Privacy Policy

Last updated 10 September 2026

1. Scope

L'Atelier UGC Studio is an internal content studio operated by L'Atelier UGC. It is used only by authorised staff to publish to the operator's own social accounts.

It collects no personal data from members of the public, and has no end users other than the operator's own staff.

2. What is stored

• Access tokens for the social accounts the operator connects, obtained through each platform's official OAuth flow.
• Basic profile information of those connected accounts — username, display name, avatar — so the operator can see which account content will be posted to.
• Generated content: images, titles, descriptions and keywords produced by the tool, and the publishing status of each item.

No browsing data, analytics or tracking cookies are collected. The only cookies set are a session cookie for staff sign-in and two preference cookies (which team a staff member works for, and how the analytics page was last arranged).

3. How tokens are protected

Access tokens are encrypted with AES-256-GCM before being written to storage, and the encryption key is held only as a server-side environment variable. Tokens are never sent to the browser, never written to logs, and never shared with anyone.

4. Processors

The tool sends data to these services, and no others:

• Google Gemini — receives the text prompts and the reference images (stock photographs, screenshots supplied by the operator) used to generate content.
• Pexels — searched for reference photographs of a plant; nothing is sent to it but the search terms.
• Supabase — stores the tool's records and sends the one-time sign-in emails to allow-listed staff.
• Vercel — hosts the application and stores generated images.
• Pinterest and TikTok — receive the content the operator chooses to publish, through their official APIs.

No data is sold, and none is shared for advertising purposes.

5. Retention and deletion

Generated content is kept until the operator deletes it from the tool. Access tokens are deleted immediately when an account is disconnected. Disconnecting can also be done from the platform's own settings, which revokes the token independently of this tool.

6. Contact

For any question about this policy, or to request deletion of data held by the tool: poolstudio.apps@gmail.com