Your photos are yours.

The data controller is AVA FIRST AI, a French simplified joint-stock company (SAS) and publisher of Clichéo, with its registered office at 173 rue de Courcelles, 75017 Paris, France (SIREN 104 044 201). Contact: contact@clicheo.com.

To create and deliver your cliché, we process:

• the photo or photos you entrust to us;
• your email (to send you your cliché and its tracking);
• your order details (universe, options, delivery address for prints);
• an anonymous account ID (signed cookie) to manage your credits;
• minimal technical data (anti-bot, abuse prevention).

Your data is used only to generate your artwork, process and deliver your order, send you the related emails, and prevent fraud. Legal bases (Art. 6 GDPR): performance of the contract (creation, order, delivery, transactional emails); compliance with our legal obligations (invoicing, accounting); our legitimate interest (service security, abuse prevention, aggregated cookieless traffic statistics). With your consent (Art. 6(1)(a) GDPR): our in-house audience measurement, and measuring and optimizing our ads. If you accept advertising, we send Meta Platforms Ireland, via the Meta Pixel and the Conversions API, the ad click identifier, your IP address, your browser and, when you place an order, your hashed email (unreadable in clear text), the amount and the product ordered. Without consent, nothing is sent.

Source photos: deleted within 30 days at most. Generated artworks: previews are kept for 30 days; ordered artworks are kept for 12 months so they can be reprinted and for support, then deleted. Order and billing data: 10 years (accounting obligation, Article L.123-22 of the French Commercial Code). Anonymous account and credit balance: while the account is active, then 3 years after the last activity. Anti-abuse fingerprint (hashed IP address): 30 days. Audience measurement: 13 months at most. Ad measurement data (click identifiers, UTM parameters): 13 months, then deleted.

Your photos and account data are stored in Europe. We rely on subprocessors needed to run the service and, only with your consent, on an advertising platform:

• Supabase — database and photo storage (European Union);
• OpenAI (United States) — generating the image from your photo. Transfers are covered by the European Commission's Standard Contractual Clauses and the EU–US Data Privacy Framework; data sent through the API is not used to train OpenAI's models and is retained by OpenAI for no more than 30 days for abuse monitoring;
• Stripe — secure payment (where applicable);
• Resend — sending emails;
• Cloudflare Turnstile — anti-bot protection;
• Gelato — printing and shipping of physical prints (network of printers in Europe);
• Vercel Inc. (United States) — website hosting and delivery, anonymized audience measurement (Vercel Web Analytics). Transfers covered by the Standard Contractual Clauses and the EU–US Data Privacy Framework;
• Meta Platforms Ireland Ltd (Ireland): ad measurement (Meta Pixel and Conversions API), only with your consent. Possible transfer to the United States, covered by the EU-US Data Privacy Framework and the standard contractual clauses;
• Prodigi Group Ltd (United Kingdom): production and shipping of Collector blocks, from its workshops in the United Kingdom and the Netherlands. Transfers to the United Kingdom are covered by the European Commission's adequacy decision.

We never resell your photos or your data, and they are never used to train AI.

Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability. To exercise them, write to contact@clicheo.com. You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

Clichéo uses: (1) strictly necessary cookies: your anonymous account ID (signed cookie) and Cloudflare Turnstile anti-bot protection; (2) Vercel Web Analytics, which works without cookies or storage on your device and produces aggregated statistics; (3) only if you accept it, our in-house audience measurement (a session ID stored in your browser and cleared when you close the tab); (4) only if you accept them, advertising cookies and trackers: the Meta Pixel (Facebook, Instagram) in your browser and Meta's Conversions API from our servers, used to measure and optimize the performance of our ads. If we add other ad platforms (TikTok, Google), they will only be activated with your consent, under the same conditions, and this page will be updated. Legal basis: your consent (Art. 6(1)(a) GDPR and Article 82 of the French Data Protection Act). You choose in the banner on your first visit; "Reject all" is as easy as "Accept all", and without your consent no advertising or audience measurement tracker is set and nothing is sent to ad platforms. Your choice is kept for 6 months, then we ask again; advertising cookies last 13 months at most, and ad measurement data is deleted after 13 months. You can withdraw your consent at any time, as easily as you gave it, via "Manage cookies" at the bottom of every page; withdrawal applies to the future.