This policy explains how Sizewright handles personal data when you visit the Sizewright website, use the platform, buy from us or review banners through an approval link. It applies from October 16, 2026. We collect what we need to run Sizewright, we do not sell personal data, and we use no advertising cookies or trackers.
Who is responsible
Sizewright is the controller for the personal data described in this policy, except where the policy says we process data for a customer.
- Controller
- Sizewright
- Privacy questions
- support@sizewright.com
- Other questions
- hello@sizewright.com
When we process data for our customers
Customers put content into Sizewright: briefs, brand kits, images, CSV files, comments and banners. That content can contain personal data, such as people in photos, names in a brief or a client’s contact details. For that data, the customer decides what happens with it and we process it on their behalf, as their processor. Business customers agree to this in our data processing agreement.
The same applies if you review banners through an approval link. You give your name and email address once, and your browser keeps them in a cookie on that page so you do not have to type them again. Your comments and decisions, with your name and email address, are shown to the workspace that shared the link, which is responsible for them. If you have a question about that data, please ask that workspace first; we help them answer it.
What data we collect
Account data
Your name, email address and password, or the link to your Google account if you sign in with Google. Your language, time zone and two-factor authentication settings. Which version of the terms and this policy you accepted, when, and from which IP address.
Workspace data
The workspaces you belong to, their names and settings, your role, the invitations you send or receive (including the email address of the person invited), your notification preferences, and the plan, seats and white-label settings of the workspace.
Billing data
Your billing name, company name, address and VAT number, whether you buy as a business or as a consumer, your request to start right away (for consumers), the plans and credit packs you buy, payments, refunds, invoices and the credit transactions of your workspace. Card details go directly to Stripe; we never see your full card number.
Content
Everything you put into Sizewright and everything it makes for you: briefs, brand kits (logos, colors, fonts, voice, legal lines, website address), uploaded images and files, CSV files, the content of a website you ask us to import, concepts, copy, generated images, banners, their version history, comments, mentions and approval decisions.
Usage data
What you do in the platform: the actions and jobs you start, their status and their cost in credits, exports, notifications, feedback you give on results, and milestones such as signing up, confirming your email address and your first purchase, which we count to understand how people start with Sizewright.
Device and log data
Your IP address, browser and device type, the times of your requests, and your sign-in sessions, which you can see in the device list in account settings. Security events, such as a sign-in from a new device, a password or email change, a change to two-factor authentication or an action by our staff, are recorded in an audit log.
Communications
Emails you send us and our replies. A record of the emails we send you: which email, to which address, in which language and whether it was delivered, but not its content. If you subscribe to product news, the record of your consent and its confirmation.
Visiting the website
When you visit our website, Cloudflare, our hosting provider, processes your IP address and the details of your request to deliver the pages and to protect them against attacks and automated abuse. Cloudflare Web Analytics counts page views for us without cookies and without recognizing you on a later visit. If you choose a language in the bar that suggests a page in your language, your browser remembers that choice.
Cookies
Only strictly necessary cookies, described in the cookie policy.
Data we receive from others
- Google, if you sign in with Google: your name, email address, whether Google has verified that address, and your profile picture if you have one.
- Stripe: the status of your payments and the billing details you enter at checkout.
- Other customers: a workspace owner or admin who invites you gives us your email address, and a workspace may include your name or other data in its content.
Why we use data and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and running your account and workspaces, providing the service and processing jobs | Account, workspace, content and usage data | Performance of the contract (Art. 6(1)(b)) |
| Taking payments, issuing invoices, granting and tracking credits | Billing, workspace and usage data | Performance of the contract; for keeping invoices and tax records, a legal obligation (Art. 6(1)(c)) |
| Recording acceptance of the terms, consumers’ requests to start right away, withdrawals and cancellations | Account and billing data, IP address | Legal obligation; legitimate interest in being able to show what was agreed (Art. 6(1)(f)) |
| Service emails, such as verification, receipts, finished work, approvals, low credits and renewal reminders | Account, workspace and usage data | Performance of the contract |
| Protecting accounts and the platform: email verification, two-factor authentication, bot protection, rate limits, the breached-password check, security emails, security and audit logs | Account, device and log data | Legitimate interest in security; legal obligation to secure personal data (Art. 32) |
| Screening briefs and uploads for acceptable use | Content and workspace data | Legitimate interest in preventing illegal and harmful use |
| Preventing payment fraud and handling payment disputes | Billing, device and log data | Legitimate interest; legal obligation |
| Support, including looking into your workspace when you ask for help | Account, workspace, content and communications | Performance of the contract; legitimate interest |
| Measuring and improving quality, reliability and costs | Usage data, job results, feedback | Legitimate interest in a reliable and affordable service |
| Rating a sample of banners for quality review, when your workspace allows it | The banners, their format and language, what they promote | Consent of the workspace (Art. 6(1)(a)), given and withdrawn in its settings |
| Counting website visits without cookies | Page views, not linked to a person | Legitimate interest |
| Product news emails | Name, email address, language | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Complying with legal requests and establishing or defending legal claims | The data relevant to the case | Legal obligation; legitimate interest |
What you have to provide
To create an account, you need to give your name, an email address and a password, or sign in with Google. To buy, you need to give billing details, because we must issue invoices and calculate tax. Without this data, we cannot provide the account or the purchase. Everything else, such as your time zone or the content you upload, is up to you.
How we weigh legitimate interests
Where we rely on legitimate interests, we have checked that the interest is real, that the processing is necessary for it, and that it does not override your interests and rights. We keep such processing narrow: IP addresses in sessions are cleared after 90 days, quality measurement looks at jobs and results rather than at people, and website statistics use no cookies and do not identify visitors. You can object to processing based on legitimate interests at any time (your rights).
How AI processes your content
Sizewright uses AI models to read briefs, direct concepts, write and translate copy, analyze brands, generate and edit imagery and check quality. AI never renders the finished banner: text, logos and layout are composed by Sizewright’s own engine.
What goes to which provider
- Anthropic (the Claude models) receives the text and images a step needs: your brief, the details of your brand kit, the text and a screenshot of a website you ask us to import, images that need to be inspected, and renders of banners for the quality review.
- fal.ai, and the image models it runs for us, receive image prompts and the images to be edited, extended, cut out or upscaled, which can include images you uploaded. Depending on the model, fal.ai runs it itself or passes the request to the model’s developer.
- Unsplash and Pexels receive search terms for stock photos, taken from your brief. We send them no personal data. When your browser shows one of their photos, it loads the photo from their servers, which then see your IP address.
Each provider receives only what the step needs. We never send account email addresses or billing data to AI providers, and we send content only to perform the work you asked for.
No training on your content
Under their commercial terms, the AI providers we use do not train their models on the data we send them through their APIs. We do not train our own models on your content.
Retention at the providers
We ask fal.ai not to store the inputs and outputs of our requests, and the files it generates for us expire after one day; we copy what we keep into our own storage. Anthropic keeps data sent through its API only for the limited period set out in its commercial terms and data processing terms. Details per provider are on the subprocessors page.
Marking AI-generated images
The platform labels AI-generated imagery. Exported images and videos (PNG, JPG, WebP, AVIF, GIF and MP4) that contain AI-generated imagery carry a machine-readable mark saying so (the IPTC/XMP digital source type), as the EU AI Act asks for synthetic content.
Automated decisions
Every brief and upload is screened automatically by an AI model against our acceptable use policy. The screening can block a brief, or let it run while marking it for a person to look at. A blocked brief costs no credits, and the platform tells you why it was blocked.
This screening decides only whether a piece of content is generated. It does not make decisions about you that have legal effects or similarly significant effects in the sense of Article 22 GDPR. Blocked and marked briefs go to our team for review, and a workspace with three blocked briefs within 90 days is flagged for review by a person. Decisions to suspend an account or a workspace are taken by people. If you think a brief was blocked wrongly, write to support@sizewright.com and a person will look at it.
Who receives your data
- Our subprocessors: the providers for hosting, database, payments, email, AI and stock photo search, listed with their purpose and location on the subprocessors page. They process data only on our instructions.
- Stripe also uses payment data for its own purposes, such as fraud prevention and its legal obligations as a payment provider. Stripe’s privacy policy applies to that use.
- Google, if you choose to sign in with Google.
- The breached-password check: when you set a password, we check it against passwords known from data breaches, using the Have I Been Pwned service. Only the first characters of a hash of the password leave our systems, never the password itself.
- Other people in your workspace see your name, email address, role and what you contribute. Reviewers who receive an approval link see the banners it covers and the replies to their comments.
- Our support staff can look into a workspace when that is needed to help you or to investigate a problem. They must record a reason, each session ends after at most 60 minutes, they cannot change billing or delete anything during it, and every session is logged.
- Our quality team may rate a sample of your banners from 1 to 5, if an owner or admin of your workspace allows quality review in the workspace settings. It is off unless you allow it, covers banners made from then on, and stops at once when you stop it. Reviewers see the banner with its format, language and what it promotes, not your workspace’s name; the ratings are used only to measure and improve our quality checks.
- Authorities, such as the tax authority, courts or the police, when the law requires it, and our professional advisers, such as accountants and lawyers, who are bound to confidentiality.
- A buyer or successor, if all or part of our business is transferred. We tell you in advance.
We do not sell personal data, and we do not share it with advertising networks.
International transfers
Our database is in the EU (Frankfurt) and our file storage is in the EU. Some providers are based in the United States or process data there, and Cloudflare serves the website from locations around the world. When personal data leaves the European Economic Area, we rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for providers certified under it, or on the European Commission’s Standard Contractual Clauses, with additional safeguards where needed. The subprocessors page lists the mechanism for each provider. You can ask for a copy of the safeguards at support@sizewright.com.
How long we keep data
We keep personal data only as long as we need it for the purposes in this policy. The periods below are applied automatically where the table says so.
| Data | How long we keep it |
|---|---|
| Account data | As long as your account exists. A deleted account is removed 14 days after you delete it, by a daily job. Sign in during those 14 days to keep it. |
| Workspaces and their content | As long as the workspace exists. When a workspace is deleted, its records are removed at once and its stored files within the hour. |
| Files deleted from a library | Removed 30 days after deletion, unless a live banner still uses them. They then stay as long as that banner does. |
| Unfinished uploads | 1 day |
| Rejected uploads | 7 days |
| Previews that nothing uses anymore | 1 day |
| Data export files (ZIP) | 7 days |
| Sign-in sessions | Up to 30 days without use. The IP address and browser details of a session are cleared after 90 days. |
| Audit log | 1 year |
| Invoices and tax records | 7 years, as Dutch tax law requires |
| Records of accepted terms, consents, withdrawals and cancellations | As long as we need them to show what was agreed, and no longer than claims about it can be brought |
| Records of emails we sent you | As long as we need them to answer questions about delivery and to show that required notices were sent |
| Your emails to us | As long as we need them to handle your question and any follow-up |
| Backups | Roll off within 30 days |
Data that we are required to keep, such as invoices, stays after your account is deleted, for the period the law sets.
How we protect data
We protect personal data with technical and organizational measures that match the risk, including:
- connections over HTTPS only, with HSTS, a strict content security policy and other security headers;
- passwords of at least 10 characters, checked against passwords known from data breaches, and email verification;
- two-factor authentication with an authenticator app and backup codes, required for our own staff;
- sessions in secure, HTTP-only cookies, a device list with sign-out per device or everywhere, and a fresh password check for sensitive actions;
- bot protection and rate limits on sign-up, sign-in, password reset and email changes, and security emails for sign-ins from new devices and changes to your password, email address or two-factor settings;
- permission checks on the server for every request, so a workspace’s data is only reachable by its own members;
- approval links with long random tokens that we store only as hashes, with an expiry date, optional password and revocation;
- checks on every upload: size limits, file type detection from the content, image decoding, cleaning of SVG files and validation of fonts;
- banner previews that run in a sandbox;
- encryption at rest for the database and file storage, both in the EU, and point-in-time backups of the database;
- logs without passwords, tokens or card data, and an append-only audit log;
- secrets kept out of the code, and regular updates and security audits of the software we depend on.
If a personal data breach happens, we assess it within 24 hours, notify the Autoriteit Persoonsgegevens within 72 hours where the law requires it, and inform you without undue delay if the breach is likely to pose a high risk to you. More about our security measures is on the security page.
Your rights
Under the GDPR, you have the right to:
- access the personal data we hold about you and receive a copy;
- rectification of data that is wrong or incomplete;
- erasure of your data, unless we must keep it, for example invoices;
- restriction of processing, for example while we check a complaint about accuracy;
- data portability: receive your data in a structured, machine-readable format, or have it sent to another provider where that is technically possible;
- object to processing based on legitimate interests, and at any time to direct marketing;
- withdraw your consent at any time, without affecting processing that took place before;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you.
How to use your rights
Much of this you can do yourself in the platform:
- A copy of your data: in account settings → Your data, download a JSON file right away with your profile, sign-ins and devices, the consents you gave, the emails we sent you, and the brand kits and campaigns of the workspaces you own. You can also have your files prepared: everything uploaded to the workspaces you own and the images made for their campaigns, in a ZIP file. We email you a link, which works while you are signed in, for 7 days.
- Corrections: change your name, email address, language and time zone in account settings.
- Erasure: delete your account in account settings. It is removed after 14 days, and you can keep it by signing in during that time.
- Product news: subscribe or unsubscribe in account settings at any time. Emails about your account, security and billing always arrive, because we need them to provide the service.
- Notifications: choose per kind (finished work, client approvals, mentions, credits, failed payments) whether you want to hear about it in the platform, by email, or both, in account settings.
For anything else, or if you prefer email, write to support@sizewright.com. We may ask you to confirm your identity first. We answer within one month. If a request is complex or we receive many, we may extend this by two months and tell you why within the first month. Using your rights is free, unless a request is clearly unfounded or excessive.
Complaints
If you are unhappy with how we handle your personal data, please tell us first at support@sizewright.com. You also have the right to lodge a complaint with a supervisory authority: in the Netherlands, the Autoriteit Persoonsgegevens, or the data protection authority of the EU country where you live, work or where the issue occurred.
Children
Sizewright is not directed at children. You must be at least 16 years old to create an account. We do not knowingly collect personal data of children under 16. If we learn that we have, we delete it. If you believe a child has given us personal data, write to support@sizewright.com.
Changes to this policy
We update this policy when our processing or the law changes. The version and date at the top show when it last changed. We email you about material changes 30 days before they take effect.
Contact
For questions about this policy or your personal data, write to support@sizewright.com.