PatronIA attaches great importance to the protection of your personal data. This policy describes what data we collect, why, and how we protect it, in accordance with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679).
01. Data controller
- Identity: Baptiste Gaschet, sole trader (entrepreneur individuel, EI), trading as “PatronIA”
- Address: 3 avenue Pasteur, 49100 Angers, France
- Personal data contact: [email protected]
02. Data collected
We collect the following categories of data:
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Identity | Name, e-mail address | Creating and managing the user account | Contract |
| Authentication | Password (hashed), Google OAuth identifier | Securing access to the account | Contract |
| Body measurements | Bust, waist, hip, lengths, etc. | Generating made-to-measure patterns | Contract |
| Photos | Images uploaded by the user | Reading of the garment by artificial intelligence (type, sleeves, neckline…) and checking by the studio before the pattern is sent | Contract |
| Payment | Processed directly by Stripe (not stored) | Purchase of credits | Contract |
| Messages | Name, e-mail address, subject and text of messages sent via the contact form | Replying to your requests and keeping a record of our exchanges | Legitimate interest |
| E-mails sent | Your e-mail address, the date, the subject and the text of the e-mails we send you (never the login links) | Knowing what we have already written to you in order to follow up your order and reply to your requests | Legitimate interest |
| Technical | IP address, user agent (sessions) | Security and fraud prevention | Legitimate interest |
| Usage | Project history, transactions | Operation of the service | Contract |
Body measurements
The body measurements you enter (bust, waist, hip, lengths…) are used exclusively for making made-to-measure garment patterns. In this purely clothing-related context, they do not constitute data concerning health within the meaning of Article 9 of the GDPR: they are processed on the basis of the performance of the contract, only to generate your patterns, and are never used for any other purpose.
Your bust, waist and hip measurements and, if you have entered them, the skirt length and inside leg are sent to Anthropic to write the sewing instructions for your pattern; no photo is attached to that transmission. To build, check or correct the pattern you have ordered, all your body measurements and your photos are also sent to the studio's assistant, a programme that runs from our servers using Anthropic's service, under the data processing agreement that binds us. Your name and e-mail address are never sent to it. Details of what is sent are given in the section Processors, recipients and transfers.
03. Processors, recipients and transfers
| Provider | Purpose | Location |
|---|---|---|
| Hostinger | Hosting of the application and database | European Union |
| Cloudflare | Content delivery network (CDN), security and TLS encryption of traffic | USA* |
| Anthropic | Artificial intelligence (Claude): reading of the garment photos, writing of the sewing instructions, and the studio's assistant that builds and checks your pattern (photos, analysis, body measurements, choices) | USA* |
| Stripe | Payment processing | USA* |
| Resend | Sending of transactional e-mails | USA* |
| OAuth authentication (optional) | USA* | |
| Sentry | Technical monitoring and diagnosis of application errors | USA* |
| Umami | Anonymous, aggregated audience measurement (no cookies and no individual profile) | EU |
| Independent dressmakers | Making or checking your garment, only at your request or with your consent: pattern, booklet, body measurements and, if needed, photo of the garment | France |
* Transfers outside the EU: Anthropic (United States) — for transmissions via the API, standard contractual clauses of the European Commission incorporated into its data processing agreement; for the studio's assistance, see below. For our other providers located outside the EU, the applicable safeguards (standard contractual clauses or Data Privacy Framework) can be obtained on request from [email protected].
What we send to Anthropic: for reading the garment, your photos (the main view and, if you add them, the back and the detail); for writing the sewing instructions, the description of the garment resulting from that reading, some of your body measurements (bust, waist and hip, and where applicable skirt length and inside leg) and the characteristics of the drafted pattern (pieces, dimensions). The pattern itself is drafted by our pattern-cutting programme, without artificial intelligence.
For the studio's assistance, which builds, checks and, if needed, corrects the patterns ordered, for each of your paid projects: the initial of your name, the photos, the analysis of the garment, all your body measurements, your choices and the status of your order in credits. Never your name, your e-mail address or your payment data.
This assistance runs mainly through Anthropic's API, from our servers. It is then covered by the data processing agreement and the standard contractual clauses described above: the data are not used to train the models, and the files sent are deleted at Anthropic once the order has been processed.
Part of the checking may still go through a Claude account of the studio for which the model improvement option is switched off: these data are not used to train Anthropic's models. This route is not covered by the data processing agreement: Anthropic then processes these data in the United States under its own terms of use and privacy policy. Every reading is logged.
The data sent for reading the garment and writing the sewing instructions are not used to train Anthropic's models: in accordance with the terms of the Anthropic API, they are used only to produce the requested response and are not reused for training purposes.
04. Retention period
| Data | Period |
|---|---|
| User account | Until the user deletes the account |
| Anonymous accounts (trial without registration) | 30 days after the last activity (automatic deletion of the account, photos, body measurements and associated patterns) |
| Projects and photos | Until the account is deleted |
| Body measurements | Until the account is deleted (or the measurement profile, if you delete it earlier) |
| Contact form messages | Until deletion of the account associated with the same e-mail address; without an account, 3 years after the message was sent |
| E-mails we send you | Until deletion of the account associated with the same e-mail address; without an account, 3 years after the e-mail was sent |
| Payment data | Processed and kept by Stripe; accounting records are kept for 10 years. |
| Technical logs | 12 months max. |
05. Your rights
Under the GDPR, you have the following rights:
- Right of access: to obtain a copy of your personal data
- Right to rectification: to change your data from the Settings page
- Right to erasure (right to be forgotten): to delete your account and all your data from the Settings page
- Right to data portability: to receive your data in a structured format
- Right to object: to object to the processing
- Right to restriction: to request restriction of the processing
To exercise your rights, write to us at the dedicated address: [email protected]. We reply within a maximum of 30 days.
Account deletion is also available directly in your settings. It results in the erasure of your data as soon as your account is deleted (account, projects, photos, body measurements, profiles).
07. Security
We implement appropriate technical and organisational measures to protect your data:
- Encryption of communications (HTTPS / TLS)
- Passwords hashed with a secure algorithm
- Database not publicly exposed
- Session tokens with a limited lifetime
- Signature verification for payment webhooks
08. Complaints
If you consider that the processing of your data does not comply with the regulations, you may lodge a complaint with the CNIL:
- Authority: CNIL — Commission Nationale de l'Informatique et des Libertés (French data protection authority)
- Address: 3 Place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07
- Website: www.cnil.fr
If you live in another country of the European Union, you may also lodge your complaint with the data protection authority of your country of residence (Article 77 GDPR).