Privacy Policy

Last updated: August 21, 2026

This document was written by the operator, not by a lawyer, and is pending legal review.

Who we are

Nico Winter, Ottawa, Ontario, Canada ([entity to be confirmed]). We are the organization responsible for personal information collected through Bad Vibes Studio.

What we collect

• Account information: name, email address, password (stored only as a salted hash), and your subscription/credit history.
• Content you upload: reference images, and photographs of clients’ bodies where you choose to upload them for cover-up or placement work.
• Your clients: the name you give a client and any notes you type against them, so their boards and consultations stay attached to one person across a year of sittings. Nothing else — the Service does not ask for a phone number, an email address or an appointment and has nowhere to put one.
• Recorded consultations: the audio you record in the app, the transcript we turn it into, and what we derive from that transcript — a summary, design briefs, and reference search phrases. This is a recording of somebody who is not our customer; see below.
• Generated designs and the settings used to produce them.
• Bandit chat: when you message Bandit, the in-app design helper, we store your recent conversation with it — your messages and its replies, and any design you attach — so it can follow the thread across a session. It is stored per account, never shared with other studios, and never used to train models. It is deleted when you close your account.
• Usage records: which generations you ran, when, and what they cost — we keep these for billing accuracy and fraud prevention.
• Payment information: handled entirely by Stripe. We never see or store your card number.

What we do with it

Operate the Service, generate your designs, bill you, prevent abuse, provide support, and review generated output to fix and improve the tool and to settle disputes about who made what (see Your designs — who can see them, below). We do not sell personal information. We do not use your uploads or designs to train AI models, and we do not share your work with other users.

Who we share it with

Only the service providers needed to run the product: Google (Gemini AI models) and fal.ai for image generation; Google again for consultations — the recording is sent to Gemini to be turned into text, and that text is sent back to Gemini to produce the summary, the design briefs and the search phrases; Supabase for database and file storage; Render for hosting; Stripe for payments; Resend for email. These providers process data on our instructions. Some are located in the United States, so your information may be stored or processed outside Canada and may be accessible to foreign authorities under the laws of those countries.

Your designs — who can see them

Straight answer: we can. The operator of this service can open the designs the tool generated for you, from an admin page no other user can reach. We are telling you this here rather than letting you assume otherwise.

There are two reasons, and they are the only two:

• To fix and improve the tool. If the engine is producing bad linework, we have to look at what came out to know that. Acting on a bug report about a design we cannot see is guessing.
• To settle a dispute about who made what. Every generated image has a record behind it — which account generated it, the exact time, the job, the settings, and the brief that produced it. If somebody claims your work is theirs, that record is how you show it is not.

What this does not mean:

• We do not use your designs to train AI models. Not ours, and not anybody else’s.
• We do not share them, publish them, or show them to another user.
• Your client photographs are not included. They are not on that page, they are not linked from it, and no admin screen in this product will open one. Cover-up and on-body previews are left out of it too, because those images are drawn on a real person’s skin.
• Consultation recordings, transcripts, client names and client notes are not included either. The admin sees how many you have, never what is in them.
• Every time an operator opens an artist’s work, that access is logged, so “we only look when we need to” is something that can be checked rather than only promised.

If that is not acceptable to you, this is not the right tool for you — tell us and we will close the account and delete the work.

Client photographs — please read

If you upload a photograph of a client’s body, you are responsible for having that client’s consent. We recommend you obtain it in writing. We treat these images as sensitive: they are stored in a private, per-account area, served only to your logged-in session, and deleted automatically 90 days after upload. That is unconditional — saving the photograph into a client’s reference board does not extend it. The design we made from the photograph is yours and stays; the photograph of the person does not.

How we know one photo from another: we treat an image as a client photograph when you use it as one — you put it on the cover-up platter, you give it the body photo role on a board, or you run an on-body preview against it. Everything else is a reference. If you have uploaded a photograph of somebody and never told the app what it was, use it as a body photo once or email us and we will clear it.

Recorded consultations — please read

If you record a conversation with a client, you are responsible for telling them and having their agreement before you press record. We recommend you get it in writing. Recording a conversation without the other person’s knowledge is a criminal offence in some places; that is your call to make where you work, and nothing in this app makes it for you.

We treat the recording as the most sensitive thing this product ever holds. It is sent to Google to be turned into text, and the audio is deleted as soon as it has been transcribed — in practice within seconds. There is no way to play it back and no way to download it; we did not build one. If a transcription fails and leaves a recording behind, it is deleted within 7 days whatever happened. The transcript is what stays, because that is what is useful to you in session four. Deleting a consultation deletes its transcript; deleting a client deletes every consultation attached to them.

How long we keep things

• Account and billing records: seven years (tax law).
• Photographs of clients: 90 days from upload, always, whatever you have done with them in the meantime.
• Reference images: 90 days from upload — unless a saved board still uses one, and then for as long as that board does. A sleeve runs over a year of sittings and a board that has gone to dead squares is worth nothing. Take an image out of the board, or delete the board, and it goes back to ageing out on its own.
• Consultation recordings: deleted the moment they are transcribed, and never kept longer than 7 days.
• Consultation transcripts, client names and notes: until you delete them or close your account. There is no clock on these — the point of them is that they are still there a year later.
• Generated designs: until you delete them or close your account, then 30 days. The full-size file of an archived design you never starred is dropped after 90 days and its thumbnail kept, so your history stays readable without us storing every render forever.

Backups may lag deletion by up to 30 days.

Security

Passwords are hashed (PBKDF2, 240,000 iterations). Sessions use signed cookies. Files are stored in private buckets and served only after an ownership check. AI provider keys are held on a separate non-public server. No system is perfectly secure; we will notify affected users and the Privacy Commissioner of Canada of a breach that creates a real risk of significant harm, as PIPEDA requires.

Your rights

You may access, correct, or delete your personal information, withdraw consent, or ask what we hold. Email hello@badvibes.ca; we respond within 30 days. If you are unsatisfied you may complain to the Office of the Privacy Commissioner of Canada. California residents: you have the right to know, delete, and opt out of sale — we do not sell personal information.

To delete your account outright, see Data Deletion.

Children

The Service is not for anyone under 18.