Privacy Policy.

In effect from 26 July 2026

The short version: we store the car photos you upload and the renders we make from them. If you never sign up, all of it is deleted after 30 days without activity. We do not sell anything to anyone, we run no advertising, and we send no marketing email.

1. Who is responsible

The data controller for Specced (specced.app) is Augustin BÉGUÉ, 5 rue Beautreillis, 75004 Paris, France. For anything on this page — including a request to see or delete your data — write to privacy@specced.app. We answer within one month, as the GDPR requires.

At our current size we are not required to appoint a Data Protection Officer, and have not. That decision is revisited if the service grows.

2. What we store

The photos you upload. Whatever is in the frame is stored as you sent it. Photos of cars routinely include number plates, and sometimes faces, house fronts and street signs. We do not blur or strip anything.
The renders we generate from those photos, and the colour, finish and car name you chose.
Your email address, but only if you sign up or buy credits. Browsing and rendering need no email.
A record of renders and credits — how many you have used and when — so the daily allowance and your balance work.
Purchase records if you buy a pack: amount, date, pack, and the Stripe reference. Not your card number, which we never receive.
Technical data in server logs: IP address, browser type, and what was requested. Used to run and debug the service.

We ask for nothing else. There is no profile, no address book, no location tracking, and no attempt to work out who you are beyond the above.

3. Why we are allowed to

To provide the service (performance of a contract) — storing your photos, rendering them, running your account and your credits.
To keep it working and safe (legitimate interest) — server logs, rate limiting, and stopping abuse.
To meet accounting obligations (legal obligation) — purchase records must be kept for the statutory period, which is why they outlive a deleted account.

We rely on consent for nothing, because we do nothing optional with your data. Sign-in emails are transactional, not marketing.

4. Where it lives

Your photos, renders and account data are stored on a server operated by us in France (European Union), along with the object storage that holds the images.

When demand is higher than our own hardware can serve, a render may be processed on rented GPU capacity from RunPod, which may be located outside the European Union. In that case the photo is sent to that machine, rendered, and the result returned; the photo is not kept there afterwards. Where such a transfer leaves the EEA it relies on the European Commission's Standard Contractual Clauses.

5. How long we keep it

Without an account

Your garage is tied to a cookie in this browser. If nothing in it is touched for 30 days — no upload, no render, no visit that changes anything — a scheduled job deletes all of it: the database rows and the image files both. This is permanent and there is no recovery.

Public share links you created are deleted with it, and stop working. Sign up if you want to keep a garage — that is the whole difference.

With an account

We keep your photos, renders and account for as long as the account exists. We do not expire them on a timer. Delete individual photos or cars at any time from the app, or delete the whole account (section 7) to remove the lot.

Regardless

Purchase records: kept for the statutory accounting period (10 years in France) even after account deletion. We are required to; they contain the amount and date, not your images.
Server logs: a short rolling window, then overwritten.
Expired sign-in links and sessions: cleared by the same daily job.

6. Who else sees it

Only the processors below, each for one specific job. None of them is allowed to use your data for their own purposes. We do not sell or rent data to anyone, and there is no advertising network involved at any point.

Stripe — Payment processing for credit packs: Email address, payment details, purchase amount. Card details go to Stripe directly and are never stored by us.
Resend — Delivery of sign-in links: Email address. Transactional only.
RunPod — Additional GPU capacity at peak: The photo being rendered, for the duration of that render. Photos are not retained by the provider after the render.

We may also disclose data where the law obliges us to — a valid court order, for example.

7. Your rights

Under the GDPR you can ask us to:

Show you the data we hold about you.
Correct anything wrong.
Delete it. Individual photos, cars and results have a delete control in the app and go immediately, image files included. Signed in, the account panel has Delete account, which removes your account, garage and images in one go. Without an account, clearing your browser cookie plus the 30-day rule gets there on its own.
Export it. The account panel has Download my data, which gives you a machine-readable file of everything held about you plus links to your images.
Object to or restrict processing based on our legitimate interests.

Anything the app cannot do for you, email privacy@specced.app and we will do it by hand. No charge, no interrogation about why.

If you think we have handled your data badly, you can complain to the French data protection authority, the CNIL (cnil.fr), or to the authority in your own EU country. We would appreciate the chance to fix it first.

8. Cookies

Specced uses only strictly necessary cookies. There are no advertising cookies, no third-party trackers, and nothing that follows you to other sites — which is why you are not being asked to accept anything.

sid: Identifies your browser so your garage is yours between visits · 1 year
Session cookie: Keeps you signed in after you use an email sign-in link · Until you sign out or it expires

You can clear these in your browser at any time. Doing so signs you out and, if you have no account, disconnects you from your garage permanently.

9. Analytics

We count page views with Umami, which we host ourselves on the same infrastructure. It sets no cookies, collects no personal data, does not fingerprint visitors, and never leaves our servers. We use it to see which pages get used, nothing finer than that.

10. Children

Specced is not aimed at children and we do not knowingly collect data from anyone under 15. If you believe a child has uploaded photos, write to privacy@specced.app and we will remove them.

11. Changes

If we change what we collect or how we use it, this page changes and the date at the top moves. Material changes are emailed to account holders before they take effect.