Privacy Policy

Collayz staging environment, Staging deployment - not for public use, is the controller for account and service data. Privacy requests can be sent to [email protected].

• Account data from Clerk, including your user identifier, email, display name, and profile image.
• Subscription records from Stripe, including customer and subscription identifiers. Collayz does not receive full card details.
• Service and security data such as request metadata, error records, and rate-limit events.
• Preferences and local drafts stored in your browser, including language, demo settings, and planner data.
• The portrait cutout tool downloads the Apache-2.0-licensed Xenova/MODNet model and WebAssembly assets from Hugging Face and jsDelivr. Your selected image is processed in the browser, but those asset providers receive ordinary network request data such as your IP address. See the third-party notice.
• If the optional external audio integration is enabled, the video URL you submit is sent to the configured processing service. Media uploads used by the editors are otherwise processed locally in your browser.

We process account and subscription data to provide the service and perform our contract with you. We process limited security and reliability data for our legitimate interest in protecting and operating Collayz. Where consent is legally required, you may withdraw it at any time.

Collayz uses Clerk for authentication, Supabase for application data, Stripe for billing, Hugging Face and jsDelivr for background-removal assets, and its hosting and network providers to deliver the service. These providers may process data outside your country under their applicable transfer safeguards and contractual terms.

Account data is kept while your account is active. When Clerk notifies Collayz that an account was deleted, the corresponding application record and its dependent projects are deleted and an active Collayz subscription is cancelled. Billing and security records may be retained longer where required by law or needed to resolve disputes.

Depending on your location, you may request access, correction, deletion, restriction, portability, or object to certain processing. You may also complain to your local data protection authority. We may need to verify your identity before completing a request.

We use access controls, signed webhooks, encrypted transport, and restricted database roles. No online service can promise absolute security. Material changes to this notice will be dated on this page.