Privacy policy

Last updated: June 10, 2026

This policy describes how Caaartoons processes your personal data, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

Data controller

Alex-Adrien Auger — alexadrienauger@icloud.com

Data we collect, and why

• Email address — account creation and magic-link sign-in, linking your credits and your gallery to you. Legal basis: performance of the contract.
• Descriptions you enter (context, characters, scenes) — generating the images you request. Legal basis: performance of the contract.
• Generated images — building your personal gallery. Legal basis: performance of the contract.
• IP address and technical logs — service security and anti-abuse limits. Legal basis: legitimate interest.
• Payment data — handled directly by Stripe (we never see your card); we keep the credit balance and purchase history linked to your email. Legal bases: performance of the contract and legal obligations (accounting).

Cookies

Caaartoons uses a single session cookie, strictly necessary for the service to work (sign-in, form protection). No advertising or analytics cookies are set.

Recipients and processors

• Fly.io (United States) — hosting of the application and images; data is hosted in the Paris region.
• OpenAI (United States) — image generation: the descriptions you enter are sent to it to produce your cartoons.
• Resend — sending sign-in emails (sent from the European Union).
• Stripe — payment processing.

Some of these providers are located in the United States: transfers rely on appropriate safeguards (standard contractual clauses and/or certification under the EU–US Data Privacy Framework).

Retention periods

• Account, image gallery and credit balance: as long as the account is active.
• Session cookie: 30 days.
• Sign-in email link: 15 minutes.
• IP addresses (anti-abuse limits): one hour, in memory.
• Billing records held by Stripe: applicable statutory periods.

Your rights

You have the right to access, rectify, erase, port, restrict and object to the processing of your data. To exercise these rights (for instance, deleting your account and gallery), write to alexadrienauger@icloud.com. You may also lodge a complaint with the CNIL, the French data protection authority (https://www.cnil.fr).

Security

The website is served exclusively over HTTPS; sessions rely on signed cookies that are inaccessible to JavaScript; each gallery is isolated per account. No passwords are stored (magic-link sign-in).