Envelope Privacy Policy

Last updated: 29 October 2026.

1. Who we are and what this policy covers

Envelope is a brand of NOSIDE, a French limited liability company (société à responsabilité limitée) with a share capital of €1,000, registered with the Paris Trade and Companies Register (RCS) under number 497 671 651, whose registered office is at 94 rue Saint-Lazare, 75009 Paris, France ("Envelope", "we"). NOSIDE is the controller of the personal data described in this policy, except where it acts on behalf of its clients (see section 4).

This policy applies to:

• our website envelope.app and our business dealings (prospects, clients, partners, suppliers);
• the Studio platform, an AI-assisted creative tool made available to our clients' teams;
• the Scale platform, an e-commerce visual production tool operated by our teams, which our clients' teams access to upload files and to track and approve production;
• our bespoke production services (campaigns, films, editorial visuals).

It describes the data we process, why, with whom and for how long, and the rights you have. It is written in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).

Our clients are businesses. We do not process consumer data on our own behalf and our services are not directed at minors.

2. The data we process

We only collect the data necessary for our relationship with you and for the operation of our platforms.

We do not process any so-called sensitive data (origin, opinions, health, sexual orientation, biometric data) on our own behalf. The content our clients entrust to us may depict people; we then process it solely on their instructions.

3. Why we process your data

Each processing operation is based on one of the legal bases set out in Article 6 of the GDPR.

We do not make any automated decisions producing legal or similarly significant effects on individuals, and we do not carry out profiling.

4. Our clients' content and artificial intelligence

The files, images, prompts and visuals that our clients entrust to us or create on our platforms (the "Content") belong to them. Where this Content includes personal data, for example a model's image, our client is the controller and Envelope acts as a processor within the meaning of Article 28 of the GDPR. We process it solely on our client's instructions, under the contract and the data processing agreement that accompanies it. People depicted exercise their rights with our client, whom we assist.

AI models used. Envelope does not train any foundation model. Our platforms orchestrate generative AI models supplied by third parties (in particular Google, OpenAI, Anthropic, Alibaba Cloud and Freepik), to which we transmit, per request and through an encrypted API, only the images and instructions needed for each generation. The models process this data transiently to produce a result. The list of active providers is kept up to date in our register of sub-processors, which is provided to our clients.

No training on your data. We do not use our clients' Content, prompts, outputs, logs or metadata to train, fine-tune, test or improve any AI model, unless the client has given prior written consent for a model dedicated to it. We access third-party models through their commercial APIs, whose terms exclude by default the use of inputs and outputs for training purposes, and we do not take part in any data-sharing programme.

Human oversight. The visuals produced by our teams are checked by a graphic designer before delivery. No content generated by our tools has any effect on a person without human intervention.

Transparency. The visuals we deliver are signed with C2PA Content Credentials, a machine-readable marking indicating that they were produced or modified using generative AI, in accordance with Article 50 of the European AI Act. The visible disclosures to be displayed upon publication are our clients' responsibility; we support them on this point.

Generated models. The models in our catalogue are fictional people created by Envelope. They do not reproduce the appearance of real, identifiable people. When a client asks us to work from the image of a real person, the client warrants that it holds the necessary authorisations.

5. Who has access to your data

Your data is accessible only to those members of the Envelope team who need it for their work, and who are bound by a duty of confidentiality. We do not sell or rent your data. We share it only with the service providers that enable us to deliver our services, who are bound by a processing agreement compliant with Article 28 of the GDPR.

We may also disclose data to our advisers (chartered accountant, lawyers), to social security and tax bodies where required by law, and to public authorities upon a lawful request.

This list changes as our tools evolve. Our clients are informed in writing, with 30 days' notice, of any addition or replacement of a sub-processor processing their data, and may object to it.

6. Transfers outside the European Union

Your account data, your files and our backups are hosted in the European Union. Some of our providers are, however, established outside the EU or process data there, in particular AI model providers (United States, Singapore) and certain technical tools.

These transfers are governed by:

• the standard contractual clauses adopted by the European Commission, incorporated into each provider's data processing agreement;
• for US providers certified under it (notably Google and OpenAI), the adequacy decision on the EU-US Data Privacy Framework;
• additional technical measures: encryption in transit, transmission limited to the data needed for each request, no retention requested on the provider's side.

You can obtain a copy of the applicable safeguards by writing to us at the address given in section 11.

7. How long we keep your data

We keep your data for as long as necessary for the purpose pursued, then delete or anonymise it.

Backups are not purged individually: they expire through automatic rotation and are never used to restore deleted data.

8. How we protect your data

We apply technical and organisational measures appropriate to the sensitivity of the data and content entrusted to us:

• encryption of exchanges (HTTPS / TLS) and of files at rest with our hosting providers;
• named accounts, hashed passwords, two-factor authentication (passkey, authenticator app or email code);
• segregation of data by client and by project, role-based access rights, our teams' access limited on a need-to-know basis;
• file access through time-limited signed links, including for model providers;
• logging of connections and actions, daily backups, regular security updates;
• confidentiality obligations in the contracts of our employees, partners and freelancers; processing agreements with our providers.

In the event of a data breach likely to result in a risk to your rights, we notify the CNIL within 72 hours and, if the risk is high, we inform you directly. Our clients are informed without undue delay of any breach affecting the data we process on their behalf.

9. Your rights

You have the following rights over your data:

• access: obtain confirmation that we process your data and receive a copy of it;
• rectification: have inaccurate or incomplete data corrected;
• erasure: request the deletion of your data, within the limits of our legal obligations;
• restriction: request that a processing operation be temporarily suspended;
• objection: object to processing based on our legitimate interest and, at any time, to prospecting;
• portability: receive your account data in a structured, machine-readable format;
• withdrawal of consent for processing that depends on it (trackers), without affecting the lawfulness of past processing;
• post-mortem instructions on what happens to your data after your death.

To exercise these rights, write to us at privacy@envelope.app or by post to NOSIDE, 94 rue Saint-Lazare, 75009 Paris, France. We may ask you for proof of identity if there is any doubt about the identity of the person making the request. We respond within one month, which may be extended by two months for complex requests, in which case we will let you know.

If you use Studio or Scale on behalf of your company, you can also go through its administrator, who will pass the request on to us. If you are a person depicted in content entrusted to us by a client, your request is handled by that client; if it reaches us directly, we forward it to them without delay.

You can lodge a complaint with the CNIL, the French data protection authority (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr).

10. Cookies and trackers

Our platforms use cookies that are strictly necessary for them to work: keeping you signed in, security (protection against request forgery), remembering your display preferences. They do not require your consent.

Subject to your consent, we also use:

You can accept or refuse these trackers through the banner displayed on your first visit, and change your choice at any time from the "Cookies" link in the footer or in your browser settings. Your choice is kept for 6 months. We do not use any advertising trackers and do not share your browsing data with advertising networks.

11. Updates to this policy and contact

We may amend this policy to reflect changes in our services, our providers or the regulations. The version in force is published on our platforms with its update date. In the event of a substantial change, we inform the users of our platforms by email or by a message when they sign in.

For any question about this policy or your personal data:

Last updated: 29 October 2026.