Courtesy translation. This English version is provided for convenience. The French version, available at Politique de confidentialité, is the legally binding one; in case of discrepancy the French text prevails.
Version 2026-09. Data controller: the publisher of the service, identified in the legal notice ("the Publisher"), contact support@broderly.com.
1. What we process, and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account: email address, name if any, technical identifier, sign-in method (email, Google, Apple) | Create and secure your account, contact you for support and service announcements | Performance of the contract | Life of the account + 1 year |
| Billing: name, address, country, payment method (held by Stripe only, never by us), payment history | Subscriptions, invoices, accounting obligations | Contract, legal obligation | 10 years (accounting) |
| Export metadata: format, stitch count, dimensions, design name, date, IP address | Plan usage counting, usage statistics, security, support | Contract, legitimate interest | 24 months |
| Free converter without an account: e-mail address, language, consent to receive our offers if given (date), IP address, number of files sent | Send you the machine file produced; with your consent, send you our offers and news (unsubscribe link in every message) | Contract (sending the file); consent (offers), withdrawable at any time | 3 years after the last file requested; erased on request to support@broderly.com |
| Designs sent for conversion (design content) | Produce the machine file | Contract | Processed in memory, not kept once the file has been produced |
| Reminders (account): e-mail address, language, number of files produced and designs saved, payment started and not finished, unsubscribe date | Offer you the Atelier trial once if you use Discovery without having tried it; send you once the link to a payment you started and did not finish. Unsubscribe link in every message. | Legitimate interest (a single message about a service you use or started to subscribe to), objection possible at any time through the unsubscribe link | Until the account is deleted; unsubscribing applies immediately |
| Projects saved in "My work": design content, name, thumbnail, stitch count, dimensions, format, dates | Find your projects on your account from one device to another (automatic saving while you work) | Contract | As long as you keep them; a deleted project stays 30 days in the bin and is then permanently erased; erased when the account is deleted |
| Assistant (Atelier+ plan): the image or design preview you submit, with the settings and the text of your request | Produce the assistant's answer (colour plan, review, suggested settings, dictated design) | Contract | Sent to the model provider for the duration of the answer, not kept by us; the provider does not use it to train its models |
| Assistant: call metadata (type of service, number of tokens, cost, duration, success or failure, date) | Monthly quota counting, cost tracking, support | Contract, legitimate interest | 24 months |
| Technical logs (requests, errors) | Operation, security | Legitimate interest | 30 days |
| Acceptance of the terms (date, version) | Proof of consent | Legal obligation | Life of the account + 5 years |
| Outline of the pro version (uploaded image redrawn by Recraft), linked to a fingerprint of the image | Showing the pro version next to the free version, and supplying it without charging again if the same image is uploaded again | Pre-contractual steps and performance of the contract | 7 days |
| One-off purchases of the pro version (e-mail address given at payment, amount, files used, IP address) | Supplying the purchased files, receipt, refund | Performance of the contract, legal obligation (accounting) | 10 years |
| Newsletters: for each message sent, its delivery (delivered, bounced, reported as spam), whether it was opened (detected by a small image loaded when it is displayed), the links clicked and when, and purchases made afterwards from those links | Knowing what each newsletter brings; stopping writing to addresses that no longer exist or that reported us as spam | Legitimate interest; you can object by unsubscribing (link in every message) or by blocking automatic image loading in your mail app | 24 months; an address set aside after a bounce or a spam report is kept, with no other data, so that we no longer write to it |
Drawing, preview and quality check take place in your browser. Two processes go through our servers: producing the machine file, for which the design is received, converted and immediately forgotten, and saving your projects in "My work", which keeps the design on your account, hosted in Europe, until you delete it. Background images are never transmitted. You alone have access to your projects; the Publisher only accesses them for support, at your request. A third process only takes place if you open the Atelier+ assistant: the image or preview concerned is then sent to the model provider named below, for the time it takes to produce the answer, and then forgotten. Nothing is sent until you request an assist. The settings, recent projects and preferences saved "for later" stay in your browser's local storage. We neither sell nor rent any data, and we do not use your designs to train anything.
2. Processors and hosting
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | Hosting of the website and the application (static files) | Global content delivery network; static files only, no personal data stored |
| Railway Corp. | Hosting of the API and the database (accounts, projects, export metadata) | Europe (Amsterdam, Netherlands) |
| Clerk Inc. | Account authentication (sign-in, passwords, Google/Apple sign-in) | United States, standard contractual clauses |
| Stripe Payments Europe Ltd. | Payment and billing | Ireland / European Union |
| Anthropic PBC | Atelier+ assistant: analysis of the image or design preview you submit, and drafting of the answer. Analysis of messages sent through the feedback bubble: your message, its technical context and your recent path in the studio (without your address or your design), to help the publisher fix the problem | United States, standard contractual clauses; submitted content is not used to train the models |
| Replicate Inc. | Image processing: clean vector outline of the uploaded image (Recraft) for pro sharpness and the pro version, and, for the Atelier+ assistant, cutting out the subject and redrawing a project from a photo | United States, standard contractual clauses |
| Resend | Sending e-mails (converter files, purchases, newsletters) and tracking their delivery, opening and clicks | Sending from the European Union (Ireland); company based in the United States, standard contractual clauses |
| Google Ireland Ltd. | Audience measurement (Google Analytics), only if you accept it in the cookie banner | Ireland / European Union, with possible transfers to the United States, standard contractual clauses |
| PostHog Inc. | Audience measurement and session recording (PostHog), only if you accept it in the cookie banner | European Union (Frankfurt, Germany), standard contractual clauses |
| Cloudflare Inc. | Anti-bot check (Turnstile) in the sign-in window, loaded by Clerk | United States, standard contractual clauses; receives only the technical data of the challenge (IP address, browser) |
| jsDelivr (Prospect One) | Delivery of the French translation file for the sign-in window | Global content delivery network; receives only the IP address while the file is loaded |
These providers act on our instructions and are bound by data-processing agreements compliant with the GDPR. Transfers outside the European Union rely on the European Commission's standard contractual clauses.
3. Cookies and local storage
No advertising cookies. The following are used without asking for your consent, because the service cannot work without them (exempt from consent within the meaning of article 82 of the French Data Protection Act):
- a session cookie set by Clerk on broderly.com when you sign in, to keep you signed in (absent as long as you have no account);
- the browser's local storage (localStorage and IndexedDB) for your preferences (language, theme, units, machine, hoops), your recent projects and automatic saving, the file dropped from a page of the website before the studio opens, and the fact of having seen the information banner.
Audience measurement. With your consent, given in the banner shown on your first visit, we use Google Analytics (Google Ireland Ltd.) to know which pages are viewed and which lead to the studio. Google then sets cookies (_ga, _ga_*, kept for 13 months at most) and receives the truncated IP address and technical browsing data; the data may be transferred to the United States under the standard contractual clauses. If you decline, or as long as you have not answered, nothing is loaded or measured. You can change your mind at any time: change my choice.
Session recording. With the same consent, PostHog (servers in the European Union) records your visit to the site and the studio: pages viewed, clicks, scrolling, windows opened and an image of the design in progress, as well as technical errors encountered. We watch them to understand where the studio gets in your way and to fix it. What you type in fields (email address, password, texts) and your displayed email address are never recorded; payment takes place at Stripe, outside the recording. When you are signed in, the session is linked to your account number, not to your address. PostHog sets a cookie and a local storage entry (ph_*, kept for 12 months at most); recordings are deleted after 30 days, visit statistics after 12 months. Declining or withdrawing your consent stops the recording immediately.
The fonts of the website and the studio are hosted with the application: displaying a page calls no third-party font server. You can clear cookies and local storage from your browser settings; you will then be signed out and your local preferences will be lost.
4. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to set instructions for the handling of your data after your death. To exercise them, including deletion of the account and of all projects: support@broderly.com. We reply within one month. You may lodge a complaint with the CNIL, the French data protection authority (cnil.fr), in the event of a disagreement.
5. Security
Encrypted connections (HTTPS), signed session tokens with a limited lifetime, strict separation of roles (administration is reserved for superadmin accounts and logged), daily database backups, passwords never stored by us. In the event of a data breach likely to affect you, we will inform you without undue delay.
6. Minors
The Service is not intended for children under 15. A minor may use it with the consent of their legal guardian.
7. Changes
This policy may change; the version in force is dated at the top. Significant changes are announced in the application.
Broderly, published by the company identified in the legal notice.
Updated 2026-10-22.