Privacy

In short

Without an account, we collect nothing. Turning your images into patterns happens entirely inside your browser: your photos and drawings are never sent to our servers. Your projects, your bead stock and your settings stay on your device.

An account serves one purpose: finding your creations again on another device. What we keep in that case is described below.

Who is responsible

The controller of this processing is the site's publisher, a private individual acting in a non-professional capacity (see the legal notice). They can be reached at contact@beads-studio.com, the address to which any request about your data should be sent.

What we process

• Your email address, to identify the account and let you recover it if you forget your password.
• Your password, never stored in clear text: only a derived fingerprint (scrypt) is kept. Nobody — not even the publisher — can read it.
• Dates of account creation and last visit, the display language, and the browser identification of open sessions, so you can spot a login you do not recognise.
• The projects you send online: the bead grid, its name and its thumbnail. Only those you send deliberately.
• A technical log: account creations, logins, failed logins, emails sent. It exists to detect abuse and to help you when something goes wrong.

Cookies

Two cookies at most, both necessary to run the site: bs_locale remembers the language you chose, and bs_session — set only if you sign in — keeps your session open. No analytics cookie, no advertising tracker — which is why this site does not throw a consent banner at you.

The application also uses your browser's local storage to keep your projects and settings on the device. That information never reaches us, and disappears if you clear the site data.

Legal basis and retention

Processing rests on performing the service you asked for (GDPR article 6.1.b) and, for the technical log, on our legitimate interest in protecting the service against abuse.

• Account data is kept for as long as the account exists.
• Deleting the account — possible at any time from the account page — immediately erases the account and the projects it holds.
• Database backups are kept for fourteen days before being destroyed, so a deleted account may survive there until that deadline.

Who sees this data

It is neither sold, rented, nor passed on for advertising purposes. Only the providers strictly needed to run the service are involved:

• OVH SAS — hosting of the site and the database (France).
• Brevo (Sendinblue SAS) — sending service emails (France).

No data is transferred outside the European Union.

Your rights

You have the right to access, correct, erase, object to and port your data. In practice:

• Get your creations back: the .perler export button gives you a complete copy, usable elsewhere, without asking us anything.
• Erase your account: from the account page, with one button.
• Anything else: contact@beads-studio.com. We answer within a month.

You may also lodge a complaint with the French data protection authority (CNIL, cnil.fr) or with the authority of your own country.

Minimum age

The application can be used without an account at any age, and nothing is collected then. Creating an account, however, is reserved for people aged 15 or over; below that, it requires the agreement of a parent or guardian.

Security

Traffic is encrypted (HTTPS), passwords are derived and never stored in clear text, sessions can be revoked, and login attempts are rate-limited. Should a data breach put you at risk, you would be informed.