Version of 1 November 2026
Version: confidentialite-2026-11-01 · English translation — the French version prevails.
Privacy policy
Updated: 1 November 2026. This policy replaces the draft of 29 September 2026 (2026-09-29-draft-1). It informs you; we do not ask you to "accept" it.
In short
- Your photos are used only to create your portrait. They are sent, without their metadata (GPS location, device), to our artificial-intelligence image-generation provider, in the United States. We do not sell them, do not publish them and do not use them to train our own models.
- Your animal's name, the name of the person shown and your texts (note, tribute) are never sent to the AI provider.
- No advertising, no audience measurement, no promotional emails.
- You can export your data and delete your account yourself, from "Settings".
1. Who is responsible for your data
The data controller is LOOPTECH, Mazen Hammoud EI (Mazen Hammoud, sole trader — *entrepreneur individuel* under French law), who runs Bond: 8 rue Philippe de Metz, 92270 Bois-Colombes, France.
Contact for your data: [email protected]. Bond has not appointed a data protection officer.
2. What we process, why, on what legal basis and for how long
| What you do | Data | Why | Legal basis (GDPR art. 6) | How long |
|---|---|---|---|---|
| You prepare a portrait | Photos of your animal (up to three per animal, metadata removed), name, species, breed, dates for an "In Memory" portrait, style, scene, "Custom Scene" elements, light | To paint the portrait you ask for | Performance of the contract or pre-contract steps at your request (b) | Until you delete them or delete your account, and at the latest 3 years after the last activity. An unfinished upload is deleted after 2 days. |
| You prepare a portrait without an account | A technical cookie (bond_guest) links your browser to your portrait; we keep only a fingerprint of its identifier | To find your portrait in progress | Performance of the contract or pre-contract steps (b) | 30-day session. Portrait data: 90 days after the last activity, or 3 years after a purchase |
| You ask for the free sitting | Your email address, verified through a link valid for 15 minutes. The link signs you in to a Bond space tied to that address (an account without a password) | To start the atelier and let you find your artwork again | Pre-contract steps at your request (b) | The request (with the address) is erased 24 hours after it was created; the Bond space, like an account (below) |
| (same moment) Abuse prevention | An encrypted, non-reversible fingerprint of your email address; for about one day, an encrypted fingerprint of your IP address (never the address itself); the bot-check result, used at the time and not kept | To limit the free sitting to one per person and protect the service, where every sitting has a real cost | Legitimate interest (f): preventing fraud and abuse | IP fingerprint: about 26 hours. Address fingerprint: for as long as the service operates, to keep the free trial unique; it is kept even after the account is deleted, so that deleting an account does not give a new free sitting |
| You create or use an account | Email address, name, language, password (stored as a secure hash) if you choose one; sign-in sessions (with IP address and browser type, as our sign-in library records them) | To let you find your portraits and orders | Performance of the contract (b) | As long as the account exists; sessions until they expire, and they are revoked when the account is deleted |
| "Together" portrait | First name and photos of the person shown; your confirmation for that portrait (type, wording version, date, portrait concerned), with no IP address and no data about your device | To paint the person with your animal; to keep proof of your confirmation | Towards the person shown: legitimate interest (f), yours and ours, supported by your confirmation. For you: contract (b) | Until you remove the person, delete their photos or your account, and at the latest 3 years after the last activity. The record of the confirmation follows the person's entry |
| Your words | Note, place, tribute, inscription (name and years) | To give them back to you with your portrait; to write the inscription on the artwork (with our own software, after generation) | Performance of the contract (b) | With the portrait, until the account is deleted. Never sent to the AI provider |
| Memory capsule | Tribute, voice message (60 seconds at most, if you record one), sharing setting | To keep a memory with the portrait and, if you decide so, share it through a link | Performance of the contract (b) | Until you delete it; permanently erased 30 days later |
| Your likeness feedback | A rating and, if you wish, a comment | To improve our styles | Legitimate interest (f) | Until the account is deleted |
| You order | Name, email, delivery address (printed artwork) or, for the digital file alone, billing country, postcode and town (no street), order content and amount, payment status (a Stripe reference, never your card details), delivery tracking | To perform the sale, apply the VAT of the delivery or billing location, deliver, provide after-sales service | Performance of the contract (b) | For the duration of the order and the guarantees, then archived for the accounting period. When the account is deleted, the order's email and name are anonymised and the addresses erased |
| (same moment) Invoices | Name, email, billing address, amounts | To keep the accounts | Legal obligation (c) | 10 years (article L123-22 of the French Commercial Code); kept even after the account is deleted |
| (same moment) Proof of your acceptances | Version of the terms accepted and the exact text of the terms shown (with its fingerprint), request for immediate supply of the HD file, dates and times, sending of the confirmation email and the moment the file was supplied to you | To prove the contract and your choices | Legal obligation (c) and legitimate interest (f): proof | The duration of the order and of the limitation periods (generally 5 years); 10 years for an order of €120 or more (article L213-1 of the French Consumer Code) |
| You withdraw from the contract ("Withdraw from contract here" function) | Order reference, first and last name declared, email address for the acknowledgment, text of the statement (with its fingerprint), date and time, channel used (account, session or reference) | To record your withdrawal, acknowledge it and refund you | Legal obligation (c) | As for the proof of your acceptances; never changed or erased before the end of that period |
| We email you | Your email address and the content of service emails (sign-in link, portrait ready, order confirmation, withdrawal acknowledgment, shipping, delivery, password reset) | To inform you about your service | Performance of the contract (b) | Our sending log keeps neither the address nor the content. Bond sends no promotional email |
| You write to us | Your messages and ours (at [email protected]) | To reply, to handle a complaint | Performance of the contract (b); legitimate interest (f) | 3 years after the last exchange |
| You browse | Technical logs (method, page address, status, duration — no IP address and none of your texts); request rate limiting (IP address held in memory for the limiting window, seconds to minutes); audit log of administration actions | Security and proper operation of the service | Legitimate interest (f): security | Logs: 30 days at most. Audit log: 12 months |
| Backups | Copies of the database | To be able to restore the service | Same bases as the copied data; legitimate interest (f): security | 30 rolling days |
Required or optional. At least one photo of your animal is needed to paint a portrait; for a "Together" portrait, the first name, at least one photo of the person and your confirmation; for the free sitting, an email address; for an order, your email, your name and, for a printed artwork, the delivery address; for the digital file alone, the billing country, postcode and town (they decide the VAT that applies). Everything else (breed, dates, note, place, tribute, voice message, feedback) is optional.
What happens only in your browser. The photo of your wall used by "See it on my wall" and the name you type in the "Write their name" preview on the home page stay in your browser: they are neither sent to Bond nor stored.
3. Artificial intelligence
- Your photos (and, for "Together", those of the person shown) are sent to the image-generation provider with a scene description written by the atelier. That description contains no first name, no name and none of your free text: subjects are described anonymously ("the dog", "the person").
- The model used is run by a third party through that provider (see section 6).
- There is no recognition or identification of people: we extract no biometric face template. No decision with legal effects on you is taken automatically.
- We do not use your photos to train our own models. According to its documentation, the generation provider deletes the data of an API request after one hour; its contractual commitments on retention and use of your photos: —.
4. The person shown in a "Together" portrait, and minors
- We receive a person's photo only if you confirm, for that specific portrait, that you are that person, that you have their permission, or that you are the legal guardian of the minor shown or have the required authorization.
- We never infer age from a photo and never ask for an ID.
- A notice is written for the person shown: "Your photo in a Together portrait" (/privacy/together). Please pass it on to them. They can write to us to exercise their rights; the quickest way is still to ask you to remove them from the portrait (their photos are then deleted).
- In your animal's photos, avoid people in the background: the atelier does not need them.
5. An animal that has died
The tribute and dates you write for an "In Memory" portrait may touch on a personal moment. They are optional, never sent to the AI provider, visible only to you (and to the people you share a capsule with) and deleted with your account.
6. Who receives your data
Only the people at Bond who need it have access, together with our providers, each for its own task and under a contract:
| Provider | Task | Data received | Where |
|---|---|---|---|
| Replicate, LLC | AI generation of the studies (and enlargement of the file for some prints) | Reference photos without metadata, anonymous scene description | United States. According to its documentation, the data of an API request is deleted after one hour. |
| Google LLC, provider of the model used (Nano Banana 2) | Running the model, if it is operated by Google through Replicate | The same, through Replicate | United States |
| Cloudflare, Inc. (R2 storage) | File storage: photos, studies, artworks, print files, voice messages | These files | Files stored in the European Union (Cloudflare R2 "EU" jurisdiction); Cloudflare is a US company |
| Cloudflare, Inc. (Turnstile) | Bot check when you ask for the free sitting | IP address, technical connection fingerprint (TLS), browser type, site concerned | Cloudflare's global network. Cloudflare also uses these signals, as a separate controller, to improve its bot detection (see its Turnstile policy) |
| Stripe (Stripe Payments Europe, Limited, Ireland, and Stripe, LLC, United States) | Payment and fraud prevention | Amount, email, name, payment details entered with Stripe, technical information needed for the payment | European Union and United States. Stripe is also a controller of its own processing (fraud prevention, legal obligations) |
| Resend (Plus Five Five, Inc.) | Sending service emails | Email address, email content, sending logs | Emails sent from the European Union, but data stored in the United States (content, logs, metadata) |
| Prodigi Group Ltd (United Kingdom) and its network of partner workshops | Making and shipping printed artworks | Recipient's name and address, print file | United Kingdom; our orders are made in a partner workshop located in the European Union (the workshop depends on the country of delivery) |
| Carriers chosen by Prodigi | Delivery | Recipient's name and address | Delivery country |
| — | Hosting of the website, the application and the logs | All data processed by the application | Germany (Hetzner, Nuremberg data centre), in the European Union |
| Hetzner Online GmbH | Database | Account, portrait and order data | Germany, Nuremberg datacenter |
| Cloudflare R2 | Encrypted backups | Database copies | European Union jurisdiction |
If you share a memory capsule through a link, anyone who has the link sees its content (animal's name, years, portrait, tribute, voice message) until you revoke the link. These pages are not indexed by search engines.
We do not sell or rent your data. We may have to disclose it to an authority that lawfully requests it.
7. Transfers outside the European Union
Some providers are established or store data outside the European Union. Each transfer relies on one of the safeguards provided by the GDPR:
- United States:
- Stripe (Stripe, LLC), Cloudflare (Cloudflare, Inc.) and Google (Google LLC) are certified under the EU–US Data Privacy Framework, recognised by the European Commission's adequacy decision of 10 July 2023; their contracts also include the Commission's standard contractual clauses. Stripe: processing governed by the DPA applicable to Stripe services. Cloudflare: processing governed by Cloudflare's Data Processing Addendum.
- Resend (Plus Five Five, Inc.): the Commission's standard contractual clauses, complemented by its certification under the same framework. Processing governed by Resend's Data Processing Addendum.
- Replicate (Replicate, LLC): —
- United Kingdom (Prodigi): European Commission adequacy decision, renewed in December 2025 until 27 December 2031. If an order had to be made outside the European Economic Area and the United Kingdom, Prodigi's contract provides for standard contractual clauses. Processing governed by Prodigi's Data Processing Addendum.
You can obtain a copy of the applicable safeguards by writing to [email protected].
8. How long, and backups
Retention periods are given in the table in section 2. When data is deleted, it remains in the backup copies made before its deletion until those copies expire (30 rolling days); if a backup ever had to be restored, the deletions made in between would be applied again before the service is put back online. We keep a record of account-deletion requests so that we can do this.
9. Your rights
You can ask for access to your data, its rectification, erasure, restriction of its processing and its portability, and you can object to processing based on our legitimate interest. You can also set instructions on what happens to your data after your death.
- From your account ("Settings"): export your data and request deletion of your account.
- While a "Together" portrait is being prepared: remove the person shown (their photos are deleted).
- For any other request: [email protected]. We reply within one month. We may ask you to confirm your identity if we have reasonable doubts.
Some data cannot be erased while a legal obligation requires us to keep it (for example invoices).
If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority: online at www.cnil.fr/fr/plaintes, or by post to CNIL, Service des plaintes, 3 place de Fontenoy, 75007 Paris, France. It is best to write to us first. If you live in another EU country, you can also contact the data protection authority of your country.
10. Cookies
Bond only uses cookies needed for the service; no advertising or audience-measurement cookies. Details are on the Cookies page.
11. Security
Files are accessed through temporary signed links, storage is private, photo metadata (including GPS location) is removed, passwords are never stored in clear, logs contain none of your texts, connections are encrypted (HTTPS), and payment happens without your card details passing through Bond.
12. Changes
If this policy changes, we update the date and the version identifier at the top of the page; for a significant change, we let you know by email or on the website.