How this policy applies
Bespokable is the operator of the service. This policy explains how we handle personal information when you visit or use it; questions about this policy can be sent to [email protected]. Studios and their users generally control the client and commission content they enter; Bespokable generally processes that content to provide the service. Bespokable independently controls account, security, billing, support, and operational information used to run Bespokable.
Users should have authority to submit client data. Freeform content and media may contain personal or sensitive information; the service is not intended for unnecessary sensitive data.
Information we handle
- Account and access: name, email, profile image, verification and session information, IP address, user agent, and hashed or authentication credentials.
- Studio and commission work: studio name, slug, branding, contact details, members and invites; client names and emails; commission details, notes, requirements, provenance, timeline rich content, uploaded media and metadata, payment schedules, amounts and status, Stripe IDs, and activity records.
- Communications and operations: waitlist, support, and email content; technical logs and request IDs; HMAC-derived rate-limit identifiers; and optional scrubbed Sentry diagnostics.
- Automatic information: normal request and network metadata, including approximate location that may be inferred from an IP address. We do not collect GPS or other precise device location through the service.
Published timelines and shared links
Studios control whether to publish a timeline. Anyone with its private share link can view a published timeline without signing in to Bespokable, and a link can be forwarded. A published view may include a client name, commission details, media and captions, studio branding, and, where the studio chooses, amounts.
Uploaded media receives direct bearer-accessible asset URLs independently of timeline publication, so anyone with an URL may access it. If an asset URL was separately retained or shared, removing or hiding a timeline does not guarantee that the previously distributed URL is revoked. Published timelines are not automatically unpublished when a Bespokable subscription lapses. Studios should review amount visibility before publishing, since it is initially enabled by default.
Why we use information
We use information to create and maintain accounts and studios, provide the commission registry and timelines, process payments and subscriptions, send service messages, respond to support, prevent abuse, secure and improve the service, and meet legal obligations.
We do not sell personal information or share it for cross-context behavioral advertising.
Service providers and disclosures
We use Railway for hosting, logs, PostgreSQL, and Redis; Cloudflare for proxy/CDN services and R2 media storage; Stripe and Stripe Connect for billing, payments, and hosted KYC flows; Resend for email; and, when configured, Sentry for scrubbed technical diagnostics. Google Fonts may receive browser requests when pages load.
Bespokable does not receive full card or bank credentials submitted on Stripe-hosted flows. We may also disclose information where needed for a business transfer, to comply with law, or to protect the safety, rights, and security of Bespokable, our users, or others.
Waitlist email may be added to a Resend-managed contact list and used for waitlist or product-launch updates. To leave the waitlist or stop those updates, email [email protected].
Legal bases and international processing
Depending on context, we may process information to perform a contract or service request, for legitimate interests in operating, securing, and improving the service, to meet legal obligations, or with consent where required. Our providers may process information in countries outside your residence, and Bespokable will use protections required by applicable law.
Cookies
We use essential authentication and session cookies; unchecking Remember me limits
authentication cookies to the browser session. We also use an up-to-24-hour pendingVerificationEmail cookie during registration and verification, and the one-year bespokable-nav-compact preference cookie. Stripe-hosted pages may use cookies under Stripe’s policies. Bespokable
has no preference center; browser controls can delete or block cookies, though blocking
essential cookies can prevent sign-in. See our Cookie Policy for details.
Retention and security
We retain information for as long as needed for the purposes described here, our legal obligations, dispute resolution, and legitimate operational needs. Backups, security records, and legal records may persist for as long as needed for those purposes.
We use reasonable technical and organizational safeguards, but no online service can guarantee absolute security.
Your rights and choices
To request access, correction, deletion, portability or export, or to object to or restrict processing where applicable, email [email protected]. You may also withdraw consent where processing depends on it and appeal a decision about a request where applicable. These are manual requests; Bespokable does not currently offer self-service export or deletion tools.
We may ask to verify your identity before acting. An authorized agent may be asked for proof of authorization and identity verification.
You may also complain to the data protection authority or regulator where you live.
Children and updates
Bespokable is not directed to people under 18. If you believe a person under 18 has provided personal information, contact us at [email protected] so we can consider deletion.
We may update this policy as our practices change. The effective date and version above identify this edition, and we will provide notice of material changes as appropriate.