Privacy policy
LAST UPDATED: 5 October 2026
1. Controller
Vincent Seidel – Four Studio, c/o Block Services, Stuttgarter Str. 106, 70736 Fellbach, Germany — hello@fourstudio.co. This policy explains which personal data Facet (fourstudio.co) processes, why, and your rights under the GDPR.
2. Visiting the website
When you open Facet, our hosting providers process technical data your browser sends — IP address, time, requested page, browser and device information — to deliver the site and keep it secure (Art. 6(1)(f) GDPR, our legitimate interest in a working, secure service). These logs are kept for 30 days. The 3D editor runs in your browser; the 3D head model is loaded from our servers.
3. Your account
To render images you create an account with your email address and a password, or sign in with a link sent by email. We process your email address, your credit balance and your account settings to provide the service (Art. 6(1)(b) GDPR) and send you the emails that belong to it (confirmation, sign-in links, payment and account notices).
If you write to us by email or through our contact form, we use your name, email address and message to answer you (Art. 6(1)(b) GDPR where it concerns your account or a contract, otherwise Art. 6(1)(f) GDPR — our interest in answering). Messages from the contact form reach us by email through Resend.
4. Creating faces and characters
- Face Creator: the face parameters you sculpt (abstract numbers — not photos of you), your prompts and the images rendered from them.
- Character Creator: body settings, clay body figures, the base photos and photo sets of your characters, and their captions.
- Photo analysis: if you upload a photo to fill in a shot or ideas, it is stored briefly in private storage, analysed by an AI model and deleted right after the analysis.
We process this to provide the service you use (Art. 6(1)(b) GDPR). Your images are stored in private storage and shown to you through links that expire. We do not use your images to train AI models. Clay body figures contain no personal features; we may keep and reuse them, for example in a body catalog.
5. AI rendering
To render, we send the necessary data — geometry images derived from your face parameters, your prompts, reference images of your character and, for a photo analysis, the uploaded photo — to our AI infrastructure provider fal.ai. fal runs the models itself or passes the request to the model’s provider, for example OpenAI (image models) or Google (language and image analysis models). Some image requests go to OpenAI directly, and when fal is busy or unavailable an image request goes to OpenRouter, which passes it to the same model provider. They process the data only to return the result.
6. Payments
Payments are handled by Stripe. Stripe processes your payment details, name, email and billing address; we never see your full card details. We receive the information we need to manage your plan and credits (for example the payment status and your country). Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for keeping records required by tax and commercial law. Cancellations sent through our “Cancel contracts here” page (name, email, contract reference) are kept as proof of the cancellation.
7. Cookies and local storage
Facet stores your sign-in session and a few settings in your browser. We also use analytics cookies to understand how Facet is used — in the EU, UK and Switzerland only if you agree. You can change your choice any time under “Privacy settings” at the bottom of the page.
8. Service providers
- Cloudflare, Inc. (USA) — website delivery and hosting.
- Google Cloud (Google Ireland Ltd.; Google LLC, USA) — our API, run in the region europe-west1 (Belgium).
- Supabase, Inc. (USA) — accounts, database and image storage, run in Frankfurt, Germany.
- Features & Labels, Inc. (fal.ai, USA) — AI rendering, and through it model providers such as OpenAI (USA) and Google (USA).
- OpenAI (OpenAI Ireland Ltd.; OpenAI, L.L.C., USA) — AI image models, also used directly.
- OpenRouter, Inc. (USA) — backup route to the same AI image models when fal.ai is busy or unavailable, and through it OpenAI (USA).
- Stripe (Stripe Payments Europe Ltd., Ireland; Stripe, Inc., USA) — payments.
- Resend (Plus Five Five, Inc., USA) — sending our emails (confirmation, sign-in links, cancellation confirmations).
All providers process data on our behalf under data processing agreements (Art. 28 GDPR), except where they act as their own controller as stated above. Where data goes to the USA, the transfer is based on the EU–US Data Privacy Framework if the provider is certified under it, and otherwise on the EU standard contractual clauses.
9. How long we keep data
- Account data: until you delete your account.
- Your images and characters: until you delete them or your account; copies in backups are removed within 7 days.
- Photos uploaded for an analysis: deleted right after the analysis.
- Payment records: as long as tax and commercial law require (up to 10 years).
- Server logs: see section 2.
10. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability and to object to processing based on our legitimate interests (Art. 15–21 GDPR). Write to hello@fourstudio.co. You can also complain to a data protection supervisory authority, for example the one responsible for us: the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, datenschutz-berlin.de).
11. Age
Facet is for people aged 18 and over.
12. Changes
We update this policy when Facet or the law changes. The current version is always on this page, with its date at the top.