Effective Date: [November 1st, 2025]
Last Updated: [November 1st, 2025]
1. Data Controller
The data controller is Kairos AI, registered in France. For full legal details, see our Legal Notice. For privacy inquiries, contact support@wristshotai.com.
2. Personal Data We Collect
- Uploaded Photos (Wrist & Watch): Your wrist image and watch image are processed to enable the AI generation process. Original uploads are not stored permanently; see Section 5 for more details on storage and retention.
- Email Address and Account Data: Collected to create your account and deliver notifications (e.g., generation status).
- Payment Information: Processed by Stripe; we do not store payment card data.
- Usage Data: Automatic tracking via PostHog Analytics (page views, visits) and Stripe Dashboard (conversion metrics).
3. Purposes and Legal Basis
- Service Delivery (contract): Processing your wrist and watch photos and your payment/credits to generate your composite image or video and make it available to you.
- Consent: You consent by uploading your photo and providing your email.
- Legitimate Interest: Basic analytics to improve the Service.
4: Data Sharing with Third Parties
We share your personal data with third-party service providers, including:
- A US-based AI service provider for processing uploaded photos to generate wristshot images and videos.
- Stripe for payment processing.
- Supabase for authentication, database, and file storage.
- Cloudflare Pages for frontend website hosting.
- PostHog for analytics.
- Fly.io for backend API hosting.
Data transfers to third parties outside the EU, such as the AI service provider and hosting providers, are conducted in compliance with GDPR requirements, including the use of appropriate safeguards like Standard Contractual Clauses.
5. Data Retention
- Uploaded Photos: Your original uploads (wrist and watch) are processed server-side and are not stored permanently. Temporary processing artifacts are deleted promptly after generation.
- Generated Images & Videos: Resulting images and videos may be stored in Supabase Storage under your account to power your history gallery and downloads. Free-tier images include a small "Generated by Wristshot AI" watermark. You can delete items from your history at any time and they will be deleted instantly server-side as well.
- Temporary Metadata: We store metadata in our database to link your account to generation jobs and storage paths. Signed URLs are generated on demand and expire automatically.
- Email & Analytics Data: Retained as necessary to fulfill the Service and for compliance, then anonymized or deleted in accordance with GDPR.
- Payment Records: Retained by Stripe per its policy.
6. Security Measures
We implement HTTPS everywhere, server-side API calls, environment-variable secret management, input validation, rate limiting, signed URLs for file access, and Row-Level Security (RLS) on user data to protect your data.
7. Your Rights under GDPR
You have the right to:
- Access and obtain a copy of your data.
- Rectify inaccurate data.
- Erase your data (“right to be forgotten”).
- Restrict or object to processing.
- Portability of your data.
- Withdraw consent at any time (without affecting processing prior to withdrawal).
To exercise any right, contact support@wristshotai.com. You may also lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés).
8. Changes to This Policy
We may update this Privacy Policy; changes will be published here with a revised date.
9. Contact Information
Email: support@wristshotai.com
Legal Details: See Legal Notice