Privacy Notice
Last updated: July 17, 2026
Who is responsible for your data?
Glowmate is operated by Carmen Rodriguez Portillo, sole proprietor, located at 81 rue Anatole France, 93130 Noisy-le-Sec, France. For privacy requests, contact us at revaagency2024@ik.me.
Data we process
We process the photo you submit, your email address, order and delivery status, and technical security information needed to operate the service. We do not receive or store your card number; payment is handled by Stripe.
Purposes and legal bases
We use your photo, email address and order information to create and deliver your purchase. This processing is necessary to perform our contract with you. We use limited technical and order information to secure the service, prevent fraud, troubleshoot and handle support requests; this is based on our legitimate interests in operating and protecting Glowmate. We retain information where necessary to comply with legal, accounting or tax obligations.
Glowmate does not use customer photos for marketing or to train its own AI systems. OpenAI states that API inputs and outputs are not used to train its models by default; OpenAI may retain limited abuse-monitoring logs under its API data controls.
Service providers
We use Vercel to host the website, Supabase for private storage and order data, Stripe for payment processing, OpenAI to create the profile pictures, and Brevo to send the delivery email. These providers process personal data only as needed to provide their respective services and act as recipients or processors as applicable.
International transfers
Some providers may process data outside the European Economic Area, including in the United States. When a transfer requires a safeguard under applicable law, Glowmate relies on the transfer mechanism made available by the relevant provider, such as an adequacy decision or contractual safeguards. You can contact us to ask which safeguards apply to your order.
Retention and deletion
Your source photo is stored privately and removed after successful generation. Finished images and order-delivery data are scheduled for deletion eight days after delivery; the private download links expire after seven days. Unpaid uploads are scheduled for deletion within 24 hours. If a paid generation fails, its private images are removed after the same eight-day retention period. A minimal payment or support record may be retained only for as long as needed to meet legal obligations or establish, exercise or defend legal claims.
Your choices and rights
You can request access, correction, deletion, restriction, objection, portability, or information about your data by emailing us at revaagency2024@ik.me. We may need to verify your request before acting on it and normally respond within one month. You may also complain to the French data-protection authority, the CNIL, or the authority in your place of residence.
Cookies and similar technologies
Glowmate does not use advertising or audience-measurement cookies. We use only technical functionality needed for the site and secure checkout. Stripe's hosted checkout may use its own strictly necessary security and session technologies. If we add optional tracking in the future, this notice and any required consent mechanism will be updated before it is used.
Automated processing
Glowmate uses AI to generate the images you order and may run technical quality checks on generated images. It does not make decisions producing legal or similarly significant effects about you.
Age and third-party photos
Glowmate is for adults aged 18 and over. Do not upload a photo of another person unless you have their permission and the right to submit it.