In effect since October 27, 2026
Privacy Policy
This policy explains how Trama processes personal data on the Platform and in the services that come with each plan, under Brazil's General Data Protection Law (LGPD, Law 13,709/2018), the Brazilian Internet Civil Framework and, for people in the European Union and the United Kingdom, the General Data Protection Regulation (GDPR).
1. Who the controller is
The controller is Trama Studio LLC, a United States company with its address at 1007 N Orange St., Wilmington, DE 19801, USA ("Trama"). Because it offers its service to and processes the data of people in Brazil, Trama complies with the LGPD (art. 3).
Trama's data protection officer (encarregado) can be reached at lgpd@trama.moda.
This policy covers Trama's website, the studio, the Apps, the Nodes editor, the plugins, the API and the MCP server, and the onboarding and Forward Deployed Creative services. Terms used here have the meaning given in the Terms of Service.
Shopper photos in the try-on of the Shopify and VTEX store Apps follow the Apps' own policy: Apps privacy.
2. When Trama is a controller and when it is a processor
Trama is the controller of the data it processes to provide and bill the service: accounts, billing, security, communication and support.
Trama is a processor of the personal data contained in the content the Customer uploads, such as people who appear in references and product photos, or data from connected stores. In that case the Customer is the controller, chooses the legal basis and answers to data subjects, and Trama processes that data only to provide the service (section 12).
For Digital Twins, Trama processes real models' images on the basis of the image-use authorisation and the consent they give through partner agencies.
3. The data we process
- Account: name, e-mail, password (stored only as a hash), studio, role in the studio, invitations and join requests.
- Document acceptance: the version of the Terms of Service and of this policy accepted at sign-up, the date and time, and a cryptographic digest of the network.
- Usage and security: session cookie, IP address, date and time of access, browser, and audit logs of studio actions (who did what and when). At sign-up, a device cookie and cryptographic digests (HMAC) of the device and the network, used to limit repeat accounts; Vercel BotID assesses browser signals when the sign-up form is submitted to block bots.
- Billing: plan, invoices, country, currency and Stripe identifiers. Card details are handled by Stripe; Trama neither receives nor stores them.
- Content: product photos, references, logos, briefs, prompts, workflows, generated assets, ratings and comments.
- Integrations the Customer connects: encrypted access tokens and the files chosen in Google Drive, products from Shopify and VTEX stores, and MCP client tokens.
- Support and plan services: support messages, session scheduling (name and e-mail), Forward Deployed Creative notes, messages in shared channels and, with consent, session recordings.
- Digital Twins: images, physical characteristics and contract details of licensed models.
- Region preference: a cookie with the chosen region and the country reported by the delivery network, to show the right language and currency.
To check that the person in a generated asset is the same as in the reference, verifiers compare the two images with AI. The comparison is made only between the asset and the chosen model's references and is not used to identify unknown people.
4. Why we use data, and on what legal basis
| Purpose | Data | Legal basis (LGPD / GDPR) |
|---|---|---|
| Create and maintain the account and studio and provide the contracted service | Account, content, integrations | Performance of a contract (art. 7, V / art. 6(1)(b)) |
| Bill, issue tax documents and meet accounting obligations | Billing, account | Legal obligation and performance of a contract (art. 7, II and V / art. 6(1)(b) and (c)) |
| Keep the access logs required by the Brazilian Internet Civil Framework | IP, date and time | Legal obligation (art. 7, II, and Law 12,965/2014, art. 15 / art. 6(1)(f)) |
| Prevent fraud, abuse and attacks; maintain security and auditing | Usage and security | Legitimate interests (art. 7, IX / art. 6(1)(f)) |
| Onboarding, Forward Deployed Creative and support | Account, support, content | Performance of a contract (art. 7, V / art. 6(1)(b)); recordings, with consent (art. 7, I / art. 6(1)(a)) |
| Improve the Platform with usage metrics and comments | Usage, ratings | Legitimate interests (art. 7, IX / art. 6(1)(f)) |
| Send Trama news | Name, e-mail | Legitimate interests, with an unsubscribe link in every message, or consent where the law requires it (art. 7, IX or I / art. 6(1)(f) or (a)) |
| Generate assets with Digital Twins | Digital Twins | The model's consent (art. 7, I, and art. 11, I / art. 6(1)(a) and art. 9(2)(a)) and the agency contract |
| Defend rights in legal proceedings | What the case requires | Regular exercise of rights (art. 7, VI / art. 6(1)(f)) |
Where the legal basis is legitimate interests, we use only the data needed, and you may object to the processing (section 8).
5. Who we share data with
Trama does not sell personal data or share it for behavioural advertising. It shares only what is needed with:
- hosting and infrastructure: Vercel (website, studio and BotID) and Railway (processing, database and file storage);
- payments: Stripe;
- transactional e-mail: Resend;
- AI providers that generate, edit, enhance and verify images and videos, depending on the node used: currently fal.ai, Pika, Zen Creator, OpenAI, Microsoft Azure, xAI, Venice, Higgsfield, OpenRouter, TypeSafe and Anthropic;
- integrations the Customer enables: Google (Drive), Shopify and VTEX;
- session scheduling and video calls: Cal.com and the video-call tool named in the invitation;
- authorities, when the law or a court order requires it, and any successor in a corporate transaction, with the same safeguards as this policy.
Providers receive data only to provide their service to Trama, under contract. Trama sends each AI provider only what the generation needs: the images and the text of the request.
6. International transfers
Trama and several of its providers store and process data outside Brazil and the European Union, mainly in the United States. These transfers rely on the mechanisms the law provides: the standard contractual clauses approved by Brazil's ANPD (Resolution CD/ANPD No. 19/2024), the European Commission's and the UK's standard contractual clauses, or the EU-U.S. Data Privacy Framework where the provider is certified.
7. How long we keep data
| Data | Period |
|---|---|
| Account and studio | While the account exists; deleted within 30 days of a deletion request |
| Content and assets | While the studio exists; studios with no plan and no sign-in for 12 months may be deleted, with notice 30 days before |
| Access logs (IP, date and time) | 6 months, as the Brazilian Internet Civil Framework requires, or longer if an authority asks |
| Billing and tax documents | 5 years, as Brazilian tax law requires |
| Sign-up device and network digests | As long as needed to prevent sign-up abuse |
| Studio audit logs | While the studio exists |
| Record of acceptance of the Terms and this policy | While the account exists |
| Session recordings | 90 days |
| Shopper photos in the Apps' try-on | 24 hours |
Backups are deleted in the regular rotation cycle. We may keep anonymised data for statistics.
8. Your rights
Under the LGPD (art. 18), you may ask for:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
- portability to another provider;
- deletion of data processed on the basis of your consent;
- information about who we share your data with and about the option not to consent;
- withdrawal of consent and objection to unlawful processing;
- review of decisions made solely by automated processing (art. 20).
In the European Union and the United Kingdom, the GDPR gives equivalent rights: access, rectification, erasure, restriction, portability, objection (including to direct marketing) and withdrawal of consent at any time.
Residents of US states with privacy laws, such as California, may know what data we process, ask for access, correction and deletion, and not be discriminated against for exercising these rights. Trama does not sell or share personal data for behavioural advertising.
To exercise a right, write to the data protection officer. We may ask for information to confirm your identity. We reply within 15 days (and within one month for GDPR requests); when Trama is a processor, we forward the request to the Customer who is the controller. E-mail: lgpd@trama.moda.
You may also complain to Brazil's National Data Protection Authority (ANPD), to the data protection authority of your country in the European Union or, in the United Kingdom, to the ICO.
9. Automated decisions
Some processing is automated: a sign-up may be refused because of bot signals, a disposable e-mail address or a repeated device or network, and verifiers may refuse a generation that breaks the usage rules or does not match its references. You may ask for a person to review these decisions, by writing to the data protection officer (LGPD art. 20; GDPR art. 22).
11. Security and incidents
Trama protects data with encrypted connections (TLS), passwords stored as hashes, encrypted integration credentials, isolation between studios in the database, short-lived file links, role-based access control and audit logs.
If a security incident may create relevant risk or harm to data subjects, Trama notifies the ANPD and the affected people within 3 business days, as Resolution CD/ANPD No. 15/2024 requires, and, where applicable, the European supervisory authority within 72 hours. When Trama is a processor, it notifies the Customer who is the controller without undue delay.
12. When Trama is a processor
When it processes personal data contained in the Customer's content, Trama:
- processes the data only to provide the service, on the Customer's instructions given through the Platform, the Terms of Service and the Order Form;
- binds the people authorised to access it to confidentiality;
- uses sub-processors only for the purposes in section 5, under contracts with equivalent obligations, and tells Customers about material changes to that list, with the option to object;
- helps the Customer answer data subjects and meet its security and incident-notification obligations;
- deletes or returns the data when the service ends, unless the law requires it to be kept;
- provides the information needed to demonstrate compliance with these obligations.
The Customer warrants that it has a legal basis for the data it uploads, including the consent of the people depicted and, for children and teenagers, of their parents or guardians (LGPD art. 14).
13. Artificial intelligence and your content
Trama does not use Customers' content or generated assets to train models offered to other customers. Templates trained on a brand's references stay in that brand's studio.
To generate an asset, Trama sends the AI provider of the chosen node the images and the text of the request; providers process that data on Trama's behalf, under contract.
14. Children and teenagers
The Platform is not intended for anyone under 18, and Trama does not knowingly collect data from children or teenagers as users. Kidswear assets use synthetic models; anyone uploading photos of real children must have the specific consent of a parent or legal guardian.
15. Changes to this policy
We may update this policy. Material changes are announced by e-mail and on the Platform before they take effect, and the date at the top of this page shows the version in effect.
16. Contact
Questions or requests about your personal data: lgpd@trama.moda.
