Privacy Policy

Who is responsible

The controller of your personal data is the operator of Klemet, France. For anything in this policy, write to [email protected].

What we collect

Account data: your email address, and the name you choose to give. If you sign in with Google, we receive your email address and your name from Google, and no password.

Content you send: prompts, parameters, and any file you upload for a render.

Content we produce for you: the files a model returns, and the record of each render, its model, its parameters and its price.

Payment data: the amount, the currency, the country of the card and the Stripe identifiers. Your card number never reaches us; Stripe holds it.

Technical data: IP address, browser, and the timestamps of requests, kept in server logs for security and abuse prevention.

Why we are allowed to use it

To perform our contract with you: running your renders, keeping your balance, and charging for what you use.

To meet legal obligations: keeping accounting and payment records for the period French law requires.

For our legitimate interests: keeping the service secure, preventing fraud and abuse, and investigating a report.

With your consent, where we ask for it, and you can withdraw it at any time.

We do not train on what you send

We do not use your prompts, your uploads or your outputs to train, fine tune or evaluate models, and we do not sell them or share them for anyone else to do so.

We do not read your prompts except when you ask us for support, or when we investigate a specific report of abuse.

How long we keep it

Renders and the files they produce are kept so that you can fetch them later. You can delete them, and they go from our storage when you do. Download links are signed and expire after 24 hours.

Account data is kept while your account exists. When you ask us to delete your account, we delete it and the content attached to it.

Payment and accounting records are kept for ten years, which is the retention French commercial law requires. Server logs are kept for twelve months.

Who else processes it

We use the following processors, and nobody else touches your data:

Supabase: Accounts, sign in, and the database. Processing location: European Union.

Cloudflare: Media storage (R2) and bot protection (Turnstile). Processing location: Global.

Modal: The machines that run the models. Processing location: United States.

Stripe: Payments and payment records. Processing location: United States.

Vercel: Hosting for the website and the API. Processing location: Global.

OpenRouter: Text models used by the Studio writer. Processing location: United States.

Comfy: One of the engines behind Studio renders. Processing location: United States.

Pika: One of the engines behind Studio renders. Processing location: United States.

Transfers outside the European Economic Area are made under the European Commission's standard contractual clauses.

Your rights

Under the GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a use, and ask for it in a portable form. You can also object to a use we base on a legitimate interest.

Write to [email protected] and we answer within one month.

If you are not satisfied, you can complain to the CNIL, the French data protection authority, at cnil.fr.

Children

Klemet is not for people under 18, and we do not knowingly collect their data. If you believe a child has an account, tell us and we will remove it.

Changes

When this policy changes in a way that matters, we post the new version here with a new date and tell account holders by email.