Privacy
Data controller
FutureLegendz is operated by Nexora Systems, a French SAS, registration number 102 580 941. Company details appear in the legal notice. Contact for personal data: hello@futurelegendz.com.
Data and operation
Photo import and initial edits stay in your browser memory. After your consent and an explicit Generate click, a smaller photo copy, re-encoded without the original file metadata, is sent to the server. We process that photo, the generated portrait, your inscriptions and technical session identifiers. A first name and photo are needed; surname, birth date and place, height, country, club, number, honours and dedication are optional. Only enter information you want on the portrait.
Purposes and lawful bases
Photo transformation and preview creation rely on consent (GDPR Article 6(1)(a)). You may withdraw it by deleting the creation or contacting us, without affecting previous lawful processing. Session security, abuse prevention and generation limits rely on our legitimate interest in securing the service (Article 6(1)(f)). Rights requests are handled to meet legal obligations (Article 6(1)(c)). This studio performs no advertising targeting or automated decision with legal effects.
Children and image rights
The studio is for adults. You must have the necessary photo rights and, for a child, authorization from their legal guardian. Creating a portrait does not authorize publication, testimonials or advertising reuse. These require a separate optional agreement. We do not request relatives’ names, accounts or contact details. No facial recognition feature intended to identify people is offered.
Recipients and international processing
Authorized Nexora Systems personnel and necessary service providers may process data. The OpenAI API receives the photo, sport and style instructions; site code does not send names, birth date, club or dedication to it. Sites and Cloudflare provide website, database and private-file infrastructure. Processing outside the EEA is possible; we do not promise exclusively European hosting. Applicable contractual terms and transfer safeguards can be requested at hello@futurelegendz.com; public provider documents are linked below. No data is sent to a printer and no payment is processed in this version.
Retention and deletion
FutureLegendz deletes the stored source copy after a generation attempt. Uploaded photos without completed generation and unpurchased creations expire after 24 hours and become inaccessible. Physical deletion of files and associated inscriptions runs in batches on subsequent service requests; this is not an independent scheduled cleanup. While your session is valid, you can delete a creation immediately from the studio. Generation-limit records are cleaned after 30 days on service requests. Email requests are kept while handled and, where necessary, to substantiate the response or a dispute; identity documents are not routinely requested.
Provider retention
Studio deletion applies to active FutureLegendz files, not instant deletion of provider backups or logs. OpenAI’s public API documentation states that data is not used for training by default; abuse-monitoring logs may be retained for up to 30 days, subject to security exceptions or legal requirements. We do not claim zero retention or a specific European data location for this account.
Your rights
Subject to GDPR conditions, you may request access, correction, deletion, restriction or portability, object to legitimate-interest processing, or withdraw consent. Write to hello@futurelegendz.com with only the information needed to locate your creation; do not resend a child’s photo for a routine request. You may also write to our registered office. We normally respond within one month; a reasoned extension is possible in cases allowed by GDPR. You may complain to the CNIL at cnil.fr/plaintes.
Security and browsing
Creation files are private and session-bound. Sensitive requests are checked and secrets stay on the server. No advertising pixel or analytics tool is installed. Language uses your explicit choice, then browser language, then an approximate technical country supplied by hosting. No GPS permission is requested. Instagram links open an external service with its own policy.