Privacy Policy · Last updated 8 September 2026
Privacy Policy
This policy explains what data SpineFactory collects when you use the service at spinefactory.com, why we collect it, who processes it, and the rights you have.
SpineFactory (“we”, “us”) is operated by [OPERATOR]. We are the data controller for the personal data described below. Contact: privacy@spinefactory.com.
1. Data we collect
| Category | What | Source |
|---|---|---|
| Account | Email address, display name and profile picture | Google sign-in or the email you register with (via our auth provider) |
| Content | Images you upload, and the symbols, rigs, animations and exports generated from them | You |
| Prompts | The text briefs you write to direct rigging and animation | You |
| Feedback | What you write in the feedback box and the screenshots you attach (a screenshot captures whatever was on your screen — check it before you send), plus the page and tool you were on, your screen size, browser, language setting and the app build | You; the diagnostic context is collected automatically when you send a report |
| Technical | IP address, browser/device info and server logs | Automatically, when you use the site |
| Session | An authentication token stored in your browser to keep you signed in | Your browser (local storage) |
2. How we use it
- To provide the service — cut, rig, animate and export your images, and store your projects.
- To authenticate you and gate access (new accounts are reviewed by an admin before approval).
- To keep the service secure, debug issues and prevent abuse.
- To read and act on the feedback you send us. An AI service summarises each report into a work item for us and may ask you for a missing detail; a person reads every report. We answer by email only when a report needs it.
- To communicate essential account emails (confirmation, sign-in links, password resets).
3. Legal basis (EEA/UK)
We process your data to perform our contract with you (running the service), on the basis of our legitimate interests (security, service improvement), and on your consent where required (e.g. optional communications). You can withdraw consent at any time.
4. Who processes your data (sub-processors)
We use trusted providers to run the service. They process data only on our instructions:
| Provider | Purpose |
|---|---|
| Supabase | Authentication and account database |
| “Sign in with Google” (only if you choose it) | |
| Anthropic and/or OpenAI | AI planning and image generation — your prompts and the relevant image data are sent to generate rigs, animations and assets; feedback reports (your words and screenshots) are sent to be summarised for us |
| Hetzner | Server hosting (EU data centre) |
| Email/SMTP provider | Sending account emails |
Some providers may process data outside the EEA; where they do, appropriate safeguards (e.g. Standard Contractual Clauses) apply.
5. Retention
We keep your account and content for as long as your account is active. When you delete your account or ask us to, we delete your personal data and content within a reasonable period, except where we must retain limited records to comply with law. Feedback reports and their screenshots are kept while we act on them and for a reasonable period afterwards so we can see what was already reported; ask and we delete them.
6. Your rights
Subject to applicable law, you can request to access, correct, delete or export your data, and to object to or restrict certain processing. Email privacy@spinefactory.com and we’ll respond within the time the law allows. You may also complain to your local data protection authority (in Finland, the Office of the Data Protection Ombudsman).
7. Cookies & local storage
We use only what’s necessary to run the service — principally an authentication session stored in your browser. We do not use advertising cookies.
8. Security
Access is gated behind authenticated accounts with admin approval, traffic is served over HTTPS, and your projects are visible only to your account. No system is perfectly secure, but we take reasonable measures to protect your data.
9. Children
SpineFactory is not directed at children under 16, and we do not knowingly collect their data.
10. Changes
We may update this policy; we’ll change the “last updated” date above and, for material changes, notify you. Continued use after an update means you accept it.
11. Contact
[OPERATOR] — privacy@spinefactory.com