Notice under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) for people who visit spun.studio, create an account or use SPUN Studio.
Last updated: 1 October 2026.
Data controller
SPUN S.r.l., C.so E. Padovano 33, Pagani (SA), Italy, VAT IT06011400659, REA SA-490544. For any question about personal data, write to privacy@spun.ai.
What data, why and on what basis
- Visiting the site. The server logs the technical data of requests (IP address, date and time, page requested, browser type) to run the site and protect it from abuse. Basis: legitimate interest (Art. 6(1)(f) GDPR).
- Account. First name, last name, email and password (stored in a non-readable form). If you sign in with Google or Facebook, we receive your name, email and profile picture from them. Basis: contract (Art. 6(1)(b) GDPR).
- What you create with SPUN Studio. The requests you write, the files you upload (texts, documents, images, audio), the generated content, the document library and the Brand Voice information about your brand. They are needed to provide the service and stay in your account. Basis: contract (Art. 6(1)(b) GDPR).
- Team. If you invite other people to your workspace, we process their name and email for the invitation and access. Basis: contract with whoever manages the workspace (Art. 6(1)(b) GDPR).
- Credits and payments. Plan, credits, usage and invoices. Payments go through Stripe or PayPal: they process the card details and SPUN does not receive them. Basis: contract and legal obligations, for example tax rules (Art. 6(1)(b) and 6(1)(c) GDPR).
- Emails to SPUN. If you write to us, we use your name, address and message to reply. Basis: your request and pre-contractual steps (Art. 6(1)(b) GDPR).
We do not sell data and we do not use it for advertising profiling.
Content about other people
If you upload or process data about other people, for example a customer list, a document with names or someone's photo, you must have the right to do so. For content a business uploads to its account for its own activity, the business is the controller: SPUN processes it only on its behalf and according to its instructions, as a processor (Art. 28 GDPR).
Artificial intelligence models
When you generate a text, an image, a video, a voice or a search, the request and the content needed to process it are sent to the provider of the chosen model, which acts as a processor on behalf of SPUN. The providers active today are OpenAI (text and images), Stability AI (images), ElevenLabs (voice), Serper (web search) and Unsplash (photo search). If we add others, we update this list. We do not use your content to train artificial intelligence models.
Public links
If you share a conversation with the sharing feature, anyone with the link can read it: only share what you want to make public.
Where the data is and who we entrust it to
The service runs on Amazon Web Services servers in the European Union (Paris). The files in your account are stored on Amazon S3 or Google Cloud Storage. For hosting, storage, sending emails, payments and AI models we rely on providers bound by contract as processors or sub-processors: the up-to-date list is available by writing to privacy@spun.ai. Stripe, PayPal, Google and Facebook, for payments and sign-in, also process data under their own privacy notices.
If a provider processes data outside the European Economic Area, the transfer only takes place with the safeguards of the GDPR: an adequacy decision, such as the EU-U.S. Data Privacy Framework, or the standard contractual clauses.
Security
Encrypted connection (HTTPS), passwords stored in a non-readable form, restricted administrative access.
How long
- Technical browsing data: for the time needed for the security of the site, then deleted.
- Account and content: for as long as the account exists. When it is closed we delete them, except for the documents the law requires us to keep, such as accounting records for 10 years.
- Emails: for the time needed to handle the request and any relationship that follows.
Cookies and browser storage
Public pages do not use analytics, advertising or profiling cookies. The account area uses technical cookies, needed to stay signed in and protect forms; without them the service does not work, so they do not require consent. The site saves in the browser's local storage the theme choice (spun-studio-theme) and, if you write one, the sample request in the home page chat (spun-studio-ask): they stay on your device and are not sent to us. You can delete cookies and local storage from your browser settings.
Your rights
You can ask for access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interest (Articles 15–22 GDPR). Write to privacy@spun.ai: we reply within one month. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.
Updates
If something changes, we update this page and the date at the top.