Privacy Policy

The controller is Hetrex Media S.R.L., trading as SCENYOU, Strada Closca, BL34 AP14, 555200 Avrig, Sibiu, Romania. E-mail: hello@scenyou.com. Authorized representative: Dan Gavrila.

We process personal data only to the extent necessary to provide the website, to initiate and perform contracts, for security, to fulfil legal obligations, or on the basis of your consent.

• Contract and pre-contractual measures: Art. 6(1)(b) GDPR.
• Legal obligations, in particular commercial and tax law: Art. 6(1)(c) GDPR.
• Legitimate interests in security, abuse prevention and reliable operation: Art. 6(1)(f) GDPR.
• Voluntary consent, in particular portfolio and marketing: Art. 6(1)(a) GDPR.

When you access the website, IP address, time, address accessed, referrer, browser, operating system and technical error data may be processed. This is necessary for delivery, stability and defence against attacks. Technical logs are only retained for as long as necessary for security and error analysis and are then deleted or anonymized.

For your account we process first name, last name, age, e-mail address, password in non-readable form, optionally telephone number, consent timestamps, login and MFA information, as well as account and notification settings. The age information is used to verify whether you may conclude a contract yourself. Mandatory fields are marked accordingly. We also store your chosen username, an optional profile picture in private storage and your preferred language so that emails and invoices are issued in your language.

Login links and e-mail confirmations are sent for secure use of your account. If two-factor authentication is enabled, the configured factor and its confirmation are managed.

We process your uploaded photos, file data, briefings, selected looks, outfit and scene preferences, messages, feedback, order and project status, and finished image versions. Photos may contain features that appear biometric; we do not use them for unique biometric identification.

Uploads are stored in private storage. You and responsible staff have access according to roles and order. Sharing links are time-limited. Publication or portfolio use only takes place after separate, voluntary consent. If you create a share link for your order, anyone with that link can view the shared order page without signing in; you can deactivate the link at any time.

We store the image files themselves – uploaded photos, working versions and result versions – in private object storage at Cloudflare R2 (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as well as Cloudflare Germany GmbH). Cloudflare acts as our processor on the basis of a data processing agreement. The storage location is chosen automatically and may be outside the EU; we base any transfer to third countries on the EU Standard Contractual Clauses together with supplementary safeguards, in particular encryption during transmission and storage as well as exclusively time-limited, signed retrieval addresses. The files are never publicly accessible. The legal basis is Art. 6(1)(b) GDPR (performance of contract); the transfer takes place pursuant to Art. 46(2)(c) GDPR. You are aware that, despite these measures, third countries may have a lower level of data protection compared to the EU and that authorities may have access possibilities there.

For personal look suggestions and parts of image editing, selected photos and your style description may be transmitted via the Lovable AI Gateway to the model provider OpenAI made available there. The processing serves exclusively the requested function or the performance of the contract. Results are reviewed by humans; no decisions are made solely by automated means that have legal or similarly significant effects.

We do not use customer photos to train our own models. Whether and to what extent providers technically log inputs is governed by the contractually agreed processing terms. International transfers are only carried out on the basis of statutory mechanisms, in particular adequacy decisions or Standard Contractual Clauses.

Final customer images never automatically appear in our gallery. Publication only takes place for a single, individually selected image finally approved by the studio, and only after your separate, voluntary consent to the public SCENYOU gallery and its findability in search engines. Name, contact details, original uploads, messages, invoices and order data are not published in the process.

Our team additionally reviews and curates every gallery entry. You may withdraw your consent at any time within the respective order or by e-mail. From the moment of withdrawal we deactivate the entry; copies already cached by search engines may technically only disappear once those engines re-crawl the page. We retain proof of consent and withdrawal to fulfil our accountability obligations until the expiry of applicable statutory retention and limitation periods.

To process orders we handle the package, services, prices, currency, billing address, payment status, document numbers and tax-relevant details. Online payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe receives your name, email address, billing address, amount, currency, payment method details and device and IP information for fraud prevention. Card data never reaches our servers. Stripe partly acts as an independent controller, for example to meet anti-money-laundering obligations; transfers to Stripe, Inc. in the USA are based on the EU-US Data Privacy Framework and the EU Standard Contractual Clauses. Legal bases are Art. 6(1)(b), (c) and (f) GDPR. More information: stripe.com/privacy.

We process contact data and messages to handle inquiries, orders, invoices, payment and status information. Resend may be used as a delivery service provider for transactional e-mails. You will only receive marketing messages after voluntary consent; this consent may be withdrawn at any time.

On your first visit you can decide for yourself via our consent interface which optional services are loaded. Without your selection, only technically necessary information is stored. Optional categories are not pre-selected and are only activated after your active consent. The legal basis for necessary storage is § 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(b) or (f) GDPR; for optional access and the related processing it is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

Necessary storage

Necessary cookies and browser storage enable login and session management, protection against abuse, secure ordering processes, the local draft of the configurator, navigation within the customer and team area, as well as storing your consent decision. This may in particular include the login session, SCENYOU_DRAFT, a state of the side navigation and scenyou-cookie-consent. The configurator draft is retained locally for up to seven days; the navigation state for up to seven days; the consent decision for up to 180 days or until it is changed. Session data depends on the duration of your login and the technically required security periods.

Comfort

With your consent, optional comfort services such as external media embeds may be loaded in the future. No such comfort service is currently active. Our web fonts Figtree and Outfit are delivered directly from our own website; no connection to Google Fonts or any other font provider is established in the process.

Analytics and Marketing

After you consent to the marketing category, we may display our own SCENYOU popups about looks, offers or consultation content. To control frequency, we store the time of the last display in your browser's local storage under the key “scenyou-popup:” with a random popup ID. Depending on the campaign setting, this is retained for the session, seven days or thirty days. If you voluntarily submit a lead form, we process your email address, language, consent and signup source for the requested mailing. Signup is secured by a confirmation email and can be withdrawn at any time through the unsubscribe link. No external advertising or tracking service is loaded for this purpose.

Selection, Proof and Withdrawal

Your selection is stored exclusively in your browser together with version number, selected categories, timestamp and expiry date; it contains no contact data and is not linked to your customer account. You may change or withdraw it at any time via "Cookie Settings" in the footer or via the cookie icon at the bottom of the page. Withdrawal applies for the future. Content already loaded is removed as far as technically possible; data that a provider has previously lawfully processed remains unaffected. After 180 days or in the event of a material change to the services used, we will ask for your selection again.

Data is only shared with parties that need it for the respective task: Lovable and its sub-processors for hosting, database and sign-in; Cloudflare (R2 and delivery) as storage for all image files; Resend, Inc. (USA) for sending emails; Stripe for payments; the Lovable AI Gateway and OpenAI only when AI features are used. Agreements under Art. 28 GDPR are in place with all processors. Transfers to third countries, in particular the USA, are based on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Tax advisers, authorities and courts may also receive data where required by law. We do not sell personal data.

We store account data until the account is deleted, unless legal obligations preclude this. Drafts and uploaded images are retained for processing and provision and are deleted after a deletion request or after expiry of the communicated project retention period. We retain invoicing and accounting data in accordance with the applicable commercial and tax law retention periods. We store proof of consent until the expiry of possible statutory evidentiary and limitation periods.

We use access controls, private file storage, time-limited links, encrypted transmission, role-based permissions, bot protection and optional MFA. No procedure can guarantee absolute security; in the event of relevant incidents we act in accordance with statutory reporting and information obligations.

Under the GDPR you have rights to access, rectification, erasure, restriction, data portability and objection. You may withdraw consent at any time with effect for the future. You may also lodge a complaint with a competent data protection supervisory authority, in particular at your place of residence, your workplace, or the place of the alleged infringement. Our competent lead supervisory authority is the Romanian data protection authority ANSPDCP, B-dul G-ral Gheorghe Magheru 28–30, 010336 Bucharest, www.dataprotection.ro.

Please send requests to hello@scenyou.com. To prevent unauthorized access, we may require proof of identity.

A personal account is intended for persons aged 18 and over. We will adapt this policy if functions, recipients or the legal situation change. The current version is always available on this page; we will inform you appropriately of any material changes.