SFUMIA01 · Who is responsible for your data?
CG.Studio, the publisher of SFUMIA, is responsible for processing relating to the website, accounts, billing, support and administration of Cloud services.
The publisher’s legal information and postal address are provided in the legal notice.
For any question or to exercise your rights: support@sfumia.ai, or by post to the address in the legal information, marked ‘Personal data’.
When your studio hosts its projects, production data or TeamChat on its own PC or server, it decides how that data is used, accessed and retained. This policy does not replace the information your studio must provide to you.
02 · What data is processed?
Website: your IP address and technical request information needed for hosting and security. Your language preference is stored on your device. An IP-based country estimate adapts the website display; it does not use your GPS location or send your IP address to an external geolocation service.
Account: email address, account identifier, authentication information, team membership, roles, access rights and information needed to manage subscriptions and Cloud credits.
Payments: billing identity and contact details, purchases, subscriptions, amounts, invoices and transaction references. Full payment card details are collected by Stripe through its payment interface and are not stored in the SFUMIA account database.
Identity verification: Stripe Identity receives the documents and, depending on the verification flow, images or selfies requested to verify identity and adulthood. SFUMIA receives the verification status and reference, among other information. Stripe explains any biometric processing within that flow; it must be distinguished from ordinary account information.
AI Cloud: prompts, parameters, task identifiers and statuses, cost information and data needed to perform your requested operation. Media is sent from your computer to the selected AI provider. That provider processes the media and may host results under its own terms.
Local software: your scenes, meshes, images, videos, production files and TeamChat conversations remain on the infrastructure you use unless you initiate a transfer, sharing action or support request containing that data.
Support: your contact address, the content of your request and attachments you choose to send. Avoid sending passwords, full payment card details or identity documents to support.
Demo film: the YouTube player loads when you request to watch the film. Google/YouTube then receives the information needed for playback and may use its own tracking technologies. You can read its privacy information before starting the player.
03 · Why use this data?
| Purpose | Legal basis |
|---|---|
| Account creation, software access, access rights and team administration | Performance of a contract or pre-contractual steps at your request |
| Subscriptions, credit purchases and requested AI operations | Performance of a contract |
| Invoices and accounting obligations | Legal obligation |
| Service support and responses to pre-purchase questions | Performance of a contract or pre-contractual steps; legitimate interests for other enquiries |
| Security, abuse prevention and account protection | Legitimate interests in protecting the service and its users |
| Identity and adulthood checks for the relevant Cloud operations | Legitimate interests in preventing fraud; explicit consent where required for biometric processing |
Creating an account requires an email address and the requested authentication information. Billing requires the relevant billing details. An operation cannot be provided without the data needed for it or for a required check. Sending additional attachments to support is optional.
04 · Who receives this data?
Only people authorised by the publisher access the data needed for their duties. Your team administrators may see information needed to manage members, access rights and production expenses.
IONOS provides hosting for the website and SFUMIA services. Stripe handles payments and Stripe Identity handles the relevant checks. The AI provider you select receives the data needed for your generation. Authorised professionals, including accountants, may receive information needed to meet legal obligations.
To confirm before publication: the authentication and email providers actually used in production, their processing regions and applicable subprocessors. The code includes Supabase for accounts and an SMTP service, but their production configuration needs to be verified.
05 · Processing abroad
Some providers, including payment, video and AI services, may process data outside the European Economic Area. Using local software does not mean that Cloud processing stays in France or the European Union.
To complete before publication: for each active provider, identify the countries involved and the applicable transfer mechanism, such as an adequacy decision or standard contractual clauses with any necessary measures. The actual safeguards and signed agreements must be verified; this working draft does not assume that they are already in place.
Each AI provider’s media retention and usage terms also need to be checked. This document does not promise immediate deletion by every provider or exclusion from training without verification of the applicable terms.
06 · Retention and deletion
The following periods were approved as targets to implement on 6 October 2026. They do not describe automatic purges that are already active. Implementation must be tested and documented before a final version of this policy is published.
| Data | Approved target |
|---|---|
| Free account with no subscription, paid entitlements or credits to preserve | Deletion after 1 year of inactivity, with 30 days’ notice allowing the user to keep the account |
| Support requests | 1 year after the request is closed, unless a dispute requires retention of relevant information |
| Routine technical logs | 90 days |
| Logs needed for security | 1 year, except targeted retention justified by an incident or dispute |
| SFUMIA service backups | Rotation and expiry within 30 days; reapplication of deletions after a restore |
Accounts with subscriptions, entitlements or credits are not deleted solely because of a year’s inactivity. Billing data needed to meet accounting obligations must be retained for 10 years. Information strictly needed for a dispute may be archived with restricted access for a period justified by that dispute.
Deleting an account does not delete files stored on your computer or your studio’s server. AI providers’ retention of media and results, and Stripe Identity’s retention of documents, follow their own rules, which must be confirmed for the configurations used. Those periods cannot be inferred from the retention period for your SFUMIA account.
07 · Your rights and requests
Subject to the conditions of the GDPR, you may request access, rectification, erasure, restriction of processing and portability of your data. You may object to processing based on legitimate interests and withdraw consent for future processing without affecting the lawfulness of prior processing.
Send your request to support@sfumia.ai, identifying the relevant account and your request. If there is reasonable doubt about your identity, only the additional information needed to verify it will be requested. Do not send an identity document by email without being asked.
The GDPR provides a response deadline of one month, extendable by two months for complex or numerous requests, with notice of the extension within the first month. Some data may be retained when a legal obligation or applicable exception requires it; the response must explain that limitation.
If your request concerns data managed by your studio on its own server, also contact its administrator. For data processed by Stripe or an AI provider for its own purposes, their rights request channels also apply.
You may lodge a complaint with the CNIL, including through cnil.fr, or with the competent supervisory authority in your country of residence.
08 · Automated checks and security
Payment and identity verification checks may affect access to the relevant purchases or Cloud operations. If a check fails or blocks access, contact support@sfumia.ai to request human review and report an error.
Security measures and access controls must be appropriate for the data processed. The final version must describe only measures actually applied, without claiming absolute protection or a certification that has not been obtained.
09 · Further information
This policy is separate from the purchase and usage terms. Significant changes to processing require an update and, where necessary, direct notification of the people concerned.