Who is responsible
Sena Studio, LLC, a limited liability company registered in Delaware, USA, runs Sena and decides what happens to your data: in the law’s word, the controller. Its address is 131 Continental Dr, Suite 305, Newark, DE 19713, USA. Write to hello@pleurat.com about anything on this page, or reply to any email from Sena.
What is collected, and why
| Data | Why | On what basis | Kept |
|---|---|---|---|
| Email address | To deliver what you bought, send its receipt, and sign you in | Our contract with you | Until you close the account; on an order, with the order |
| Name, if you give one | To address you in an email | Our contract with you | Until you close the account |
| Password, if you set one | To sign you in. Supabase keeps only a one-way scrambled form of it; nobody, us included, can read it back | Our contract with you | Until you close the account |
| Your Google name and address, if you sign in with Google | To sign you in | Our contract with you | Until you close the account |
| Orders: what, when, for how much, the licence, and the Terms version you agreed to | To give you the files, and because tax and accounting law require records of sales | Our contract with you; a legal obligation | Seven years, as tax law requires |
| Payment reference | To match a refund or a dispute to its sale | Our contract with you; a legal obligation | With the order |
| Download log: when, from which link, and the IP address | To catch a download link that leaked, and to help you if a download fails | Our legitimate interest in protecting the files and the people who paid for them | Twelve months |
| Sign-in and form attempts: the address or IP address, and when | To stop password guessing and floods of requests | Our legitimate interest in keeping accounts safe | A day |
| A studio enquiry: name, work email, company, website, what you asked for, and how you heard about us if you say | To answer you about the project | Steps you asked for before a contract | Two years from when you sent it |
| As a Studio client: your name, email, company and phone, and for invoices your billing address and VAT number if you give them | To give you a project space, sign you in to it and reach you about the work | Our contract with you | While we work together, then six years as the record of the project |
| Your invitation to the project space: a one-time link to choose a password, kept only in a scrambled form | To let you set your password without one ever being emailed | Our contract with you | Until you use it, or fourteen days |
| Your projects: what we agreed, the dates, the timeline, the task board, and the files and links we share with you | To show you where the work stands and hand it over | Our contract with you | While we work together, then six years as the record of the project |
| Requests and offers on a project: what you asked for or we offered, the answers, any fee quoted and when you approved it | To agree extra work, and its price, before it starts, and to invoice it | Our contract with you; a legal obligation, for a fee you approved | With the project; an approved fee, seven years, as tax law requires |
| Invoices on your project: their number, lines, amounts and dates, and when you paid | To bill you for the work and keep the records accounting needs | Our contract with you; a legal obligation | Seven years, as tax law requires |
| An application to sell: name, country, portfolio, sample, and how you use AI | To review your work and tell you our decision | Steps you asked for before a contract | While you are a designer with us; if declined, twelve months after our decision |
| As a designer: the name and address of your page, your country, a line about you, your site | To put your name on your templates, and to know how you would be paid | Steps you asked for before a contract | While you are a designer with us; your name stays on templates already sold |
| A template you send for review: the zip, its design file link, and the decisions behind it | To check it, review it and tell you our decision | Steps you asked for before a contract | The zip until it is decided; the record while you are a designer with us |
| Two-step sign-in, for designers and admins who turn it on: the authenticator key, encrypted, and the recovery codes, as hashes | To ask for a code from your phone when you sign in | Our contract with you | Until you turn it off or close the account |
| Analytics, only if you allow it: the pages you view, what you click, how you arrived, your browser and device, and roughly where you are | To see where visitors get lost, and fix it | Your consent, which you can take back at any time | Up to a year |
Card numbers are never collected. Card details are typed into Stripe’s own secure fields, so they never reach Sena; Sena is told only that a payment succeeded, and a reference for it.
Most purchases are sold through Link, Stripe’s checkout service, which is the seller of record. To sell to you and work out your tax, Link collects your name, email and billing address itself and handles them under its own privacy notice. In the few countries Link does not serve, such as Kosovo, Sena sells directly and Link is not involved.
Analytics, if you allow it
On your first visit, a small box asks whether you allow analytics. Until you say yes, nothing is recorded and nothing is stored. If you do, we see which pages people read, what they click and where they give up, so we can fix what gets in the way.
What is recorded: the pages you view and for how long, what you click and the words on it, how you arrived (the site before and any campaign tags in the link), your browser and device, roughly where you are (worked out from your IP address), and errors on the page. What is not: anything you type, your screen, and any email address or sign-in link, which are taken out before anything leaves your browser.
You can change your answer here at any time, as easily as you gave it. Saying no deletes what analytics stored in your browser.
What is not collected
No advertising trackers, no analytics that follow you between sites, no advertising profiles, and no third-party cookies outside the checkout. A video on a listing loads from YouTube or Vimeo only after you press play. Analytics is off until you switch it on, so Do Not Track and Global Privacy Control find nothing running to switch off.
Who else handles it, and where
Each company does one job and receives only what that job needs:
- Vercel hosts the site. The code that handles your data runs in Dublin, Ireland.
- Supabase keeps the database, the accounts and the files, in Ireland.
- Stripe takes payments: Stripe Payments Europe, Ltd. in Ireland, and Stripe, Inc. in the United States.
- Resend sends our emails, from Ireland.
- Google signs you in, if you choose Google, and hosts the mailbox that answers you.
- YouTube or Vimeo, only if you press play on a video.
- PostHog records analytics, in the United States, only if you allow it. Lissoss, our analytics tool, serves the small script that asks for your answer, so it receives your IP address and browser details when a page loads. It reads PostHog’s records to show us where visitors get lost, and uses Anthropic’s Claude to describe them, without your IP address.
None of them is paid for your data, and none may use it for anything else. Vercel, Supabase, Stripe, Resend, Google, PostHog and Anthropic are American companies, so even data kept in Ireland can be reached from the United States. Each of those transfers rests on the company’s own data-processing terms: the EU–US Data Privacy Framework where the company is certified under it, and the European Commission’s standard contractual clauses, with the UK’s addendum, where it is not.
Your rights
Wherever you live, you can:
- see what is held about you, and take it elsewhere: on your account page, “Download a copy” gives you all of it in one file;
- correct it;
- have it deleted, by closing your account (below);
- have its use paused while a question about it is settled;
- object to a use that rests on our legitimate interests;
- complain to a data protection authority: in the EU, the one where you live; in the UK, the Information Commissioner’s Office. We would rather hear from you first, and fix it.
In the EU and the UK these are your rights under the GDPR. Everyone else gets the same here anyway, because running two standards is how the lower one wins. Ask using the contact details above; we answer within 30 days, usually the same week.
Closing your account removes your profile, your name and your download history. It does not remove order records: tax law requires them for seven years, and they are reduced to the minimum — what was bought, when, for how much, and the email it was bought under.
If you are a Studio client, closing your account ends your sign-in to the project space. The projects stay with us as the record of the work, for the time shown above. Ask, and we delete the files we shared with you sooner.
If something goes wrong
If data is exposed, the people affected are told what happened, what was reachable, and what changed as a result — in plain language, and without waiting for it to be tidy. Regulators are told where the law requires it.
Changes
When this page changes, the date at the top changes with it. See also the terms of sale.