Privacy policy

Who we are

CarFlex Studio is operated by Nobiliti S.A.S., a Colombian company, tax ID (NIT) 902.081.249-5, registered with the Cámara de Comercio de Cartagena, with its registered office at Calle 30 #20-145, Pie de la Popa, Cartagena de Indias, Bolívar, Colombia. You can reach us at info@carflexstudio.com.

Two different relationships live in this product, and it matters which one you are in. For the business that subscribes, we are the data controller of its account. For the photographs of that business's clients, the business is the controller and we act on its instructions as a processor: it decides whose photo is taken, why, and when it is deleted.

What data we process

• From the subscriber: name, email, phone, business name and country, plan and billing history. Card numbers never reach us — see Payments below.
• From the person photographed: the photograph, the images generated from it and, if the business writes one, a free-text label to find the project again. Optionally a gender marker, used only to phrase the instruction sent to the AI model.
• Technical data: IP address, device and browser, and event logs needed to run and secure the service, including which images were generated and how much each account consumed.

We do not ask for and do not store medical records, diagnoses, identity documents or payment card data. CarFlex Studio is not a clinical record system and holds no patient history.

Why we may process it

To provide the service you contracted, to bill it, to keep it secure and available, to comply with tax and accounting obligations, and — only with your prior authorisation, and only for the account holder — to write to you about the product. Under Colombia's Law 1581 of 2012 the processing of personal data rests on the authorisation of the data subject, and the business using CarFlex Studio is the one that must obtain it from the person photographed.

The photographs

They are stored encrypted in a private bucket. They are not public: to view one, the application issues a signed link that expires on its own.We do not sell them, we do not train anything on them, and we grant no one the right to. The only third party they reach is the AI provider that performs the edit — see the section below, because what that provider may do is governed by its contract, not by ours.

The business can delete a simulation or a whole project at any time. Deleting removes the stored files as well, not just the database row.

Consent from the person photographed

Before generating, the application requires the professional to confirm they hold the person's authorisation to process their image. Obtaining that authorisation, keeping evidence of it and honouring its withdrawal is the business's responsibility, under Law 1581 of 2012 and its implementing decrees. Every image the platform produces is marked as an AI-generated simulation.

Payments

Our sole payment provider is Lemon Squeezy, acting as merchant of record: it runs the checkout, issues the invoice and handles the sales taxes of your country. Card details are entered on their systems and never reach ours — we receive the outcome of the payment, the amount and an identifier, and nothing else. Subscriptions are charged in US dollars.

What the AI providers may do with an image

To produce a simulation the photograph has to leave our servers and reach an AI provider. That provider is not bound by this policy: it is bound by its own terms, which it writes, which it can change, and which you can read — every one is linked in the list below. What follows is what those terms allow today, said plainly.

• They process the image to answer the request. That is the point: the photograph and the instruction go, the edited image comes back.
• They keep it for a short window. These providers typically retain what is submitted for a limited period — on the order of thirty days — to investigate abuse and to meet legal requests, and then delete it.
• Automated safety systems inspect it, which is why some requests come back refused. Content those systems flag may be reviewed by a person at the provider.
• They may keep aggregate, non-content data — how many requests, how long they took, whether they failed.
• Training is the line we do not cross. We send images only through the providers' business APIs, whose terms state that submitted content is not used to train their models. The free and consumer tiers of these same products often say the opposite, and the application never uses them.

We choose providers on those terms and we re-check them, but we cannot promise on someone else's behalf. If a client will not accept that their photograph is processed by a third party abroad, the honest answer is not to photograph them: there is no version of this product where the image stays on your premises.

Who else touches the data

We rely on the providers below to run the service. Each one receives only what its function requires, and none of them is authorised to use your data for its own purposes.

• Railway · United States
  Application hosting and the database that stores accounts, plans and simulation records. Their terms
• Cloudflare R2 · United States / global edge
  Encrypted object storage for every photograph and every generated image. Their terms
• Google (Gemini API) · United States
  The AI model that performs the image edit. It receives the photograph and the instruction, and returns the result. Their terms
• OpenAI · United States
  Alternate AI provider, used as a fallback when the primary one refuses or fails. Their terms
• Anthropic · United States
  Alternate AI provider, used as a fallback when the primary one refuses or fails. Their terms
• fal.ai · United States
  Alternate AI provider, used when the main one cannot complete a simulation. Their terms
• Lemon Squeezy · United States
  Our sole payment provider and merchant of record. It handles checkout, invoicing and sales taxes. We never receive or store card numbers. Their terms
• Resend · United States
  Transactional email: sign-up verification, billing notices and the deliveries a business sends to its own client. Their terms
• Twilio · United States
  WhatsApp delivery, when the business enables it. It receives the recipient's number and the message or image being sent. Their terms
• Google Analytics · Search Console · Firebase · United States
  Aggregate traffic measurement on the public website, and push notifications for the mobile app. None of them receives a client photograph. Their terms

These providers process data outside Colombia, chiefly in the United States. We use them because they offer at least the level of protection required by Colombian law, and we contract them under terms that limit them to processing on our instructions.

Analytics and cookies

The public website measures aggregate traffic with Google Analytics and is registered with Google Search Console. Neither one has access to the application or to any client photograph.

The site itself stores two small preferences on your device — the language and the light or dark theme — and, once you sign in, the session token that keeps you signed in. Nothing else is written to your browser, and none of it is used for advertising.

How long we keep it

Photographs and simulations live as long as the account keeps them: you delete them when you want, and they go for good. When an account is closed we delete its content within 30 days. Billing records — payments and invoices — are kept for the period tax law requires, detached from your photographs and your content.

Your rights

You can access, update, correct and delete your data, ask us for proof of the authorisation given, and withdraw that authorisation. Write to info@carflexstudio.com from the address on the account and we answer within the statutory deadlines — fifteen business days for a query and fifteen for a complaint, extendable once under Law 1581. If you are the person photographed rather than the subscriber, address the business that took the photo first: it decides over that image, and we act on its instructions.

To close an account and erase everything in it, see Delete your account.

Security

Traffic travels over TLS, images sit in a private bucket reachable only through expiring signed links, credentials and provider keys are stored encrypted, and each account only ever sees its own data. No system is immune: if a breach ever affects your data, we will tell you and the competent authority as the law requires.

Children

The service is for professional use by adults. Generating simulations from photographs of minors is forbidden by the terms of service, and an account doing it is suspended.

Changes to this policy

If we change it we update the date at the top and, when the change is material — a new purpose, a new kind of provider — we tell account holders by email before it takes effect.