Privacy

STUDIO CORE is operated by The White Whale sas, a company incorporated in Italy with registered office at Via Tadino 20, 20124 Milan, Italy — VAT no. IT 13571300964 (the "Operator"). GDPR roles. The Operator acts as a data processor for personal data entered into the platform by each studio (its clients, artists, bookings). Each studio that uses STUDIO CORE acts as the data controller for the personal data it collects from its own clients. The Operator is the data controller only for account-level data (login email, role, payment metadata). The terms under which the Operator processes data on each studio's behalf are set out in the Data Processing Agreement (studio-core.app/dpa), which is part of the Terms of Service. Contact for privacy matters and data subject requests: privacy@studio-core.app — or write to the registered office above.

STUDIO CORE processes the following categories of personal data, strictly for studio management and internal analytics: • Practitioner data: name, email, role, payment parameters, calendar tokens. • Client data collected per appointment: full name, email address, phone number, city, country, year of birth. • Financial data: session prices and deposits. • Consent form data (when signed by the client): tax code, home address, ZIP code, province, ID document type and number, digital signature, and health-related confirmations. • Appointment metadata: date, time, workstation, appointment type, session notes, reference files.

Data is used exclusively for: • Managing bookings and workstation allocation. • Internal analytics and performance tracking. • Sending automated email communications to clients (booking confirmations and aftercare instructions). • Artist-specific client history: each artist can view an aggregated history of their own clients to facilitate repeat bookings. This data is private to the individual artist and is not shared with other artists or studio administrators. • Guest artist tracking: monitoring external artist sessions and social media posting compliance for partnership agreements.

Our integration with Google Services utilises OAuth2 protocols. STUDIO CORE requests restricted access to manage a dedicated calendar created by the application. Tokens are encrypted and stored securely within our Cloud Infrastructure. Users maintain full control and can revoke access via their Personal Parameters.

We utilise LocalStorage technology to maintain UI preferences such as language selection. No tracking cookies are used for marketing purposes. All operational data is stored via Firebase (Google Cloud) with encryption at rest and in transit.

STUDIO CORE offers two optional AI features based on Google's Gemini API (via Genkit), active only when enabled for the service: • Analytics insights: only aggregated, non-personal figures (counts, totals, distributions) are sent — no client names or contact details. • ID document scan in the consent form: a photo of the client's identity document is sent to read the personal details and fill in the empty fields of the form. STUDIO CORE does not store or log the image. Calendar synchronisation and the daily recap email do not use AI. Under Google's terms for the paid Gemini API, which apply to services offered in the EEA, Google does not use prompts or responses to train its models, but may keep them for a limited period for abuse monitoring and legal compliance. Processing takes place on Google infrastructure, including in the United States.

In accordance with GDPR (EU Regulation 2016/679), every data subject — including clients whose data is recorded during appointments — has the right to access, rectify, restrict processing, or request the deletion of their personal data. Data retention is limited to the duration of the professional relationship with the studio, or as required by applicable law for fiscal documentation. Requests may be submitted via the feedback channel within the application or by contacting the studio directly.

To deliver the service the Operator engages the following sub-processors, each bound by data processing terms that comply with Art. 28 GDPR: • Google LLC (Firebase / Google Cloud) — hosting, authentication, database, file storage, scheduled functions. United States (us-central1); some scheduled functions in the EU (europe-west1). • Google LLC (Gemini API) — optional AI features: analytics insights (aggregated, non-personal figures only) and ID document scan in the consent form. Google infrastructure, including the United States. • Resend (Plus Five Five, Inc.) — transactional email delivery. United States; EU sending region (Ireland). • Sentry (Functional Software, Inc.) — error monitoring; error reports can include the signed-in user's ID, email and name. United States or EU. • PayPal (Europe) S.à r.l. et Cie, S.C.A. — recurring subscription billing (studio billing data only). EU (Luxembourg). For transfers to the United States, see "Data location & international transfers" below. The list is reviewed periodically; changes are communicated to studio admins by email at least 30 days in advance, and studios may object as set out in the Data Processing Agreement.

STUDIO CORE runs on Google Cloud (Firebase). Where the data is: • Database (Cloud Firestore) and application hosting (Firebase App Hosting): United States, Google Cloud region us-central1 (Iowa). • File storage (studio logos, booking reference files): Google Cloud Storage, United States (us-central1). • Background functions: those that read the database run in us-central1; some scheduled jobs run in the EU (europe-west1, Belgium) and only trigger tasks in the application, without storing data. • Email delivery (Resend): processed mainly in the United States, sent through Resend's EU sending region (Ireland). • Error monitoring (Sentry): United States or EU, depending on the account's data region. • Optional AI features (Gemini API): Google infrastructure, including the United States. Studio data is therefore stored outside the European Economic Area. These transfers rely on the certification of Google LLC, Resend (Plus Five Five, Inc.) and Sentry (Functional Software, Inc.) under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and, where the providers' data processing terms include them (for example the Google Cloud Data Processing Addendum and the Resend DPA), on the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). A copy of the relevant safeguards is available on request at privacy@studio-core.app.