Privacy Policy

Who we are and what this policy covers

Benjamin Melki, Entrepreneur individuel (EI), Paris, France, is the controller of the personal data described in this policy (“we”, “us” or “our”). This policy covers the Plastic Surgery Simulator desktop software, including AI Edit, the public commercial website, the customer portal, licensing, purchases of licences and AI credits, optional feedback and optional crash-report submission.

Questions and data-rights requests may be sent to contact@plastic-surgery-simulator.com.

Images and data that remain local

Photos and project content you open or create in Plastic Surgery Simulator are processed locally on your computer. They are not uploaded or transmitted to us. The subscription, licensing and AI credit services do not receive image pixels, filenames, file paths, image metadata, patient or client names, editing history or project content. The software does not provide image cloud storage or synchronization. The only feature that sends part of a photo outside your computer is AI Edit, described in the next section, and it sends it to the AI provider, not to us.

The imported original remains unchanged. Images exported by Plastic Surgery Simulator do not carry the source file’s EXIF metadata. Your local settings, contact details, recent folders, raw diagnostic logs and any local crash dump also remain on the computer. Raw logs and dumps are never submitted automatically. Local logs are normally removed after fourteen days or when their rolling limit is reached; local diagnostic files may also be removed when the application is uninstalled.

The software does not send analytics about which tools you use, how many images you open, how long you work, or the content you edit.

AI Edit

AI Edit is optional and available only with a paid licence. It sends image data only when you press Generate.

What is sent to the AI provider: a newly created copy of the area you painted, with some surrounding context. It contains no metadata from the original file.
What is never sent: the rest of the photo, the original file and its metadata, file names and folders, annotations, the painted mask, and any client or project information.
Where it goes: directly between your computer and third-party AI providers, including OpenAI. Image data never passes through our servers and we never receive, view or store it.
At the provider: images are kept private, are set to expire ten minutes after processing, and are not used by the provider or by us to create, train or develop any product or service.
What our servers process: your licence and account identifiers, the chosen procedure and quality, technical information about the crop such as its dimensions, generation job identifiers and status, and the credits charged, so that we can run the generation and maintain your credit balance.

You are responsible for obtaining the patient’s authorization before using AI Edit on their photograph.

Your responsibility

You control and are responsible for your images and storage

Because we do not receive or store your photos or projects, we are not their custodian and cannot secure, back up, recover, monitor, retain or delete them for you. You are responsible for the lawful collection and use of images, obtaining any required patient or subject consent, including for AI Edit, professional confidentiality, device security, access permissions, storage location, backups, retention periods, deletion and every disclosure or transfer you initiate.

If you save to a cloud-synced or network folder, or choose to share, print or transmit an image through your operating system or another service, that action is controlled by you and the selected provider. You must review its security, sharing settings, location, terms and legal suitability. We do not select, operate or govern those storage and sharing services.

Personal data we process online

Website analytics. The public website and the customer portal, except its administrator pages, use Google Analytics to measure visits and how visitors use the sites, for example the pages viewed, downloads started, purchase steps reached and completed, and the referring website. Google Analytics uses cookies and similar identifiers and processes your IP address, approximate location, device and browser information. You can block analytics cookies in your browser settings or with Google’s opt-out browser add-on. The desktop software does not use Google Analytics.

Website and portal requests. Hosting and security providers may process the IP address, date and time, requested page, browser and device information, referrer and technical security logs needed to deliver and protect the sites. The sites do not use advertising cookies.

Customer account and authentication. We process your Firebase account identifier, email address, authentication provider, email-verification state, sign-in records, and the optional customer name you enter. If you buy without signing in, we create your customer account with the email address you enter at Stripe Checkout, or add the licence to the existing account for that address. The browser temporarily stores the email address used for passwordless sign-in and the route needed to return you to the purchase page. After a purchase, it also remembers the email address used for that purchase so the sign-in page can suggest it; you can remove it from the sign-in page at any time.

Purchases and billing. Stripe processes payment details. We receive and retain transaction and subscription information needed to provide the licence and AI credits, including Stripe customer and transaction identifiers, selected platform, price and currency, billing country, subscription and refund status, invoice references, dates and account ownership. We do not receive or store complete card or bank-account numbers.

Licence activation and device management. We process the activation key, account and licence identifiers, subscription status, platform, application version, activation and refresh times, a pseudonymous device identifier, a server-created device-binding identifier, and the computer name displayed in your customer portal. The key is protected in server storage and only its suffix is shown in administrative lists. No image data is included.

AI credits. We keep your AI credit balance and a record of credit purchases, free credits granted and the credits charged for each AI Edit generation.

Anonymous trial. We process a pseudonymous device value, a random installation value, trial identifier, platform, application version, identifier source, and trial start and expiry times to provide one trial per eligible computer and prevent abuse. The source network address and raw installation value are used as inputs to protected rate-limit digests rather than stored in the trial record as plain identifiers.

Feedback you choose to send. The in-app feedback form sends the name and email you choose to enter, your message, application version, platform, customer-state label, an opaque feedback identifier and a protected rate-limit value. It does not attach an image, project, path, activation key, receipt, raw hardware identifier or patient or client record.

Crash report you expressly consent to send. After an abnormal exit, the application may offer a separately constructed, sanitized technical report. It contains only allowlisted version, error and operation fields. It never includes a memory dump, raw log, image, project content, filename, path, contact setting, credential, activation key, signed receipt or payment detail. Choosing not to send it does not prevent normal use of the software.

Support and legal requests. If you contact us, we process your address, message, attachments you choose to provide, and the account or transaction information needed to respond. Do not send patient images or health information to support unless we specifically request a safe transfer method and you have authority to disclose them.

Why we process data and our legal bases

Contract: to create and authenticate your account, process an order, issue and verify a licence, manage active computers, provide the trial, run AI Edit generations and maintain your AI credit balance, billing access and requested support.
Legitimate interests: to secure the sites and services, prevent fraud and trial or licence abuse, diagnose failures, keep reliable transaction and entitlement records, measure and improve the websites with analytics, and defend legal claims. We limit these activities to what is reasonably necessary.
Consent: when you choose to submit the separately described sanitized crash report. You may decline without losing normal product access and may withdraw consent for future submissions.
Legal obligations: to keep records required for tax, accounting, consumer protection, fraud prevention, sanctions, court orders or other applicable law.

We do not use your data for automated decisions that produce legal or similarly significant effects, and we do not sell personal data.

Service providers and international processing

We use Google services, including Firebase Authentication, Hosting, Cloud Functions, Firestore, Cloud Storage and Google Analytics, to operate and measure the websites, accounts, licensing, AI credits and optional submissions. We use Stripe for checkout, subscriptions, credit purchases, invoices and the billing portal; third-party AI providers, including OpenAI, to process AI Edit generations; and email providers to deliver authentication, licence, receipt, support and operational messages. Software downloads and updates may be provided through platform-specific stores or distribution channels.

These providers process data under their own infrastructure and may process it outside France or the European Economic Area, including in the United States. Where required, transfers rely on a valid legal mechanism such as an adequacy decision or approved contractual safeguards. We may also disclose data when required by law, to protect rights and security, or in connection with a business reorganization subject to appropriate safeguards.

How long we keep online data

Account, purchase, subscription, invoice, licence, AI credit, device-binding and administrative records are kept while needed to provide the service and afterward for accounting, tax, security, fraud prevention, dispute handling and legal claims.
AI Edit images at the provider are set to expire ten minutes after processing.
The anonymous trial record is kept while needed to enforce the one-trial-per-computer policy and prevent repeat abuse.
Feedback and sanitized crash reports are currently retained until an administrator explicitly deletes them. You may request deletion, subject to any legal need to retain a limited record.
Website analytics data is kept for the retention period configured in Google Analytics.
Authentication, hosting, Function, payment, AI and email providers keep their own technical and security logs according to their documented retention settings and legal obligations.

When data is no longer needed, we delete or anonymize it, unless continued retention is required or permitted by law. Your locally stored photos and projects are outside these online retention periods because we do not possess them.

Security

We use measures designed to limit access and protect online data, including authenticated account access, server-authoritative operations, restricted database and storage rules, encrypted transport, protected secrets, limited administrator access, pseudonymous identifiers and sanitized operational logs. No internet service or storage system is completely secure, so absolute security cannot be guaranteed.

Your data-protection rights

Depending on applicable law, you may request access to your personal data, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time for future consent-based processing without affecting earlier lawful processing. Some requests may be limited where data must be retained for legal obligations, fraud prevention, security, the rights of others or legal claims.

Send a request to contact@plastic-surgery-simulator.com. We may ask for information reasonably necessary to verify that the request concerns you. You also have the right to lodge a complaint with the French data-protection authority, the Commission nationale de l’informatique et des libertés (CNIL), or with the competent authority where you live or work.

Children

The commercial software, customer account and purchasing services are intended for adults and professionals. They are not directed to children, and children must not create an account or purchase a licence.

Changes and contact

We may update this policy when the product, providers or legal requirements change. The date at the top identifies the current version. Material changes will be highlighted or communicated where required.

Privacy questions and requests: contact@plastic-surgery-simulator.com