Privacy Policy

ARTO Studio AI (creative.artostudio.ai, the "Service") is an ARTO Group product operated by ARTO Inc., a Delaware corporation located at 101 Avenue of the Americas, Fl 8, New York, NY 10013, which also bills the plans ("we") and is the controller of your personal data. This policy explains what personal data we process, why, who we share it with and what rights you have. For any question or request, email contact@artogroup.com.

What data we process

Account: your email and, if you provide them, your company and role. If you sign in with Google, also your name and photo. We store which campaign brought you if you accepted analytics.
Usage: the searches you run (text, language and result), the prompts you open, favorites and collections, and how many free prompts you opened today.
Brand Roast: the name, website, industry, company size and description of the brand you roast, and the result. Our server reads the public page of that website. If you leave your email to get the report, we store it with the result.
Waitlists: your email, language, whether you ticked the promotions box (with the date and the version of the text) and, if you accepted analytics, which campaign or site first brought you here.
Payments: if you buy a plan, your Stripe customer id, plan and subscription status.
Technical: server logs (paths and errors) and your IP to limit abuse, deleted after 7 days.

Why we use it

Give you access to your account, favorites and collections, and apply the free plan limit.
Answer your searches and generate the Brand Roast.
Send the emails you asked for: sign-in links, the roast report and the opening notice of a waitlist.
Improve the catalog with what people search for and don't find.
Charge your plan, if you buy one.
Measure what works on the site, only if you accept analytics.
Measure which Instagram and Facebook ads bring people to the site and show them to similar people, only if you choose "Accept all".
Send you promotions, new prompts and launches, only if you ticked the box to receive them.

Promotional emails

We only send promotions if you expressly opted in: the box comes unticked. If you tick it when you create your account, the sign-in link already proves the address is yours. If you tick it in the Brand Roast or on a waitlist, we send a confirmation email and send nothing else until you confirm. Every email has an unsubscribe button; unsubscribing doesn't affect sign-in emails or receipts.

Who we share it with

Only with the providers we need to run the Service, for the stated purpose. We don't sell or rent your data and we don't use it to train third-party models.

Supabase: Database and authentication (magic link and Google). Stores your account, favorites, collections and searches.
Vercel: Hosts the site. Vercel Web Analytics and Speed Insights measure visits and speed in aggregate, without cookies.
Resend: Sends our emails: sign-in links, the Brand Roast report and, only if you opted in, promotions.
PostHog: Product analytics, only if you accept it in the cookie notice. We identify you by an internal number, never by your email. No session recording.
Anthropic: Writes the search recommendations and the Brand Roast analysis. Receives your search text or, in the roast, the brand's name, industry, size, website and description, plus the public text we read from that website.
OpenAI: Turns your search text into a vector to find the closest prompts.
Google: If you choose to sign in with Google, it shares your name, email and photo with us. And, only if you accept analytics in the cookie notice, Google Analytics measures visits and page views with a pseudonymous identifier (a random number, not your name or email); its advertising features and Google Signals are turned off.
Stripe: Processes payments if you buy a plan. We only keep your customer id and subscription status, never your card.
Meta: Only if you choose "Accept all" in the cookie notice, the Meta pixel records the pages you see, whether you run the Brand Roast (industry and score), whether you leave your email to get the report and whether you create an account. We also send those same events to Meta from our server, with your IP address, your browser and the _fbp and _fbc cookies. Once you have given us your email (to get the report or to create an account), it goes too, hashed: an irreversible code, never the email itself. When you create an account we also send an irreversible code of your user ID and whether you signed up with Google or with email. We never send the brand name or anything you type. Meta matches it with your Instagram or Facebook account, if you have one, and uses it to measure our ads and show them to similar people. Nothing is sent on shared roast pages.

Your data is processed in the United States, where ARTO Inc. and most of these providers are based, under the safeguards of their own data processing agreements.

Cookies

We use essential cookies without asking, because the site doesn't work without them. The notice has three options: "Essential only", "Analytics only" (PostHog and Google Analytics) and "Accept all", which adds the Meta pixel to measure ads. If you don't answer, we only use essential cookies. You can change your choice at any time: .

Cookie	Purpose	Duration	Type
sb-…-auth-token(.N)	Keeps you signed in (Supabase).	Up to 400 days or until you sign out	Essential
asai_vid	Anonymous identifier for the 3 free prompts per day counter and to prevent abuse.	1 year	Essential
NEXT_LOCALE	Remembers the language you chose.	1 year	Essential
asai_next, asai_signup	Bring you back to the page you were on and keep company and role while you create your account.	15 to 60 minutes	Essential
asai_consent	Stores your choice in the cookie notice.	6 months	Essential
asai_promo_24h	Stores which Pro offer you got and when its clock started, so it does not restart and checkout gives you the discount you saw. It only holds each offer's identifier and that time, signed.	400 days	Essential
asai_utm	Which campaign or site brought you here the first time (utm parameters and referring site, no personal data). It is also used to show you that campaign's offer, if there is one.	30 days	Analytics, only with your permission
ph_…_posthog	PostHog product analytics: which pages and features get used. PostHog also keeps a record in the browser's local storage.	1 year	Analytics, only with your permission
_ga, _ga_…	Google Analytics: how many people visit the site, which pages they see and where they come from. No advertising features.	2 years	Analytics, only with your permission
_fbp, _fbc	Meta pixel: tells us whether you came from an Instagram or Facebook ad and whether you then ran the Brand Roast, left your email or created an account, so we know which ads work.	90 days	Advertising, only if you choose "Accept all"

If you visited other artostudio.ai sites, your browser may show cookies from them (for example Google Analytics or Meta). This Service only uses the ones listed in the table.

How long we keep it

Your account and what you save in it are kept while the account exists. Your search text is deleted after 12 months. If you ask us to delete it, we remove your personal data within 30 days, except what the law requires us to keep (for example, payment records). If you unsubscribe from the mailing list, we keep your email marked as unsubscribed so we don't write to you again.

Your rights

You can ask to access, correct or delete your data, object to its use, withdraw your consent and limit how we use it. If you are in the European Union, you can also ask for portability and lodge a complaint with your data protection authority. Email contact@artogroup.com from your account email. We reply within 20 business days, or within one month if you are in the European Union.

Minors

The Service is meant for professionals and is not directed at anyone under 18.

Changes to this policy

If we materially change how we handle your data, we update this page and, when the change warrants it, email account holders. The date at the top shows the current version.