Privacy Policy

Last updated: September 25, 2026.

This policy describes what data Fimbi collects, why, and what you are entitled to request. Data controller: [company name to be completed]. Contact: contact@fimbi.dev.

The data we process

• Account: email address and password (stored in hashed form by our authentication provider Supabase; we never have access to it in plain text), or your Google identity if you use Google sign-in.
• Projects: the descriptions (prompts) you write, the generated stores (text, structures, images) and the history of your edits.
• Shopify connection: your store’s domain and the access tokens issued by Shopify, stored encrypted (AES-256-GCM). Never your Shopify password.
• Technical data: server logs (timestamps, errors) needed to run the service and keep it secure. No advertising cookies.
• Audience measurement: page views, referrer, device and approximate country, measured without cookies and anonymously. Only if you accept (the “Analytics cookies” banner, which you can change via “Manage cookies” at the bottom of the page): analytics cookies, your journey on the site and session recordings, with input fields masked.

Why (purposes and legal bases)

• Providing the service (generation, preview, publishing): performance of the contract.
• Security and abuse prevention: legitimate interest.
• Support when you write to us: performance of the contract.
• Audience measurement and product improvement: legitimate interest for anonymous, cookieless measurement; your consent for analytics cookies and session recordings.

AI and your prompts

To generate your store, your descriptions and your project’s content are sent to artificial intelligence models operated by third parties (Google Gemini models, via the Vercel AI Gateway). These processors handle this data to produce the requested generation. Don’t put sensitive information in your prompts that doesn’t belong there.

Our processors

• Supabase (database, authentication, storage, EU hosting)
• Vercel (web application hosting, AI gateway, United States)
• Railway (generation engine execution, United States)
• Upstash (Redis job queue, United States)
• Google (Gemini AI models, United States)
• Shopify (publishing to your store, at your request)
• PostHog (audience measurement, EU hosting)

Some processors are located outside the European Union; these transfers are governed by the mechanisms provided for by the GDPR (standard contractual clauses).

Retention periods

• Account and projects: for as long as your account exists.
• Account deletion: your data (account, projects, Shopify connection) is erased, except where the law requires us to retain it.
• Technical logs: a short period, as required for security.
• Audience measurement: 13 months at most; analytics cookies: 13 months at most, after which we ask for your choice again.

Your rights (GDPR)

You have the rights of access, rectification, erasure, portability, restriction and objection. To exercise them: contact@fimbi.dev. You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr), if you believe your rights are not being respected.