Privacy Policy
Last updated 29 July 2026
The short version. Your images and video never leave your browser — there is no upload, so we hold no copy of your work. We store your email address, and if you subscribe, what Stripe tells us about your plan. We don't use tracking cookies, we don't run advertising, and we don't sell or share your data with anyone.
1. Who is responsible
The data controller is Sebastian Fioravante, trading as Stasera, of 40 Cecil Road, Hertford, SG13 8HR, United Kingdom. For anything about your data, email seb@stasera.digital.
2. What we don't collect
This is the most important section, so it goes first. Every tool on this site runs entirely in your browser. When you open an image, a photograph or a video clip, it is read by your own machine, processed on your own machine and saved back to your own machine.
Nothing you open in a tool is ever transmitted to us or to anyone else. There is no upload endpoint. We cannot see your work, we cannot recover it for you, and we have nothing to hand over if anyone asks us for it.
3. What we do collect
Your email address, from the tool gate. Before you open a tool we ask for an email. We store the address, which page you entered from, and the time. We use it to send occasional product updates. Lawful basis: consent, which you give by submitting the form and can withdraw at any time by unsubscribing or emailing us.
Your email address, from an account. If you sign in, we store your address so the account exists and so we can send you the sign-in link. Lawful basis: performance of a contract.
Subscription details, if you subscribe. We store your Stripe customer and subscription identifiers, the plan, its status, and when the current period ends. We never see or store your card details — those go directly to Stripe. Lawful basis: performance of a contract, and our legal obligation to keep financial records.
Your IP address, briefly. Requests to our few server endpoints are rate-limited per IP so that automated abuse can't fill our database or send sign-in emails to people who didn't ask for them. Counters are keyed to an IP address and expire within an hour. Lawful basis: legitimate interest in keeping the service working.
Anonymous usage counts. We count events like “a gate was shown”, “an email was submitted” and “an export finished”, as daily totals. These are numbers with no identifier, no session and no payload attached — we can tell that fifty exports happened, not who did them. Lawful basis: legitimate interest in understanding whether the product works.
Aggregate traffic statistics. We may use Vercel Web Analytics, which is cookieless and does not build a profile of individual visitors or track them across sites.
4. Cookies
We use no advertising or tracking cookies, so there is no consent banner on this site. The only cookies we set are:
- Session cookies, once you sign in. They keep you signed in and are required for the account to work. They're set to be unreadable by JavaScript and sent only over HTTPS.
- Stripe may set its own cookies on its checkout and billing pages, governed by Stripe's privacy policy.
We also use your browser's local storage to remember that you've already passed the email gate. That stays on your device and is never sent to us.
5. Who we share it with
We don't sell your data and we don't share it for anyone else's marketing. We use a small number of processors to run the service:
- Vercel — hosting and serving the site.
- Supabase — accounts and authentication.
- Stripe — payments, subscriptions and billing records.
- Upstash — the mailing list store and rate-limit counters.
Some of these may process data outside the UK and EEA. Where they do, that transfer is covered by standard contractual clauses or an equivalent safeguard in our agreement with them.
6. How long we keep it
- Mailing list: until you unsubscribe or ask us to remove you.
- Account and subscription records: for as long as your account exists, then up to six years for financial records, which UK tax law requires.
- Rate-limit counters: minutes to an hour, then automatically deleted.
- Anonymous event counts: 120 days. There's nothing personal in them.
7. Your rights
Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to processing based on legitimate interest. Where processing rests on consent, you can withdraw it at any time. Email seb@stasera.digital and we'll respond within one month.
If you think we've handled your data badly, please tell us first — but you have the right to complain to the Information Commissioner's Office at any point.
8. Children
This site isn't aimed at children under 13, and we don't knowingly collect their data. If you believe a child has given us their email address, email us and we'll delete it.
9. Changes
If we change this policy we'll update the date at the top. If a change materially affects how we handle your data, we'll email you about it.
10. Contact
- seb@stasera.digital
- Controller
- Sebastian Fioravante, trading as Stasera
- Address
- 40 Cecil Road, Hertford, SG13 8HR, United Kingdom