Privacy Policy — Studio by Sadé
Last updated: 9 September 2026
This policy explains what Studio by Sadé collects, why, and what you can do about it. It describes the service as it works today. Where something is not yet live, this policy says so rather than describing it as if it were.
Studio by Sadé is operated by Sadé ("we", "us"). If you have a question about this policy, contact us at hello@studiobysade.org.
1. What Studio by Sadé is
Studio by Sadé sells digital-product creation tools that run inside ChatGPT. To use a paid tool you create a Studio by Sadé account and connect it to ChatGPT. Our service confirms whether your account is allowed to use the product you are asking for.
We do not run the AI that generates your products. That is OpenAI's ChatGPT. See section 8.
2. Information we collect
Information you give us
| What | When | Why |
|---|---|---|
| Email address | When you create an account or sign in | It is your account identifier and the only way we can send you a sign-in link |
That is the entire list. We do not ask for your name, address, phone number, or date of birth. We do not have a password field, so there is no password to store.
Information created by using the service
| What | Why |
|---|---|
| Account record — your email, account status, and when the account was created | To know the account exists and whether it is active |
| Entitlements — which products you may use, at what level, when access was granted, and any expiry | This is the core of the service: it is how we answer "may this customer use this product?" |
| Membership record — a plan name and status, if one has been recorded for you | Billing bookkeeping. It does not by itself grant access to anything |
| Sign-in records — one-time sign-in links and their expiry, and the access tokens issued when you connect ChatGPT | To sign you in, and to let you disconnect |
| Connection records — that your ChatGPT connection exists, and when it was last used | To keep you signed in and to let access be revoked |
Information we do not collect
- We do not receive your ChatGPT conversations. When a Studio by Sadé tool checks your access, our service is told only which product is being asked about. We never see your prompts, your uploads, or anything the AI generates.
- We do not store the products you create. They exist in your ChatGPT session and wherever you save them. They never reach our servers.
- No payment card details. We do not currently process payments (section 6), and if we do in future, card details will go to the payment provider and not to us.
- No advertising or tracking cookies. No analytics profile, no third-party trackers, no cross-site tracking.
- No sensitive categories — no health, biometric, financial, racial, religious, political, or precise-location data.
Cookies
We use exactly one kind of cookie: a sign-in cookie for the private admin dashboard, which only the business owner uses. It exists so the owner stays signed in. It is not used for tracking, advertising, or profiling. Customers do not receive any cookie from us.
3. How we use your information
We use it only to:
- Create and identify your account
- Send you a sign-in link when you ask for one
- Decide whether you may use a product you are asking to use
- Keep a record of what access you were given, so it can be renewed, changed, or ended
- Answer you if you contact us
- Keep the service secure and working, and meet our legal obligations
We do not sell your information. We do not share it for advertising. We do not use it to train AI models.
4. Where we operate, and which rules apply
Studio by Sadé is operated from the United States. Customers buy from many countries, so more than one set of rules can apply at once. Rather than guess which applies to you, we give everyone the same rights — see section 9.
United States
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either, and there is no opt-out to configure because there is nothing to opt out of.
We do not collect sensitive personal information as US state privacy laws define it — no precise location, no biometric or health data, no financial account details, no racial, religious or sexual-orientation data.
Which state law applies depends on where you live and on our size; several US states now grant privacy rights to their residents. The rights in section 9 are offered to every customer regardless, so you do not need to work out which law covers you.
Legal basis (UK/EU)
Where UK or EU data-protection law applies — which it can, because we sell to customers there:
- Performance of a contract — creating your account, signing you in, and confirming your access. Without this the product cannot work.
- Legitimate interests — keeping the service secure and preventing abuse, balanced against your rights.
- Legal obligation — where we must retain records to comply with law.
We do not rely on consent for any of the above, because none of it is optional to the service. There is no marketing profiling to consent to.
5. Who we share it with
We use a small number of service providers. Each receives only what it needs.
| Provider | What it handles | What it receives |
|---|---|---|
| Neon (database hosting) | Stores accounts, entitlements, memberships, sign-in records | Everything in section 2 |
| Vercel (application hosting) | Runs the Studio by Sadé service | Ordinary web-request data such as IP address and timestamps |
| Resend (email delivery) | Sends sign-in emails | Your email address and the message |
| OpenAI (ChatGPT) | Runs the plugins you use | See section 8 |
We share information with no one else, except where we are legally required to, or where it is necessary to establish or defend a legal claim.
International transfers. We operate from the United States, and these providers may process data in the United States and elsewhere. If you are in the UK or EU, your information will be transferred outside your country. Where that happens, transfers rely on the safeguards these providers have in place, such as standard contractual clauses.
6. Payments — not yet live
We do not currently process payments through this service. There is no payment provider connected. Access is granted manually by the owner.
If payment processing is added later, we will update this policy before it goes live and will say who the payment provider is. Card details would be handled by that provider directly; we would expect to receive only a confirmation that a purchase happened and which product it was for.
Nothing in this policy should be read as a claim that any particular payment provider is connected today.
7. How long we keep it
| Record | Kept for |
|---|---|
| Sign-in links | Minutes — they expire quickly and are single-use |
| ChatGPT connection tokens | Until they expire or you disconnect |
| Account, entitlement and membership records | While your account exists, and afterwards only as long as needed for records, disputes, or legal obligations |
| Email you send us | As long as needed to deal with it |
Entitlement history is kept even after access ends, so that "who had access to what, and when" remains answerable. If you ask us to delete your account, we delete or anonymise what we are not required to keep.
8. ChatGPT and OpenAI — please read this
Studio by Sadé products run inside ChatGPT, which is operated by OpenAI, not by us. This distinction matters:
- Your conversations with ChatGPT are governed by OpenAI's privacy policy and your settings in your OpenAI account, not by this policy.
- We cannot see, retrieve, or delete your ChatGPT conversations. If you want conversation data removed, you must do that through OpenAI.
- When you connect Studio by Sadé, ChatGPT tells our service which product is being asked about, and nothing else about the conversation.
- We identify you only from your authenticated Studio by Sadé sign-in. If an email address is typed into a ChatGPT conversation, our service ignores it for access purposes. Nobody can gain access to your account by typing your email.
9. Your rights
Depending on where you live, you may have the right to:
- Access the information we hold about you
- Correct it if it is wrong
- Delete it, subject to records we must keep
- Object to or restrict how we use it
- Take it with you in a portable format
- Withdraw consent, where we relied on consent
- Complain to a data-protection regulator — in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, your national authority; in the US, your state Attorney General
We give every customer these rights, wherever you live, rather than only where a particular law requires it.
To exercise any of them, email hello@studiobysade.org. We will respond within one month, and sooner where the law requires it. We will not charge you, refuse you service, or give you a worse price for asking — that would be unlawful in several places and wrong everywhere.
Because we hold so little about you, most of these requests are quick to answer.
10. Security
- Sign-in links are single-use and short-lived.
- Access tokens are stored hashed, never in a form that could be reused if the database were exposed.
- All traffic uses HTTPS.
- Access to a product is checked on every request, so revoked access stops working immediately rather than at the next renewal.
- The admin dashboard is restricted to a specific allowlist of addresses.
No system is perfectly secure. If a breach affects your rights, we will notify you and the relevant regulator as the law requires.
11. Children
Studio by Sadé is for adults running a business. It is not directed at children and we do not knowingly collect information from anyone under 16. If you believe a child has created an account, email us and we will delete it.
12. Changes to this policy
If we change this policy we will update the date at the top. For changes that meaningfully affect you — a new provider, a new category of data, or payments going live — we will tell you by email before the change takes effect.
13. Contact
For data-protection requests, please put "Privacy" in the subject line.