1. Our role

StudioNN Agency S.L. is the controller for account, service, security and billing information. When a client organisation places content or personal data in Aimily on behalf of other people, StudioNN processes that data under the client’s documented instructions.

2. Information we process

We process only the information needed to provide and protect the service.

• Account data, including email address, name, organisation, role and access settings.
• Workspace content, including collection briefs, moodboards, images, audio, documents, product data, decisions, comments and generated outputs.
• Usage and security data, including device and app version, IP address, audit events, crash reports and diagnostics.
• Commercial data, including plan and subscription status and Stripe identifiers. Aimily does not receive card details.
• Integration data and tokens only when an authorised user connects a third-party service.

3. Why we use it

We use this information to operate and synchronise workspaces; authenticate users and enforce permissions; provide AI-assisted workflows; preserve approvals, decision traces, audit history and undo; secure and support the service; administer subscriptions; and comply with law. The legal basis is performance of the service contract, legitimate interests in security and improvement, compliance with legal obligations and, where applicable, the client’s instructions as controller.

4. Artificial intelligence

When a user requests an AI feature, the relevant workspace context may be sent to specialist service providers for inference. These calls produce the requested result and are not used to train Aimily models on client content. Aimily applies data minimisation and, where available, provider controls that exclude training. AI outputs can be inaccurate and remain subject to human review and approval.

5. Service providers and sharing

Aimily uses providers for hosting, databases, AI inference, monitoring, email and billing. These can include Supabase, Vercel, Anthropic, OpenAI, Google, Freepik, Perplexity, Sentry, Resend and Stripe. Connected services such as Shopify exchange data only when an authorised user enables the integration. We do not sell personal data or use it for third-party advertising.

6. Storage and international transfers

Aimily’s primary database is hosted in the European Union. Some service providers may process data outside the European Economic Area. Where this occurs, Aimily uses the transfer basis and safeguards applicable to the provider and the transfer, and makes the relevant information available to client organisations.

7. Retention, export and deletion

Account and workspace information is retained while the service relationship is active and afterwards only for the periods needed for security, legal obligations, dispute handling and reliable backups. Authorised users can request export or deletion. Where Aimily acts as processor, requests concerning data controlled by a client organisation are handled with that organisation.

8. Rights and choices

Depending on applicable law, people may request access, correction, deletion, restriction, objection or portability, and may complain to the Spanish Data Protection Agency or their local authority. Requests can be sent to the address below.

9. Security and eligibility

Aimily uses authentication, per-operation authorisation, ownership checks, encryption in transit and at rest, least privilege, secure secret storage and audit logging. No system can guarantee absolute security. The business service is intended for professional users aged 18 or over. We may update this policy when the service or law changes and will publish the new date here.