Privacy

Who looks after your data

Vestigia is a colour studio by Vena Amoris, operated by Schoen LTD, the data controller, at Gladstonos 12–14, 8046 Paphos, Cyprus. For privacy questions or requests, write to ops@vena-amoris.co.

What we collect and why

• Account details: your email address, account identifier and sign-in records, to send access links, secure your account and sync your work.
• Your work: collection and group names, saved colour references and timestamps. These are associated with your account and are not published to other users.
• Generation details: when photo generation is available to your account, the photos you submit, product name, generated model, request status and usage records, to fulfil the request and enforce usage limits.
• Technical and support information: hosting and service providers process connection details such as IP address, browser information, request times and errors. We also receive anything you send when contacting us.

We process account data and your work to provide the services you request (performance of our agreement with you). Security, troubleshooting and support are based on our legitimate interests in operating a reliable service. We may retain information where required by law. An email address is needed for account features; you can browse without one.

Photos and 3D models

A GLB you open from your device is processed and saved locally in this browser; that upload does not send the model to our servers. A local preview copy may remain until you replace or remove it, or clear this site’s browser data.

Photo generation is different: submitted photos are uploaded to private Supabase storage and made available to fal.ai to run the Tripo model. The resulting GLB and generation history are saved to your account. We do not send your colour collections or selected Pantone data to the generation service.

We attempt to remove source photos from our storage once the generated model has been successfully saved. Failed or unfinished uploads, or a failed cleanup, may leave photos in storage until manually removed. Provider-side copies and logs are governed by the provider’s processing terms. Contact us to request removal of stored photos or generated models. Removing a model from the browser preview does not delete its cloud copy.

Service providers

We use Vercel for hosting, Supabase for accounts and private storage, and Resend for sign-in emails. Optional photo generation uses fal.ai. Authorised operators and providers may access data as necessary to deliver, support or secure these services.

Some images and 3D support assets may be fetched from external hosts, which receive the connection information needed to serve them. Following an external link takes you to a service with its own privacy practices.

Providers may process data outside the European Economic Area, including in the United States. Applicable transfer arrangements are described in their data-processing terms, including standard contractual clauses where applicable. Contact us for information about the safeguards relevant to your data.

Browser storage and tracking

We use local browser storage for your sign-in session and theme preference, and IndexedDB for the current 3D preview. Clearing site data removes local preferences and previews and may sign you out; it does not erase your cloud account.

This version does not include advertising trackers or product-analytics scripts. We do not sell your personal information or use your collections or uploads for our own AI model training.

How long information stays

Account details, saved work and generated models remain while your account is in use, unless you request deletion. Deleting a collection in the interface currently hides it using a recoverable deletion; it is not immediately erased from the database. There is no automatic purge schedule for those records or unfinished uploads in this version.

For permanent deletion, email us. We remove data that is no longer needed, subject to lawful retention needs and provider backup cycles. Security and service logs follow provider retention settings; contact us for details relevant to a request.

Your choices and rights

You can request access, correction, deletion or a portable copy of your personal data, and request restriction or object to processing where applicable. Where processing relies on consent, you can withdraw it. We may need to verify your identity before acting on a request.

Write to ops@vena-amoris.co. You may also complain to your local data-protection authority or the Cyprus Commissioner for Personal Data Protection. We do not use your data for automated decisions producing legal or similarly significant effects.

Changes

We will update this statement as Vestigia develops, and provide a prominent notice or contact account holders when a material change affects how their data is used.