detail using the contact address below.
6. How long we keep data
- Uploaded photos are processed to generate your output and are not retained as separate files after processing.
- Output images and account data are kept while your account is active and deleted (or anonymised) after you delete them or close your account, unless we must keep them longer by law.
- Transaction records are kept as long as needed for tax and accounting obligations.
- Logs are kept for a limited period for security and troubleshooting.
7. Your rights
Under UK and EU data protection law you have the right to:
- access a copy of your personal data;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict or object to certain processing;
- data portability; and
- withdraw consent at any time where we rely on it.
To exercise any of these, email privacy@neoluxe.studio. If you are in the UK you can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk; if you are in the EU you can complain to your local data protection supervisory authority. We’d appreciate the chance to help first.
8. Security
We use appropriate technical and organisational measures to protect your data, including access controls and encryption in transit. Your stored images are held in private storage and served via expiring, signed links. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
9. Children
The Service is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.
10. Cookies
We use a small number of essential cookies and similar technologies. See our Cookie Policy for details.
11. Changes to this policy
We may update this policy from time to time. If changes are material we will take reasonable steps to notify you, and we will always post the current version here with an updated date.
12. Contact
Carbon Circuit LLC, a New Mexico limited liability company trading as NeoLuxe Studio, registered office 8206 Louisiana Blvd NE, Ste A #10082, Albuquerque, New Mexico 87113, USA. For any privacy question or request, email privacy@neoluxe.studio.