Who processes your data
The controller is Stellaria, domiciled in Mexico. For anything related to this notice, including exercising your rights, write to admin@stellaria.app.
What we collect
We collect only what Rosette needs to work. It falls into four groups:
Identity and account: your email and the basic profile Google hands us when you sign in with your account.
Content you create: your avatar descriptions, and the images, videos, audio and conversations you generate on the platform.
Reference images: the photographs you upload to define an avatar's identity.
Preferences and usage: language, currency, whether you already declared your age, and the roset consumption tied to your account.
Sensitive data: images of faces
The photographs you upload to define an avatar may contain facial features, and Mexican law treats biometric data as sensitive personal data. Processing it therefore requires your express consent, which you give when you upload a reference image.
We make two concrete commitments about these images: they are stored in Amazon S3, and they are not used to train artificial intelligence models, ours or anyone else's. They exist solely to generate the content you ask for with the avatar you created.
Only upload images of yourself or of people who have explicitly consented to this use. Uploading someone else's face without their permission breaches these terms and, depending on the case, the law.
What we use it for
These purposes are necessary to provide the service: without them, Rosette cannot work.
Creating and maintaining your account, and authenticating you when you sign in.
Generating the content you request and keeping your avatars' identity consistent between one generation and the next.
Processing your payments and tracking your roset balance.
Handling your support requests and any request you file about this notice.
Meeting the legal and tax obligations that apply to us.
Who we share it with
We do not sell your personal data. We share it only with the providers that make the service possible, and only to the extent each one needs:
Stripe, to process payments. Your card details go to Stripe directly and are stored by Stripe: Rosette never holds them.
Amazon Web Services, where content and reference images are hosted.
Google, when you choose to sign in with your Google account.
How long we keep it
We keep your data while your account is active. When you delete an avatar, a studio or your whole account, the associated content is deleted too, including the reference images stored in S3.
The only exception is records we are legally required to retain, such as tax receipts for your payments, kept for the period Mexican law sets.
Your ARCO rights
You can access your data, rectify it if it is inaccurate, cancel it when you believe we no longer need it, and object to specific uses. You can also withdraw at any time the consent you gave us, including for reference images.
To exercise them, write to admin@stellaria.app stating which of the four rights you are exercising, and do so from the email tied to your account so we can verify your identity. We will respond within the periods set by law.
If you believe your request was not handled properly, you may turn to the Secretaría Anticorrupción y Buen Gobierno, the competent authority for personal data protection.
Cookies
Rosette stores in your browser your language, your currency, whether you already declared your age, and your signed-in session. We use no advertising or cross-site tracking cookies.
Changes to this notice
If we change this notice, we will publish the new version at this same address and update the date in the header. When a change affects the purpose of processing, we will tell you by email before it takes effect.