In short. We collect the minimum needed to run AppScenes: your account details, the content you create, and basic technical logs. We do not sell your data, we do not use it for advertising, and we never train AI models on your screenshots. If you use the design assistant, your prompt and the current scene are sent to our AI provider to generate the edit. If you comment on a shared review link as an external reviewer, we process your name and email to verify the comment; your email is never shown publicly.
1. Controller
The controller responsible for processing your personal data under the EU General Data Protection Regulation ("GDPR") is:
Mediart Solutions,
Inhaber Zharko Popovski
c/o Autorenglück #27850
Albert-Einstein-Straße 47
02977 Hoyerswerda, Deutschland
Email: [email protected]
No data protection officer has been appointed. For any privacy-related questions, please contact [email protected].
2. Data we collect
We process the following categories of personal data:
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password hash, email-verification status, plan, admin flag | You, at registration |
| Content data | Projects, slides, project versions, designs, uploaded images and assets, exports, brand kits | You, while using the Service |
| Collaboration data | Workspaces, memberships and roles, invitations (email address and role) | You or your workspace owner |
| Billing data | Plan, subscription status, price, currency, renewal date, scheduled cancellation and reminder status; payment card details are handled by our payment processor, not stored by us | You / payment processor |
| AI usage data | Assistant prompts, conversation history, tool-call records, token counts, measured cost and AI credit ledger entries | You, while using the design assistant |
| Reviewer data | Reviewer name, email address, email-verification status, comments and timestamps, reviewer session token hash | External reviewers of a shared review link |
| Free-tool usage data | Aggregated tool events (page/tool opened, files selected, validation result counts, resize/compress/convert/download events, CTA clicks). No image data, file names, file contents or ASO text | Automatically, while using the Free Tools |
| Technical data | IP address, request time, endpoint, user agent, session token, error logs | Automatically, when you use the Service |
We do not intentionally collect special categories of data (such as health, biometric or political data). Please do not upload such data.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing your account, authenticating you and providing the editor | Performance of a contract (Art. 6(1)(b)) |
| Processing payments and managing subscriptions | Performance of a contract (Art. 6(1)(b)) |
| Operating the AI design assistant: sending your prompt and the current scene to the AI provider, and metering AI credit usage | Performance of a contract (Art. 6(1)(b)) |
| Sending transactional emails such as verification, password reset, invitations, comment verification / owner notifications, subscription renewal reminders, cancellation confirmations and failed-payment notices | Performance of a contract (Art. 6(1)(b)) |
| Operating shared review links: verifying reviewer email addresses and publishing/displaying comments | Performance of a contract (Art. 6(1)(b)) |
| Securing the Service, preventing abuse and rate limiting | Legitimate interests (Art. 6(1)(f)) |
| Measuring aggregate usage of the website and Free Tools (Matomo, self-hosted, without image data) | Legitimate interests (Art. 6(1)(f)) |
| Diagnosing errors and improving reliability | Legitimate interests (Art. 6(1)(f)) |
| Complying with legal, tax and accounting obligations | Legal obligation (Art. 6(1)(c)) |
| Sending product updates or marketing emails (if offered) | Consent or legitimate interests, with opt-out at any time (Art. 6(1)(a)/(f)) |
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
4. Cookies and local storage
AppScenes uses essential cookies and browser local storage for the application, plus first-party analytics cookies from our self-hosted Matomo instance to measure aggregate usage. We do not use advertising or third-party tracking cookies on this website. The Free Tools do not upload, store or analyse your images, and text entered into the ASO Character Counter never leaves your browser.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| Session token | Essential / localStorage | Keeps you signed in and authenticates API requests | Until logout or expiry (up to 30 days) |
| appscenes-cookie-consent | Essential / localStorage | Remembers your cookie-notice choice | Until you clear it |
| appscenes-custom-fonts | Functional / localStorage | Stores fonts you add in the editor | Until you clear it |
| appscenes_reviewer | Essential / HttpOnly cookie | Keeps an external reviewer signed in to a shared review after email verification | Up to 30 days |
| _pk_id.* / _pk_ses.* | Analytics (first-party, Matomo) | Distinguishes visits and sessions for aggregate usage statistics; no advertising | Up to 13 months (if enabled) |
Because these are strictly necessary or purely functional, they do not require consent under the ePrivacy Directive. You can clear them at any time through your browser settings, though doing so will sign you out.
5. Processors and recipients
We share personal data only with service providers that help us run AppScenes, under data-processing agreements, and only as necessary:
- Hosting / infrastructure — the provider hosting the application and database.
- Object storage — the provider storing uploaded assets, exports and design documents.
- Payment processor — Stripe — processing subscriptions and payments.
- Analytics — Matomo, self-hosted at s.mediartsolutions.com — aggregate website and Free Tools usage statistics; no image data or file contents.
- AI provider — the configured AI model provider — receiving your assistant prompts and the current scene to generate edits, only when you use the design assistant.
- Email delivery — our email service provider — sending transactional emails.
We may also disclose data if required by law, to enforce our Terms, or to protect the rights, property or safety of AppScenes, our users or the public. We do not sell personal data.
6. International transfers
Some processors may process data outside the European Economic Area (EEA). Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where relevant, supplementary measures, to ensure a level of protection comparable to that in the EEA.
7. Retention
- Account data — for as long as your account exists, then deleted or anonymised within 30 days of account deletion, unless we must keep it for legal reasons.
- Content data — until you delete it or your account; deleted content is removed from active systems promptly and from backups on our normal backup cycle.
- AI conversations and credit ledger — conversation history is kept until you delete the conversation or your account; aggregated, non-identifying usage statistics and the auditable credit ledger are kept for as long as needed for billing disputes and statutory retention.
- Billing and tax records — retained for the statutory period, typically 6–10 years depending on jurisdiction. Renewal-reminder and cancellation-confirmation metadata is kept with the subscription record so we do not send duplicate reminders.
- Reviewer data — reviewer name, email and session data are kept for as long as the shared review exists and the reviewer stays active; reviewer sessions expire after up to 30 days and are deleted when expired. Pending comments that are not verified within 30 minutes are deleted. Resolved comments remain in the review history until the project is deleted or the owner deletes them.
- Technical and security logs — retained for a short period (typically up to 90 days) for security and troubleshooting.
8. Reviewers and review comments
Shared review links may be used by external reviewers who do not have an AppScenes account. For these reviewers we process the name and email address they provide, whether the address has been verified, the comments they post and their timestamps, and a hashed reviewer session token. Verification links are single-use and expire after 30 minutes; reviewer sessions expire after up to 30 days and can be revoked by logging out or clearing the cookie.
Reviewer email addresses are never exposed publicly. The project owner and authorised collaborators can see them in the review dashboard; other reviewers using the same review link only see the reviewer's display name, comment and timestamp. We use reviewer email addresses only to verify the comment, to associate further comments with the same reviewer session and to notify the project owner of new comments. We do not use reviewer email addresses for marketing, and we do not create AppScenes accounts for reviewers.
Reviewer data is retained as described in section 7. If you are a reviewer and want your comment or reviewer data removed, contact the project owner or us at [email protected]; project owners can delete comments from their dashboard and deleting a project removes its reviewer data.
9. Security
We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), password hashing with bcrypt, opaque session tokens, access controls, rate limiting and security headers. No method of transmission or storage is completely secure; please use a strong, unique password and keep it confidential.
10. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten");
- Restrict processing in certain circumstances;
- Data portability — receive your data in a structured, machine-readable format;
- Object to processing based on legitimate interests;
- Withdraw consent at any time where processing is based on consent; and
- Lodge a complaint with a supervisory authority, in particular in your country of residence, place of work or place of the alleged infringement.
To exercise your rights, email [email protected]. We will respond within one month, subject to any extensions permitted by law. You will not be charged for reasonable requests.
11. Children
The Service is not directed at children. We do not knowingly collect personal data from children under 16 (or the applicable age of digital consent). If you believe a child has provided us with personal data, please contact us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be announced by email or in the Service, and the "Last updated" date above will change. We encourage you to review this page periodically.
13. Contact
For privacy questions or to exercise your rights, contact [email protected]. See also our Terms & Conditions and Legal Notice / Imprint.