Version 2026-11-02.4

Privacy policy

Prelaunch notice: the operator’s full legal and hosting details are still being completed. Payments are test only.

Who handles your data

Wonderframe is operated by Arthur Bernard André Chevallier, trading as Wonder (Entrepreneur individuel (micro-entreprise), France). See business information for the operator details still to be completed. Privacy contact: [email protected].

What the studio processes and why

Account identifiers, a display name of your choice, verified email when used, password hashes, and security sessions let us provide and secure your account. We record the terms version, minimum age declaration, method and time of signup. We do not ask for a birth date or identity document at signup.

Your briefs, prompts, storyboards, generated source, uploaded references, media, feedback and optional creator preferences provide the creative workspace you request. Credit reservations and test receipts provide usage accounting. The default simulator requests no payment card, billing address or real payment details. Optional Stripe sandbox checkout is hosted by Stripe and must use test information only. It receives a pseudonymous customer reference and the selected offer; provider payment event records stay in the private deployment database. No card details are stored in the studio.

Optional Google sign in shares your verified email, identifier and display name. Optional Instagram connections process access tokens, selected account identifiers, authorized media, available metrics and comments for the insights you request. Instagram passwords remain with Meta. Connect only accounts and upload only material you have permission to use, and avoid unnecessary personal or sensitive data in prompts.

Legal grounds and recipients

Account and creative processing is necessary to provide the service you request. Security and abuse prevention serve legitimate interests. Mandatory legal records rely on applicable legal obligations. Optional account connections require your action and provider authorization; you can disconnect Instagram in Account. We do not bundle marketing consent with signup.

The operator and its configured hosting and email providers process necessary service data. Google and Meta receive data when you choose their connection. A configured generation provider receives the brief, selected references and other inputs needed for a requested generation. Provider destinations and international transfer safeguards must be documented by the operator before enabling a provider in public production. This notice does not claim that every provider stores data in France or the EU.

Retention and security

Workspace data is retained while your account is active, until you request deletion or a specific legal retention requirement applies. Sessions expire after seven days, browser authentication after fifteen minutes, verification links after one hour and password reset links after fifteen minutes. Expired links are unusable; some expired rows are cleared on subsequent authentication activity. Operational logs, local email outboxes, provider copies and backups also require operator review during deletion. No fixed backup expiry has yet been configured.

Passwords are hashed, stored provider tokens are encrypted, and sessions and workspace access are scoped to accounts. These controls do not guarantee that a service can never experience an incident.

Your choices and rights

Contact [email protected] for access, correction, portability, restriction, objection or deletion. Where consent applies, you may withdraw it. Sign in and request deletion from Account, or email from your registered address if you cannot sign in. We aim to respond within one month; a lawful extension or retention exception must be explained to you. You can complain to the CNIL.

Young users

Accounts are for people aged 16 and over. If you are 16 or 17, involve a parent or guardian where required to enter a contract or authorize a purchase. We do not provide accounts for children under 16. Contact us if a younger child has supplied personal data.