PRIVACY POLICY
Last updated: 10 May 2026
This privacy policy describes how JL CAPITAL collects, uses and protects your personal data through the Nanou Studio service. It applies to nanou.studio and to the iOS and Android apps, and complements our terms of service.
1. Data controller
The controller of your personal data is:
JL CAPITAL, EURL with share capital of €1,000
Registered office: 3 Place Léon Duguit, 33800 Bordeaux, France
Bordeaux Trade Register 993 098 920 · SIRET 993 098 920 00016
Contact: our contact form
2. Data we collect
We collect only the data strictly necessary to operate the Service.
2.1. Account data
- Email address and encrypted password (or federated Google / Apple identifier when used);
- First name and age of each child added to your profile;
- Usage preferences (language, default voice, subscription plan).
2.2. Story-creation data
- Photos you import to create 3D portraits;
- Casting selected (chosen actors, associated first names);
- Generated stories (text, illustrations, audio) and associated metadata (genre, scene, date).
2.3. Technical data
- Information about your device (model, operating system, anonymous install identifier);
- Technical operating logs (timestamp, error code, app version);
- Billing data sent by App Store, Google Play or our payment processor (excluding the full card number, which never transits through our servers).
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creation and management of your account | Performance of the contract (art. 6.1.b) |
| Generation of personalised stories | Performance of the contract (art. 6.1.b) |
| Billing and subscription management | Performance of the contract (art. 6.1.b) and legal obligations (art. 6.1.c) |
| Security, fraud prevention, abuse mitigation | Legitimate interest (art. 6.1.f) |
| "Safe for kids" moderation of generated content | Legitimate interest: protection of minors (art. 6.1.f) |
| Response to your requests (support, GDPR rights) | Performance of the contract (art. 6.1.b) and legal obligation (art. 6.1.c) |
| Sending transactional communications (cancellation, alerts) | Performance of the contract (art. 6.1.b) |
No processing is carried out for advertising or commercial profiling. No data is resold to third parties.
4. Fate of imported photos
The photos you import to create a 3D portrait are sent encrypted to our image-generation provider, only for the time strictly necessary to create the portrait. The original photo is deleted immediately after transformation and is never retained long-term on our servers, nor used to train an artificial intelligence model. Only the resulting stylised portrait is kept, and only for the lifetime of your account.
5. Recipients and sub-processors
Your data is accessible only to authorised personnel at JL CAPITAL, and to the following sub-processors, chosen for their GDPR compliance:
- Google Ireland Limited (Firebase, Google Cloud Platform): hosting, database, authentication, server functions. European data centres (Belgium, Germany).
- Anthropic, PBC (United States): language model used to generate the story text. No training dataset is built from your requests (explicit contractual clause).
- Google LLC (United States): image and synthetic-voice generation models (Gemini).
- Apple Inc. and Google LLC: billing of subscriptions purchased through the App Store and Google Play, under their own privacy policies.
6. Transfers outside the European Union
Some sub-processors are established in the United States. Transfers to these recipients are framed by the standard contractual clauses adopted by the European Commission (decision 2021/914) and, where applicable, by their participation in the EU-US Data Privacy Framework. You can obtain a copy of these safeguards on simple request via our contact form.
7. Retention period
- Account data: for as long as the Service is used, then deleted within a maximum of 30 days after account deletion.
- Imported photos: deleted immediately after transformation into a 3D portrait.
- 3D portraits and generated stories: kept as long as your account is active, then deleted with the account.
- Billing data: kept for 10 years, in line with article L. 123-22 of the French Commercial Code.
- Technical logs: 12 months maximum.
8. Security
We implement appropriate technical and organisational measures to protect your data against loss, alteration, disclosure or unauthorised access: encryption in transit (TLS) and at rest, environment segmentation, access control, logging, regular backups and a documented incident management procedure.
9. Minors
The Service is intended for family use. Children have no account of their own: their profile is created and managed by a holder of parental authority. No child can sign up alone. If you believe an account has been created without the relevant parent's consent, you can use our contact form to obtain immediate deletion.
10. Your rights
Under articles 15 to 22 of the GDPR, you have the following rights:
- Access: obtain confirmation that data about you is being processed and obtain a copy.
- Rectification: have inaccurate or incomplete data corrected.
- Erasure: request deletion of your data, within the limits of legal retention obligations.
- Restriction: ask for the processing of your data to be suspended.
- Objection: object to processing based on legitimate interest.
- Portability: receive your data in a structured, machine-readable format.
- Post-mortem directives: define what happens to your data after your death.
You can exercise these rights at any time by writing through our contact form. You will receive a response within a maximum of one month.
You also have the right to lodge a complaint with the CNIL (the French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at www.cnil.fr/fr/plaintes.
11. Cookies and local storage
Nanou Studio only sets cookies and local-storage identifiers that are strictly necessary to operate the Service: keeping you authenticated and remembering your preferences. No advertising cookies, no third-party trackers, no behavioural analytics tools are used. As such, your prior consent is not required (article 82 of the French Data Protection Act).
12. Policy changes
This policy may be updated to reflect changes to the Service or to applicable regulations. Any material change will be notified to you by email or via an in-app notification. The last-update date appears at the top of the page.
13. Contact
For any question regarding your personal data or to exercise your rights, you can use our contact form or write by post to JL CAPITAL, 3 Place Léon Duguit, 33800 Bordeaux, France.
← Back to home