1. Introduction
reshaders ("we", "our" or "us") is operated by Revyme, an auto-entrepreneur under French law, and is committed to protecting your privacy. This policy explains how we collect, use, disclose and safeguard your information when you use the reshaders studio and website, in compliance with the EU General Data Protection Regulation (GDPR) and French data protection law (Loi Informatique et Libertés).
2. Information We Collect
2.1 Information You Provide
Account information: when you sign in, the shared account system provides us with your account identifier, email address, display name and avatar. Passwords are never shared with reshaders.
Payment information: if you subscribe to Pro, payments are processed by Stripe. We receive the subscription status and a customer reference; we never receive or store card details.
Communications: support requests, feedback and email correspondence.
2.2 Information Processed in Your Browser
The studio renders your compositions on your own device using WebGL. Your projects, layers and settings are stored in your browser's local storage and are not sent to our servers unless a cloud feature explicitly says so. Exports (code, images, GIFs, videos) are generated on your device.
2.3 Automatically Collected Information
- Server logs: IP address, browser type and version, requested pages and timestamps, kept for security and debugging
- Essential cookies: the session cookie that keeps you signed in and short-lived cookies used during sign-in
We do not use third-party analytics or advertising cookies.
2.4 Information from Third Parties
- The shared account system (sign-in, entitlements)
- Stripe (subscription status for Pro)
3. How We Use Your Information
To provide the service: keep you signed in, know which plan you are on, unlock the exports your plan includes, and answer support requests.
To improve the service: fix bugs, monitor performance and reliability, and understand which features are used, in aggregate.
To communicate with you: service updates and notices about your account or subscription, and marketing communications only with your consent.
To ensure security: prevent fraud and abuse, monitor for security threats, enforce our Terms & Conditions and comply with legal obligations.
4. No AI Processing of Your Data
reshaders does not send your compositions, projects or exports to any artificial intelligence service, and does not train models on your data. Rendering, thumbnails and exports are computed locally in your browser.
5. How We Share Your Information
We do not sell your personal information. We share information only in these circumstances:
- Service providers: hosting, content delivery, payment processing and transactional email, each bound by data processing agreements
- Business transfers: in connection with a merger, acquisition or sale of assets, with advance notice and the opportunity to delete your account
- Legal requirements: to comply with legal obligations, protect our rights and property, prevent fraud or illegal activity, or respond to valid legal requests
- With your consent: when you explicitly authorize sharing
6. Third-Party Service Providers (Subprocessors)
We use the following third-party services to operate reshaders. Each is bound by Data Processing Agreements (DPAs) and Standard Contractual Clauses (SCCs) where applicable:
- Hetzner Online GmbH (Germany) - hosting
- Cloudflare, Inc. (USA) - CDN, DDoS protection and file storage
- Stripe, Inc. (USA) - payment processing and subscription management
- Resend (USA) - transactional emails
6.1 International Data Transfers
Where subprocessors are located outside the EEA/UK, we ensure adequate protection through the EU-US Data Privacy Framework where certified, Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), and adequacy decisions by the European Commission. We may add, replace or remove subprocessors as needed and will update this page when we do.
7. Data Storage and Security
7.1 Where We Store Data
- Account and subscription data: Germany (Hetzner)
- Projects: your own browser, on your device
- CDN/distribution: global (Cloudflare)
7.2 Security Measures
- Encryption in transit (TLS)
- Encryption at rest for sensitive data
- Signed, HTTP-only session cookies
- Access controls and regular access reviews
- Monitoring, automated threat detection and incident response procedures
8. Your Privacy Rights
8.1 Access and Control
You have the right to:
- Access: request a copy of your personal data
- Rectification: correct inaccurate information
- Deletion: request deletion of your data ("right to be forgotten")
- Portability: export your data in a standard format
- Restriction: limit how we process your data
- Objection: object to certain processing activities
8.2 How to Exercise Your Rights
Contact us at hello@revyme.com. We respond within 30 days (45 days for complex requests), as required by GDPR. Because projects are stored in your browser, you can delete them yourself at any time from the dashboard or by clearing your browser data.
8.3 Cookies
We only set cookies that are necessary to operate the service (sign-in and session). You can remove them at any time through your browser settings; doing so signs you out.
9. Data Retention
- Account data: until account deletion, plus 30 days
- Projects: in your browser until you delete them
- Server logs: 90 days
- Security logs: 1 year
- Payment records: 7 years (tax compliance); card data is never stored
- Deleted accounts: soft deletion for 30 days (recoverable), then permanent; backups purged within 90 days
- Marketing communications: unsubscribed contacts kept 3 years to honor the opt-out
You can request early deletion at any time by contacting hello@revyme.com, subject to legal retention requirements.
10. Legal Basis for Processing (GDPR)
- Consent (Article 6(1)(a)): marketing emails and any optional cookies
- Contract performance (Article 6(1)(b)): sign-in, providing the studio and exports, processing payments and managing subscriptions, customer support
- Legitimate interests (Article 6(1)(f)): fraud prevention and security monitoring, service improvement on aggregated data, business administration
- Legal obligation (Article 6(1)(c)): tax and accounting records, lawful requests from authorities, breach notification
You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. For contract-based processing, withdrawal may mean we cannot provide the service to you.
11. Data Breach Notification
In the event of a data breach that affects your personal information we will assess it within 24 hours, notify the supervisory authority within 72 hours of discovery where required, and notify affected users without undue delay by email, with an in-app notice as a backup. We will tell you the nature of the breach, the data affected, the likely consequences, the measures taken and a contact point. You may have a right to compensation if you suffered damage due to a breach caused by our violation of GDPR. To report a security concern: hello@revyme.com
12. Children's Privacy
reshaders is not intended for users under 16. We do not knowingly collect information from children; if we discover that we have, we delete it immediately.
13. International Data Transfers
As a French operator we may transfer data outside the European Economic Area, notably to subprocessors in the United States (see section 6). We use Standard Contractual Clauses for these transfers, verify Data Privacy Framework certification where applicable, and comply with GDPR Chapter V. You may request information about these safeguards at hello@revyme.com.
14. Third-Party Links
Our service may contain links to third-party websites. We are not responsible for their privacy practices, their content or their data collection. Always review the privacy policies of third-party sites.
15. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have additional rights under the CCPA and CPRA:
- Right to know what personal information we collect and how we use it
- Right to delete your personal information
- Right to correct inaccurate personal information
- Right to limit use of sensitive personal information
- Right to opt out of automated profiling decisions
- Non-discrimination for exercising your rights
We collect no sensitive personal information beyond what the sign-in provides; payment details are handled by Stripe and never stored by us. We do not sell or share personal information for advertising. To exercise your rights: hello@revyme.com
16. Changes to This Policy
We may update this policy to reflect changes in our practices, legal requirements, or new features. We will notify you of material changes by email and by a prominent notice on our website. Your continued use after changes constitutes acceptance.
17. Contact Us
Email: hello@revyme.com
Service: reshaders (https://reshaders.com)
Operator: Revyme
Legal Name: Nikita Kofman
SIRET: 89119005000023
Country: France
French Data Protection Authority (CNIL): if you are unsatisfied with our response, you may lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), https://www.cnil.fr, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, +33 1 53 73 22 22. In other EU countries you may contact your local data protection authority: https://edpb.europa.eu/about-edpb/board/members_en
This policy is effective as of the date listed above.