Your idea stays yours.

Who is responsible for your data

DeskStudio is the platform through which this service is provided.

What we collect

• Your account email, authentication identifier, and preferred language and country when you create or use an account.
• Your prompts, uploaded references, generated designs, saved projects, and the exact revision approved for an order.
• Your email, selected country, consent, and optional request text when you ask to hear when shipping reaches your country.
• Your email, shipping country, order status, Stripe payment reference, amount, currency, policy versions, and recorded order consents.
• Shipping address and phone number through the payment flow when required for delivery.
• Contact and support messages, plus any optional cancellation reason or feedback you choose to provide.
• Essential security, abuse-prevention, error, email-delivery, and product events such as generating, finalizing, and starting checkout.

Why we use it

We use this data to operate the design Studio, provide your account, create the production file, process payment and refunds, fulfil and support orders, prevent abuse, meet legal obligations, improve reliability, and send only the country-launch notifications you requested.

Legal bases

We process account, design, checkout, order, refund, support, and delivery data to perform the service or take steps you request before an order. We use legitimate interests for proportionate security, fraud prevention, reliability, and aggregate product measurement. We rely on consent for international shipping notifications, optional analytics, experience recordings, and advertising measurement, which you can withdraw. We retain or disclose records where a legal obligation requires it.

Where it is processed

Supabase provides account authentication, database, and private file storage. Stripe processes payment and refund information; DeskStudio does not store card details. Resend delivers account, order, refund, support, and requested shipping-launch messages. Sentry provides essential error monitoring without design prompts, uploaded references, email addresses, request bodies, cookies, or query strings. Meta processes consented PageView events from public pages and coarse contact, product-customization, and checkout-start events for advertising measurement. A production and shipping partner receives only what is needed to manufacture and deliver an accepted order.

Optional analytics, recordings, and advertising

We use first-party necessary cookies to remember your language, country, privacy choices, and an ad-selected design category. With your choice, we use Vercel Analytics and Google Analytics to measure the public site, and a first-party attribution cookie for up to 90 days to remember the first and latest UTM campaign. We copy that campaign attribution onto an order or portfolio request so we can measure results. We use Microsoft Clarity on the public landing page and in Studio for heatmaps and session recordings. All Studio content, including design prompts, uploaded references, conversations, previews, filenames, account details, and order details, is masked before it can be uploaded to Clarity. With separate advertising consent, Meta Pixel measures PageView events on public pages and coarse Contact, Lead, CustomizeProduct, and InitiateCheckout events. It does not send Studio PageView events, prompts, designs, files, account or order identifiers, and it does not run on account, order, support, or admin pages.

Retention

We keep order, payment-reference, campaign-attribution, refund, contact, and support records for the period needed to fulfil orders, measure campaign results, answer requests, meet accounting or legal obligations, and resolve disputes. Contact messages and optional cancellation feedback are included in your account export and are removed or anonymized when an eligible account is deleted. Shipping-interest requests remain until you unsubscribe or ask us to remove them. The campaign-attribution cookie lasts up to 90 days and is deleted if you withdraw analytics consent. Browser-only drafts can be removed by clearing local site data. Optional analytics, recordings, and advertising tools follow the configured provider retention periods described in the privacy controls.

Your choices

You can export eligible account data or request account deletion from your account, unsubscribe from shipping notifications at any time, or ask for access, correction, restriction, objection, or help by contacting team@desk.studio. You can change language and country from the site selector and manage optional analytics, recordings, and advertising measurement from the privacy controls. Some order information must be retained where the law requires it. You may also lodge a complaint with the competent data-protection authority.

Security and changes

We limit operational access and do not store card details. No online system is risk-free. Material changes to this notice will be reflected by a new effective date on this page.