2026-09-13
Privacy
Last updated 2026-09-13. Controller: the DuoShot operator (France / CNIL). This is a product notice, not legal advice.
Data we process
Account data (email, auth identifiers), consent logs, workspace membership, export metadata, and the screenshot files you upload. Vercel Web Analytics records aggregated page views without cookies. No marketing or ads in v1.
Legal bases
Contract (GDPR Art. 6.1.b) for the tool and ZIP. Legal obligation + contract for Stripe invoices. Contract for magic-link email and receipts.
Transfers
Captures and profile data are stored primarily in Paris (Supabase eu-west-3). Vercel, Stripe, Resend and Google OAuth may process data in the US under the Data Privacy Framework / SCCs. List: sub-processors.
Retention
Uploads and ZIP files: 24 hours. Account rows until you delete the account. Stripe keeps billing records as required by law.
Your rights
Access, portability (JSON export), erasure (account delete, target 30 days), objection — from the account page. UK GDPR: same rights. CCPA/CPRA: we do not sell or share personal information for cross-context advertising — Do Not Sell. LGPD: access, correction and deletion if you are in Brazil. Breach: CNIL notified within 72 hours when required. No DPO appointed in v1 (Art. 37 to be reassessed).