Privacy
Last updated 11 September 2026
This is written from what the software actually does, not from a template. Every retention period below is a constant in the code, and if one changes this page changes.
Short version: we collect what the product needs, five companies help run it, nothing is sold, nothing follows you onto other websites, and a shopper's photograph is deleted within six hours.
01Who we are
Flatlay Studio is a product operated from India that turns a photograph of a garment into product photography, listing copy and marketplace crops. This page covers the studio at flatlay.in and the try-on widget we host on our customers' storefronts.
Questions about anything here go to saifsiddiqui2409@gmail.com.
02What we collect
Only what the product needs to work. There is no advertising business here and nothing is sold on.
| What | Why |
|---|---|
| Your email, name and label | To make the account and to reach you about it |
| Your password, hashed | To let you back in. Stored as a scrypt hash with its own salt, never as text, and not recoverable by us |
| Your Google account id, if you use Google sign in | To recognise you next time. We receive your email, name and profile picture, and ask for nothing else |
| Photographs you upload | They are the input. We read the garment out of them and generate from them |
| Images and copy we generate for you | So they are in your library when you come back |
| Your credit ledger | Every debit and refund, so the balance can be explained rather than asserted |
| Session records | The device and the browser string, so you can see what is signed in and sign it out |
03Analytics, and what it does not do
We use PostHog to see which pages people read and where they give up. It records the page you are on, roughly where in the world you are from your address, and what you click. There is no advertising pixel, no tag manager and nothing that follows you onto other people's websites.
Session replay runs on the marketing pages only. It is switched off the moment you sign in, and everything you type is masked before it leaves your browser. Recording somebody looking at a collection they have not launched yet is not a trade worth making for funnel data, so the studio itself is never recorded.
We never see your card. Payments go through Dodo Payments, who take the card details directly. We receive the fact that you paid and what for.
05Shoppers using try-on
If you are a shopper who tried a garment on somewhere, this part is about you. You have no account with us and we are not trying to give you one.
Your photograph is used to make your result and nothing else. It is not added to a catalogue, it is not shown to the merchant, and it is not used to train a model.
| What | Kept for |
|---|---|
| The photograph you upload | Six hours, then deleted automatically |
| The result you were shown | Thirty days, so you can come back to it, then deleted |
| A salted hash standing in for you | Rate limiting only. It is not a name, an email or an account |
| Your email, only if that shop asked for it | The merchant's own record, under their privacy policy |
06Who else sees your data
Five companies, each doing one job. We do not sell data and we do not share it for advertising.
| Who | What they get, and what for |
|---|---|
| The photographs and prompts, to generate images through the Gemini API. If you sign in with Google, your identity for that sign in | |
| PostHog | Which pages you read and what you click, so we can tell what is working. Marketing pages only for session replay, never the studio |
| Dodo Payments | Your email and name, to take payment and issue receipts. They hold the card details, we do not |
| Resend | Your email address and the message, to deliver password resets and team invites |
| Microsoft Azure | Hosting. The server and its database sit in Azure's South India region |
07How long we keep things
Anything with a clock on it deletes itself on that clock, whether or not anybody asks. A retention rule that needs somebody to remember it is a rule that fails on a busy day.
| Thing | Kept for |
|---|---|
| A shopper's try-on photograph | Six hours |
| A try-on result | Thirty days |
| Working files during generation | Six hours |
| A password reset link | One hour, and one use |
| A team invite link | Seven days, and one use |
| A signed in session | Thirty days, or until you sign out |
| Your account, photographs and library | Until you delete them or close the account |
08Your rights
You can see, correct, export or delete what we hold. Most of it is already in the app: your library, your sessions, your team and your ledger are all on screen and under your control.
For anything the app does not cover, including deleting the account outright, write to saifsiddiqui2409@gmail.com and we will do it. We will not make you fill in a form to leave.
Depending on where you live you may also have the right to object to processing or to complain to a data protection authority. Nothing here is meant to limit that.
09Security
Passwords are hashed with scrypt, each with its own salt. Sessions are opaque random tokens held on our side, so signing out actually revokes them, which a self contained token cannot do. Reset and invite links are stored hashed, expire, and work once.
Sign in attempts are rate limited per email and per address. Traffic is encrypted in transit.
None of that makes a system perfect. If you find something wrong with ours, tell us at saifsiddiqui2409@gmail.com and we would rather hear it from you than from somebody else.
10Children
The studio is for businesses and is not aimed at children. We do not knowingly hold an account for anyone under 18.
Kidswear photography generates images of children who do not exist. No real child is photographed and no child's photograph is collected. Merchants should not enable try-on on pages aimed at children, because try-on asks the shopper for a photograph of themselves.
11Changes
If this page changes in a way that matters, the date at the top changes and we will say so by email rather than quietly editing it.
12Contact
Everything reaches saifsiddiqui2409@gmail.com, privacy questions included.