2026-09-24
Privacy
Last updated 2026-09-24. Controller: the DuoShot operator (France / CNIL). This is a product notice, not legal advice.
Data we process
Account data (email, auth identifiers), consent logs, workspace membership, export metadata, and the screenshot files you upload. Vercel Web Analytics records aggregated page views without cookies. If you agree, Mixpanel records pseudonymous product events, pages visited and visible time, without screenshots or email addresses.
Legal bases
Contract (GDPR Art. 6.1.b) for the tool and ZIP. Legal obligation + contract for Stripe invoices. Contract for magic-link email and receipts. Consent for optional Mixpanel product analytics; you can change this choice at any time via Analytics preferences in the footer.
Transfers
Captures and profile data are stored primarily in Paris (Supabase eu-west-3). Vercel, Stripe, Resend and Google OAuth may process data in the US under the Data Privacy Framework / SCCs. Mixpanel analytics use an EU project. List: sub-processors.
Retention
Uploads and ZIP files: 24 hours. Derived Studio review JPEGs: 7 days maximum, or earlier if the owner revokes the link. Account rows remain until you delete the account. Analytics events follow the Mixpanel project retention setting and can be deleted upon request. Stripe keeps billing records as required by law.
Your rights
Access, portability (JSON export), erasure (account delete, target 30 days), objection — from the account page. UK GDPR: same rights. CCPA/CPRA: we do not sell or share personal information for cross-context advertising — Do Not Sell. LGPD: access, correction and deletion if you are in Brazil. Breach: CNIL notified within 72 hours when required. No DPO appointed in v1 (Art. 37 to be reassessed).