Privacy Policy

CuratorX Studio is a browser-based batch photo editing tool owned and operated by Cruzsan Technologies LLC. Cruzsan Technologies LLC, an Ohio limited liability company located at 6545 Market Ave. North, STE 100, Canton, OH 44721, USA, is the data controller for the personal information described in this policy. You can reach us at support@cruzsantechnologies.com.

As of the effective date of this Privacy Policy, image processing occurs locally within your browser and uploaded images are not stored by us.

All editing — filters, watermarks, manual adjustments — is performed using your device's own processing power via the browser Canvas API. When you export, the resulting file is downloaded directly to your device. Under the current feature set, we have no technical ability to access your photos.

If future features involve cloud storage, cloud-based processing, AI-assisted processing, collaboration tools, or image synchronization, those practices will be disclosed through updates to this Privacy Policy prior to any such features becoming active. Material changes that affect your privacy will be communicated to you in advance as described in Section 17.

When you create an account and use our service, we collect the following categories of personal data:

• Account information: your name and email address, provided when you sign up.
• Billing linkage: a Stripe customer ID that connects your account to your payment records held by Stripe. We do not store card numbers, bank details, or any raw payment data.
• Subscription status: your current plan (Spark, Pro, or Studio), trial end date, renewal date, and cancellation status.
• Time zone: your time zone (for example, "America/New_York"), read from your browser's settings, so dates in our emails — like when your trial ends — match your local time. It is stored with your account and deleted with it.
• Custom presets: custom filter presets you save are stored locally in your browser only (not on our servers). Their names and numeric settings (e.g., brightness: 6, warmth: 20) never leave your device. No image content is stored.
• Watermarks: a PNG logo you upload or a watermark you draw (which may include your signature) is saved locally in your browser so it is available on your next visit. It is never uploaded to our servers, and you can remove it by clearing your browser storage.

When you access CuratorX Studio, our infrastructure providers may automatically collect certain technical information as a normal part of operating a secure web service. This may include:

• IP address
• Browser type and version
• Device type and operating system
• Authentication and session logs
• Security and error logs
• Request metadata (timestamps, pages accessed, HTTP status codes)

This technical information is collected by our infrastructure providers (primarily Supabase and Cloudflare) as part of standard network security, service reliability, and fraud prevention operations. We do not use this information for advertising, behavioral profiling, or any purpose beyond security and operational troubleshooting. It is retained only as long as reasonably necessary for those purposes.

We use a small number of cookies and browser storage mechanisms:

We do not use advertising cookies, cross-site tracking, or analytics cookies. You can clear browser storage at any time via your browser settings.

We use the personal data we collect only to:

• Create and maintain your account
• Process subscription payments and manage your plan
• Send service emails about your account and subscription: email verification, password reset, free-trial confirmation and trial-ending reminder, cancellation confirmation, and account-deletion notices. Payment receipts and failed-payment notices are sent by Stripe on our behalf.
• Save your account preferences and settings
• Respond to support requests you send us
• Detect and prevent fraud, abuse, unauthorized access, and Terms of Service violations — including free trial abuse and subscription fraud
• Maintain the security and integrity of the platform
• Comply with applicable legal obligations

We do not sell your personal information. We do not use your data for advertising or behavioral profiling. We do not share your data with any third party except as described in Section 9.

We process personal information only when we have a valid reason to do so. For users in the EU and UK, the legal bases under GDPR are:

• Contractual necessity (Art. 6(1)(b)): creating and managing your account, processing your subscription, delivering the Service, and sending transactional emails you need to use the Service.
• Legitimate interests (Art. 6(1)(f)): security monitoring, fraud and abuse prevention, free trial integrity, platform reliability, and responding to support requests. We rely on this basis only where our interests are not overridden by your rights and freedoms.
• Legal obligation (Art. 6(1)(c)): retaining billing records, tax records, and other data required by applicable laws and regulations.

For users outside the EU/UK, we process your information because it is necessary to deliver the Service and fulfill our contractual commitments to you, and for the legitimate operational and security purposes described in this policy.

We may process certain account and technical information for the purposes of fraud prevention, abuse detection, and platform security. This includes detecting and responding to:

• Unauthorized account access attempts
• Suspicious or anomalous account activity
• Free trial abuse, including the creation of multiple accounts to obtain repeated trials
• Subscription fraud or payment disputes
• Automated or bot activity that violates our Terms of Service
• Other activity that threatens platform integrity or other users' security

Processing for these purposes is based on our legitimate interest in maintaining a secure and trustworthy service. Such processing is limited to what is reasonably necessary for operational and security purposes. It is not used for advertising, behavioral profiling, or any purpose unrelated to security and platform integrity.

We share limited personal data with the following companies to operate the service:

• Supabase — provides our authentication system and database. Your email, name, and subscription status are stored on Supabase infrastructure. Supabase is GDPR-compliant and operates under a Data Processing Agreement with us.
• Stripe — processes all subscription payments. When you subscribe, Stripe collects and stores your payment details under their PCI-DSS Level 1 certified environment. We receive only a customer ID token and do not store card numbers, bank details, or raw payment data. Stripe's privacy policy is available at stripe.com/privacy. Stripe keeps its own customer record after your CuratorX account is deleted — see section 11.
• Resend — sends our service emails (for example email verification, password reset, trial and cancellation notices, and account-deletion notices). Resend processes your email address, your name where included, and the content of those emails. Resend's privacy policy is available at resend.com/legal/privacy-policy.
• Cloudflare — hosts and delivers the application through its global network. As part of normal content delivery, DDoS protection, and security operations, Cloudflare may process technical information including IP addresses, request metadata, browser information, security telemetry, and network performance data. This processing enables content delivery, protection against malicious traffic, and service reliability. Cloudflare does not use this information to identify or profile individual users on our behalf. Their privacy policy is available at cloudflare.com/privacypolicy.

CuratorX Studio is operated by Cruzsan Technologies LLC from the United States. Our service providers — Supabase, Stripe, and Cloudflare — may process or store your personal information on servers located outside your country of residence, including in the United States and other countries whose privacy laws may differ from those in your jurisdiction.

Where required by applicable law, we rely on reasonable safeguards to protect personal information transferred internationally, including standard contractual clauses and other transfer mechanisms recognized under applicable data protection law.

By creating an account and using CuratorX Studio, you acknowledge that your information may be transferred to and processed in the United States and other countries.

We retain your account data (email, name, and subscription records) for as long as your account is active. Custom presets are stored only in your browser, never on our servers.

When you delete your account: if you have a paid plan or free trial, your subscription is set to end and your account is permanently deleted at the end of your current billing period or trial. You keep access until then and can cancel the deletion from your Account page before that date. If you have no paid plan or trial, your account is deleted immediately. Either way, we email you a confirmation when you make the request and again when the deletion is complete. If you want your data erased before the end of your billing period, contact us and we will do so. Deletion removes your profile and subscription record from our systems, except as described below.

Stripe's records: payments are processed by Stripe, which keeps its own customer record for you — your name, email address, billing address, payment card brand and last four digits, and your invoices and payment history. Deleting your CuratorX account does not delete that record: Stripe retains it under its own legal, tax and anti-fraud obligations and under Stripe's privacy policy (stripe.com/privacy). After your account is deleted we no longer keep a link between you and that Stripe record, but we may still look up payment records in Stripe when needed to handle a refund, a payment dispute, or our tax and accounting obligations.

Certain categories of information may be retained after account deletion where required or permitted by applicable law, including:

• Billing and transaction records
• Tax and accounting records required by financial regulations
• Security and fraud-prevention logs
• Records needed to resolve active or reasonably foreseeable disputes
• Records required to comply with legal or regulatory obligations

The retention period for such records varies based on the applicable legal requirement. Information retained after account deletion is not used for marketing purposes. Stripe may independently retain transaction records pursuant to their own legal obligations and policies.

localStorage data (editor preferences, local presets, and saved watermarks) is stored on your device and is not under our control. You may clear it at any time through your browser settings.

If Cruzsan Technologies LLC or CuratorX Studio is involved in a merger, acquisition, reorganization, sale of assets, financing transaction, or similar business combination, your personal information may be transferred to the acquiring entity as part of that transaction.

We will take reasonable steps to notify you before your information becomes subject to a materially different privacy policy. The Privacy Policy in effect at the time of any transfer will continue to apply to your information unless you are notified otherwise and given the opportunity to make choices about your data.

Depending on where you are located, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure: ask us to delete your personal data ("right to be forgotten"), subject to legal retention obligations.
• Portability: request an export of your data in a machine-readable format.
• Objection: object to processing based on legitimate interests.
• Restriction: ask us to limit how we process your data in certain circumstances.

EU/UK (GDPR): You have all rights listed above. Our lawful bases for processing are set out in Section 7. To exercise any right, email support@cruzsantechnologies.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

California (CCPA/CPRA): We do not sell or share your personal information with third parties for their own marketing or advertising purposes. You may request access to or deletion of your personal information by contacting us at the address above.

We implement appropriate technical and organizational measures to protect your personal data, including encrypted connections (HTTPS), row-level database security (each user can only access their own records), and strict access controls on our systems.

No method of electronic transmission or storage is 100% secure. While we work to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your rights and freedoms, we will notify affected users as required by applicable law.

CuratorX Studio does not currently respond to browser "Do Not Track" (DNT) signals. There is no universally accepted standard governing what DNT signals require a website to do, and no consistent implementation exists across browsers or jurisdictions. We will reassess this position if a recognized standard is adopted.

CuratorX Studio is not directed at children under the age of 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, please contact us immediately at support@cruzsantechnologies.com and we will delete it promptly.

We may update this Privacy Policy from time to time. If we make material changes that affect your rights — including changes to how your images are processed, what data is collected, or who we share it with — we will notify you by email at least 30 days before they take effect. The most current version will always be available at this URL with its effective date.

Your continued use of the Service after changes take effect constitutes your acceptance of the updated policy.

For any privacy-related questions, data requests, or complaints, contact us at: