Privacy Policy

Who we are

Gemistry Labs is a sole proprietorship registered in Ontario, Canada, and is responsible for the personal data described in this policy. We handle personal data in accordance with Canadian privacy law (including PIPEDA) and, where they apply, the privacy laws of your place of residence. This policy is meant to be read together with our Terms of Service. Questions and requests can be sent to hello@gemistrylabs.com.

Data we collect

Account details. Your email address, an optional display name, and the sign-in identity our authentication provider (Stytch) issues for your account.

Design content. The prompts and chat messages you exchange with Kiln, your design state and notes, and any reference images you upload. Reference images may include photos of people or personal items — only upload images you have the right to share. This is the most sensitive data we hold, and it is yours to delete at any time.

Generated artifacts. Concept images, 3D models, and export bundles produced from your designs. Generated artifacts are content-addressed, so identical requests can share the same cached image or model across users.

Billing records. A Stripe customer reference, your purchase history, and the gem ledger that tracks credits and debits. Payment card details are entered on Stripe’s hosted pages and never touch our servers.

Security and usage records. Login records (including IP address and browser user agent), structured request logs, and an append-only audit trail. Audit entries store only identifiers, counts, and durations — never your chat text, email, or name.

Feedback. Anything you choose to submit through the feedback form.

How we use data

We use this information to operate the studio, save and restore your designs, generate the concept images, 3D models, and jeweler-ready handoff files you request, process purchases and credit Gems, prevent abuse (rate limiting and investigating suspicious activity), improve product quality, troubleshoot errors, and meet legal and accounting obligations. We do not sell personal data, and we do not use it for advertising.

Service providers

The Service depends on a small set of providers, and we send each one only what it needs: Stytch (authentication) holds your email, name, and sign-in sessions; Stripe (payments) receives your email and an account reference, plus the payment details you enter on its hosted pages; Google Gemini (AI text and image generation) receives your design prompts and reference-image bytes for the active turn only, with no account identifiers; fal.ai (3D generation) receives only the generated concept image being turned into a model, with no user identifiers; and Sentry (error reporting) receives error events scrubbed of emails, names, and credentials — and only runs in your browser if you allow it.

These providers process data on servers outside Canada, including in the United States. Where that happens, the data is protected by our agreements with the provider and the provider’s own safeguards.

Cookies and local storage

Gemistry uses one category of essential cookies: our sign-in provider (Stytch) stores your session so you stay signed in. These are required for the studio to work and are not used for advertising or tracking.

Your browser's local storage holds your in-progress design session, whether you've entered the studio, and your privacy choice itself. Nothing in local storage is shared with third parties.

Optional error reporting (Sentry) only runs if you allow it in the consent notice. You can change that choice at any time from the Privacy & data section of your account settings.

How long we keep data

Account details are kept for the life of your account and anonymized when you delete it. Login IP addresses and user agents are scrubbed after 90 days, and the rest of each login record is deleted after 365 days. Design sessions live until you delete them or your account — deleting a session removes its chat transcript and design state immediately and permanently. Non-billing audit records are deleted after 365 days; billing records and the gem ledger are kept indefinitely as financial records, linked only to your anonymized account after deletion. Uploaded reference images are kept while your account exists and are deleted when you delete your account. Generated concept images, 3D models, and export bundles are derived artifacts kept as a shared cache to serve future requests. Error reports follow Sentry’s retention settings (90 days by default).

Your choices and rights

You can delete any design session at any time, and the deletion is immediate. You can delete your account from the Privacy & data section of your account settings. Deletion permanently removes your designs, chat history, and reference images, and deletes your sign-in identity; purchase records are retained in anonymized form for accounting.

You can also ask us for access to, a copy of, or a correction of the personal data we hold about you by writing to hello@gemistrylabs.com. If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or the data-protection authority where you live.

Security

Data is encrypted in transit, access to production systems is restricted, sensitive fields such as emails, names, and credentials are deny-listed from logs and error reports, and payment card details never reach our servers. No system is perfectly secure, and if a breach affects your personal data we will notify you as required by law.

Children

The Service requires you to be at least 18 years old, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

Changes to this policy

We may update this policy as the Service and our legal requirements change. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice.

Contact

Privacy questions and requests can be sent to hello@gemistrylabs.com — including “Privacy” in the subject line helps us route it. A mailing address is available on request.