1. Who we are
Lenci Studio (“Lenci”, “we”, “us”), available at lenci.siyada.pro, is operated by Siyada Technology, Riyadh, Kingdom of Saudi Arabia. Siyada Technology is the controller of the personal data described in this Policy.
We process personal data in accordance with the Kingdom of Saudi Arabia’s Personal Data Protection Law (PDPL), issued by Royal Decree No. (M/19) dated 9/2/1443H, as amended, its Implementing Regulation and the Regulation on Personal Data Transfer outside the Kingdom, under the supervision of the Saudi Data and Artificial Intelligence Authority (SDAIA).
This Policy explains what we collect when you use Lenci Studio (the web studio and every Lenci app that signs in with the same account), why we use it, who receives it, how long we keep it and how you can exercise your rights. For any privacy question, write to our Data Protection Officer at dpo@lenci.ai.
2. Definitions
- Personal data: any information that identifies you or makes you identifiable, directly or indirectly.
- Processing: any operation on personal data, such as collection, recording, storage, use, disclosure, transfer or destruction.
- Controller: the entity that decides why and how personal data is processed (Siyada Technology).
- Processor: a provider that processes personal data on our behalf and under our instructions.
- Content: the images, files, text and settings you upload or create in Lenci, and the results generated for you.
3. Personal data we collect
3.1 Account data
Your e-mail address, your Lenci user ID and, when you choose Google sign-in, the name and profile picture your Google account shares with us. You sign in with a one-time link sent to your e-mail or with Google; we do not ask for or store a password.
3.2 Credits, plans and payments
Your credit balance and credit history (every charge, refund, grant and purchase), your plan and its status, orders, invoices and their amounts in Saudi riyals, and the payment and invoice identifiers returned by our payment provider. You enter card or Apple Pay details on Moyasar’s secure payment page: we never see or store full card numbers.
3.3 Content you upload or create
Product photos, photos of people, logos, garments, reference images and other files you upload; the scenes you build in the Studio; prompts, briefs and captions; the images and videos generated for you (your Library); brand profiles, campaigns and posts; locations, looks, storyboards, designs and websites; brand memory facts; ratings and comments you give on results. Content may include images of people, including faces. You must have the permission of every person who appears in what you upload (see the Terms of Service).
3.4 Your own models
When you add a real person under “My models”, we store their photos, the details you enter (name, sex, age band, notes) and the consent confirmation you give for that person.
3.5 Connected accounts
When you connect an outside account (for example Instagram, Facebook, Google, X, LinkedIn, TikTok, Pinterest, Snapchat, Shopify, Salla, Zid, WhatsApp or an MCP server), we store the access tokens that service issues, encrypted at rest, together with a log of the actions run through it (tool, time and result).
3.6 Support and e-mail
The messages you send through the support assistant, “Talk to a human”, “Report an issue” or the Support page, any screenshot you attach, the page, language and screen size recorded with a report, your e-mail language preference, and a record of the e-mails we send you.
3.7 Technical data
Your IP address and browser information, which reach our servers with every request and are used to deliver the service, limit abuse and keep it secure, and the short-lived request logs our hosting provider keeps.
3.8 Data stored in your browser
Your browser keeps your sign-in session, your language, the Studio’s autosaved scene, your presets and shot list and a few interface preferences in its local storage. Unless you switch usage measurement off (3.9), it also keeps a random visitor ID for 30 days and a session ID for the browser session, used only for that measurement. We do not use advertising cookies, and we do not run third-party trackers or analytics services.
3.9 Usage measurement
To find where the product works and where it fails, Lenci records a few events on its own servers: a visit, the AI route you choose, an export started, a step that failed and its reason category (for example “quota” or “network”), with the random visitor and session IDs, a traffic-source category (direct, Google, Instagram, Facebook, TikTok, X, e-mail, referral or other; never the address you came from or campaign text) and, when you are signed in, your account and the IDs of the shoot or result concerned. The service itself also records, for signed-in accounts, the sign-up, a prepared shoot, a stored result and a provider request or failure. No content, prompt, image or file name is recorded, and nothing is shared with a third party. The events are deleted after 30 days; the date of your first export is kept with your account until it is deleted. You can switch measurement off for your browser with “Usage measurement” under Your privacy choices at the top of this page; a browser that sends the Global Privacy Control signal is never measured.
4. Legal bases for processing
- Performance of our contract with you: your account, generating images, videos and text, credits, plans, payments and invoices, support.
- Your consent: connecting outside accounts and publishing through them, adding photos of real people as your own models, and any optional feature that asks for it. You can withdraw consent at any time without affecting earlier processing.
- Legal obligations: keeping invoices and payment records, answering lawful requests from competent authorities.
- Legitimate interests, where the law allows: securing the service, preventing fraud and abuse (including keeping a one-way hash of your e-mail address so the free sign-up credits are given once), diagnosing failures and improving the service from the usage measurement in 3.9, which you can switch off.
5. What we use your data for
- To run the Studio and its AI features: generating and editing images and videos, writing campaigns, captions and suggestions, and answering your support questions.
- To manage your account, credits, plan, payments and invoices.
- To send service e-mails: welcome, payment confirmations and receipts, renewal reminders, low-credit reminders (which you can stop from the link in the e-mail) and replies to your support requests. We do not send marketing e-mails without your consent.
- To publish or export to the accounts you connect, only when you ask or schedule it.
- To keep the service secure, prevent fraud and abuse, and comply with the law.
We do not sell your personal data, and we do not use your content to advertise Lenci without your permission.
6. Service providers and recipients
We share only what each provider needs for its task, under agreements that bind it to protect your data:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Railway | Hosting of the application, its database and the files stored for you | All service data | European Union (Amsterdam, Netherlands) |
| Supabase | Sign-in: one-time e-mail links and Google sign-in | E-mail address, name, profile picture, sign-in records | Supabase cloud (United States company) |
| Google sign-in, when you choose it | Your Google account identity | As determined by Google | |
| OpenAI | Image generation and editing; writing (campaigns, captions, concepts, styling and support answers) | The prompt, the brief and the reference images a request needs | United States |
| xAI | Grok image and video generation; writing when OpenAI is unavailable | The prompt, the brief and the reference images a request needs | United States |
| Moyasar | Payments in Saudi riyals (mada, cards, Apple Pay) | Amount, description, payment status; the card details you enter on Moyasar’s page | Kingdom of Saudi Arabia |
| Resend, or our SMTP e-mail provider | Sending service e-mails | E-mail address, name, the content of the e-mail | United States (Resend) |
| Jev System One (TypeSafe) | Marketing decisions for Nawaa campaigns (category, tone, platforms, posting times) | Your brand profile (business information, no account data) | Provider-hosted cloud |
| Google Fonts, jsDelivr | Delivering fonts and open-source browser libraries | IP address and browser information, as in any web request | Global content delivery networks |
6.1 Services you choose to use
Some features send data to services you pick and govern with your own account: the outside accounts you connect and publish to; “Shoot with my own AI” and task links, which hand a brief and your reference images to the AI tool you choose (such as ChatGPT, Grok, Claude, Copilot, Gemini or Midjourney); and OpenClaw, which runs on your own computer with the agent token you create. Their own terms and privacy policies apply to what they receive. Websites you publish are public at their address.
6.2 Authorities
We disclose personal data to a competent authority only when the law requires it.
7. Transfers outside the Kingdom
Our servers are in the European Union and our AI providers are in the United States, so your data is processed outside the Kingdom of Saudi Arabia. Under Article 29 of the PDPL and its Transfer Regulation, we transfer only the minimum data each purpose needs, because the transfer is necessary to perform our contract with you, and with contractual safeguards from each provider. Payments are processed in the Kingdom by Moyasar.
8. How long we keep data
| Data | Kept for |
|---|---|
| Account, profile and settings | While your account is open; erased 7 days after you delete your account (a request by e-mail is scheduled within 30 days, with the same 7 days) |
| Library (uploads, generated images and videos) and other content | Until you delete it or your account |
| Brand memory | Until you retract it or choose “Forget everything”, and according to the retention you set in Memory → Settings |
| “Shoot with my own AI” links and task links, with their reference images | 24 hours, then the link expires and its references are deleted |
| Connected-account tokens | Until you disconnect the account or delete your Lenci account |
| Support conversations | While your account is open |
| Records of the e-mails we send you | 90 days |
| Activity log of your connected accounts (tool, time, result) | 180 days |
| Usage measurement events (3.9) | 30 days; the date of your first export until your account is deleted |
| Security and administration logs | 1 year (administrators’ activity log); 2 years (operator actions on accounts) |
| Invoices, payments and the related credit records | As long as Saudi accounting and tax rules require (up to 10 years), even after your account is deleted, limited to that purpose and without your name or e-mail address |
| A one-way hash of your e-mail address | After your account is deleted, only to prevent a second free sign-up grant |
| Encrypted backup copies of the service | Up to 14 days, replaced every day; used only to restore the service after an incident, and an account deleted before a restore is deleted again |
| Hosting request logs | The hosting provider’s short log retention |
| Copies held by AI providers | Under each provider’s own API retention policy (typically for abuse monitoring) |
9. Your rights under the PDPL
- To be informed of how your data is processed (this Policy).
- To access your personal data and obtain a copy of it in a readable format (“Download my data”).
- To correct inaccurate or incomplete data.
- To have your data destroyed when it is no longer needed, subject to the records the law requires us to keep.
- To withdraw your consent at any time, for processing based on consent.
- To object to or ask us to restrict processing in the cases the law provides.
10. How to exercise your rights
Many rights work directly in the product: download all your data in one file (“Download my data” under Your privacy choices above or on Account deletion), download or delete any item in your Library, export or erase your brand memory (Memory → Settings), disconnect outside accounts (Connections), revoke agent tokens (Developers) and switch usage measurement off. To delete your whole account yourself, use “Delete my account” on Account deletion: it is erased 7 days after you confirm, and you can cancel during those 7 days.
For anything else, send a request from your signed-in account through Support, or write to dpo@lenci.ai from the e-mail address of your account. We may ask you to confirm your identity. We answer within 30 days, or tell you within that time why we need longer and for how long. Exercising your rights is free of charge.
11. Cookies and local storage
Lenci sets no advertising cookies and uses no third-party analytics. Your browser’s local storage keeps your sign-in session, your language, your autosaved scene, presets and interface preferences so the Studio works as you left it, and the measurement IDs described in 3.9 unless you switch measurement off. You can clear them in your browser’s site settings at any time; this signs you out and resets the Studio.
12. Children
Lenci is not intended for anyone under 18. We do not knowingly collect data from minors. If we learn that an account belongs to a minor, we close it and delete its data.
13. Security
All traffic is encrypted with TLS. Tokens of connected accounts are sealed with AES-256-GCM. Agent tokens and share links are stored only as SHA-256 hashes. AI provider keys stay on our servers and never reach the browser. Uploaded images are checked before they are accepted. Administrator access is limited to named administrators and every administrative action is recorded; the administration dashboard shows account metadata, not your prompts or images, and support messages are read only by the team that answers them.
14. Personal data breaches
If a breach of personal data occurs, we notify SDAIA within 72 hours of becoming aware of it, and we inform you without undue delay when the breach may harm you, as the PDPL requires.
15. Complaints
If you believe we process your data in breach of the PDPL, contact us first at dpo@lenci.ai. You may also complain to the Saudi Data and Artificial Intelligence Authority at sdaia.gov.sa.
16. Changes to this Policy
We may update this Policy when the service or the law changes. We announce material changes by e-mail or with a clear notice in the product at least 14 days before they take effect. The date at the top shows the current version.
17. Governing law and language
This Policy is governed by the laws of the Kingdom of Saudi Arabia. It is published in Arabic and English, and both versions are binding; if they differ, the Arabic version prevails.
18. Contact
- Data Protection Officer: dpo@lenci.ai
- Privacy questions and deletion requests: privacy@lenci.ai
- Legal matters: legal@lenci.ai
- Support: support@lenci.ai
- Siyada Technology, Riyadh, Kingdom of Saudi Arabia. To receive our registered postal address, write to legal@lenci.ai.