Privacy Policy

The data controller is the individual operator of Tesla Custom Studio. Privacy inquiries can be sent to hoitchac@gmail.com or via the contact page.

We operate email and Google account registration and process the following information as needed to provide the Service.

• Member information (sign-up / login): Email address, display name, profile photo URL (Google login), sign-in provider (email/Google), account creation time. Stored in Firebase Authentication and Firestore users collection.
• Automatically collected: Access time, IP address, browser/OS, pages visited, referrer URL (via server logs and analytics)
• Cookies: Language preference, ad identifiers, etc. (see Cookies & ads below)
• User input: Text prompts for wrap generation, selected vehicle model, optional reference images
• API keys: For signed-out users, Google Gemini API keys are stored in browser sessionStorage and sent through the Service server to Google when generating images. Keys registered by signed-in users are encrypted on the server using AES-256-GCM and stored in Firestore users documents. Existing session keys are cleared on sign-in. The server decrypts the stored key for image generation. The account key settings show whether a key is registered.
• Gallery content (after consent on download): When you agree to publish on download, the wrap PNG, prompt, vehicle model, author display name, and registration time are stored in Firebase Storage and Firestore gallery collection and may be viewed by other users.
• Gallery activity: Like records (logged-in user UID), download count statistics
• When you contact us: Your email address and message content

• Member identification, login/authentication, and account management
• Providing AI-based vehicle wrap image generation
• Gallery sharing, browsing, likes, and downloads
• Service stability, error analysis, and improvements
• Usage analytics and UX improvements
• Personalized and non-personalized ads (Google AdSense)
• Responding to inquiries and notices
• Legal compliance

Information is deleted without delay after the purpose is fulfilled, except where law requires retention.

• Member information: Deleted upon account deletion request or when the purpose is fulfilled.
• API keys (not logged in): Removed from sessionStorage when the tab/session ends.
• API keys (signed in): Stored encrypted with your account. Key data is deleted from users documents upon a key or account deletion request. Registering a replacement key overwrites the previous key.
• Gallery content: Retained until you delete it on My Page or request deletion. Storage files and Firestore documents are removed on deletion.
• Generation requests (not published): Not stored after processing.
• Access logs: May be retained per hosting provider policy (e.g. Vercel).

We do not sell or arbitrarily share personal information. We use the following services to operate the site.

• Google LLC (Gemini API): Image generation. Prompts, reference images, and API keys are sent to Google. Google Privacy Policy
• Google LLC (AdSense): Ads and performance measurement. Cookies and ad IDs may be used. Google Ads policies
• Vercel Inc.: Hosting and analytics. Access logs may be processed. Vercel Privacy Policy
• Google LLC (Firebase): Authentication, member and gallery data (Firestore), gallery images (Storage). Google/Firebase Privacy Policy

We may use cookies and similar technologies for UX, analytics, and advertising.

You can refuse or delete cookies in browser settings. Manage Google ad personalization at Google Ads Settings. Some features or ad personalization may be limited if cookies are blocked.

You may exercise rights under applicable law including access, correction, deletion, and suspension of processing. Delete gallery posts on My Page. Clear API keys in your browser or request changes to your account key. Account deletion and other requests: hoitchac@gmail.com.

We apply reasonable measures including HTTPS, encrypted server storage of member API keys, authenticated request handling, and least privilege. Any legacy plaintext key is encrypted on first use and its plaintext field is deleted. Complete security cannot be guaranteed on the internet.

The Service is not directed at children under 14 and we do not knowingly collect their personal information.

This policy may be updated with legal or service changes. Updates are posted here with an effective date. Material changes may be announced on the site.