Privacy Policy

This policy explains what data SpineFactory collects when you use the service at spinefactory.com, why we collect it, who processes it, and the rights you have.

Operator placeholder — replace with your legal entity, address and a contact email before publishing (search “[OPERATOR]” / “privacy@spinefactory.com”). This document is a solid starting point, not legal advice — have it reviewed for your jurisdiction.

SpineFactory (“we”, “us”) is operated by [OPERATOR]. We are the data controller for the personal data described below. Contact: privacy@spinefactory.com.

1. Data we collect

Category	What	Source
Account	Email address, display name and profile picture	Google sign-in or the email you register with (via our auth provider)
Content	Images you upload, and the symbols, rigs, animations and exports generated from them	You
Prompts	The text briefs you write to direct rigging and animation	You
Technical	IP address, browser/device info and server logs	Automatically, when you use the site
Session	An authentication token stored in your browser to keep you signed in	Your browser (local storage)

2. How we use it

To provide the service — cut, rig, animate and export your images, and store your projects.
To authenticate you and gate access (new accounts are reviewed by an admin before approval).
To keep the service secure, debug issues and prevent abuse.
To communicate essential account emails (confirmation, sign-in links, password resets).

3. Legal basis (EEA/UK)

We process your data to perform our contract with you (running the service), on the basis of our legitimate interests (security, service improvement), and on your consent where required (e.g. optional communications). You can withdraw consent at any time.

4. Who processes your data (sub-processors)

We use trusted providers to run the service. They process data only on our instructions:

Provider	Purpose
Supabase	Authentication and account database
Google	“Sign in with Google” (only if you choose it)
Anthropic and/or OpenAI	AI planning and image generation — your prompts and the relevant image data are sent to generate rigs, animations and assets
Hetzner	Server hosting (EU data centre)
Email/SMTP provider	Sending account emails

Some providers may process data outside the EEA; where they do, appropriate safeguards (e.g. Standard Contractual Clauses) apply.

5. Retention

We keep your account and content for as long as your account is active. When you delete your account or ask us to, we delete your personal data and content within a reasonable period, except where we must retain limited records to comply with law.

6. Your rights

Subject to applicable law, you can request to access, correct, delete or export your data, and to object to or restrict certain processing. Email privacy@spinefactory.com and we’ll respond within the time the law allows. You may also complain to your local data protection authority (in Finland, the Office of the Data Protection Ombudsman).

7. Cookies & local storage

We use only what’s necessary to run the service — principally an authentication session stored in your browser. We do not use advertising cookies.

8. Security

Access is gated behind authenticated accounts with admin approval, traffic is served over HTTPS, and your projects are visible only to your account. No system is perfectly secure, but we take reasonable measures to protect your data.

9. Children

SpineFactory is not directed at children under 16, and we do not knowingly collect their data.

10. Changes

We may update this policy; we’ll change the “last updated” date above and, for material changes, notify you. Continued use after an update means you accept it.

11. Contact

[OPERATOR] — privacy@spinefactory.com