Privacy policy.

01Data controller

The data controller is Loshie, publisher of Loshie, whose full details are in the legal notice. For any question about your data: hello@loshie.com.

02The data we process

• Account: first name, email address and language. If you create a password, our authentication provider processes it and stores a hash rather than the plaintext password.
• Sign in with Google: Google sends us your name, email address and profile picture. We never receive your Google password.
• Country: inferred from your IP address when you sign up (only the country is saved in your profile), then replaced by your billing country if you pay.
• Your brand: your website address, the documents, logos, images and texts you upload, your Brand DNA, briefs, creations, and the proposals you keep or pass on.
• Payment: handled by Stripe. We receive your subscription status and invoices, never your card number.
• Usage and security: credits used, and technical logs (IP address, browser, date and time of requests).
• Audience measurement: page views and where visits come from, aggregated and without cookies.

03Why, and on what legal basis

• Providing the service (account, brand analysis, generating and exporting creations, credits): performance of the contract.
• Billing and bookkeeping: legal obligation.
• Protecting Loshie against bots, fraud and abuse (bot check, attempt limits, one Discovery offer per person): legitimate interest.
• Sending emails about your account (confirmation, security, billing): performance of the contract. Telling you about the launch if you asked: consent, which you can withdraw at any time.
• Measuring the site's audience anonymously to improve it: legitimate interest.

04Artificial intelligence

To analyse your brand and generate visuals, we send the information needed for your request to Google's Gemini API, such as your brief, website text, and images or documents you provide. How Google processes and may use that data depends on the applicable service and agreements; we need to verify the actual configuration before guaranteeing that the data is not used for model training.

Do not upload sensitive data or personal information about other people that your creations do not need.

05Our providers

Your data is only accessible to us and to the providers that help us run Loshie, each limited to its role:

• Supabase: database, authentication and file storage, on servers in Frankfurt (European Union).
• Vercel: hosting of the site and the app, cookie-free audience measurement.
• Google: Gemini API (analysis and generation), and Sign in with Google if you choose it.
• Stripe: payment and billing.
• Resend: sending emails.
• Cloudflare: bot check (Turnstile) on account forms.

Some of these providers are based in the United States. These transfers are covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.

06How long we keep data

• Account, brand and creations: as long as your account exists. Once it is deleted, they are erased within 30 days.
• Invoices and accounting records: 10 years, as French commercial law requires.
• Technical logs: a few weeks, unless a security incident is being investigated.

07Cookies and local storage

Loshie only uses cookies it needs to work: your sign-in session, your language choice and the bot check. Stripe's payment pages set their own security cookies. We use no advertising or cross-site tracking cookies, which is why no consent banner is shown.

Your browser also keeps a few preferences locally (for example your progress during onboarding). They never leave your device.

08Your rights

At any time you can ask to access, correct, erase or port your data, or to restrict its processing, object to processing based on our legitimate interest, withdraw your consent, and set instructions for your data after your death. Write to hello@loshie.com: we reply within one month.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority of your country.

09Security

Traffic is encrypted (HTTPS). Each workspace can only be read by its members, which the database checks on every request. Administrative access is personal and restricted.

10Minimum age

Loshie is reserved for people aged 18 or over.

11Changes

We may update this policy. If a change is significant, we will tell you by email or in the app before it takes effect. The date of the last update is shown at the top of the page.