Privacy Policy

Version 2026-08 · Last updated 9 August 2026

This explains what personal data we collect through BANA FACES, why, where it is kept and what you can ask us to do with it. It is written to be read, not to be survived.

Who is responsible

The data controller is:

Bana Studio Ossas, S.L.
Calle Acuerdo 36, 4.º C · 28015 Madrid, Spain
NIF B01817865 · VAT ES B01817865

Contact: faces@bana.studio.

What we collect, and why

If you write to us

The contact form collects your name, work email, company, what you are asking about, your message and the IP address the message came from. We use it to answer you and to keep a record of the conversation. The lawful basis is that you asked us to get in touch — steps taken at your request before a possible contract.

The IP address is kept for one reason: to be able to block an abusive source without closing the form for everyone. It is not used to profile anyone and it is never shown in our admin panel.

If you have an account

For people at client organisations we hold an email address, the brands the account may see, and authentication records. The lawful basis is the contract between us and your organisation.

If you use the catalogue

With your consent, we record which models an account opens and which ones it adds to a project. We use this for one purpose: to understand what your brands are looking for so we can produce models that fit it.

Two limits, and they are the point of the whole design:

• We aggregate by brand, never by person. The account identifier is stored because it is needed to count distinct clients, but no screen inside BANA shows what any individual person looked at.
• We do not mix data between companies. One client's activity never appears in another's figures, not even aggregated.

This is asked for separately, inside the platform, and it is recorded by version: if we change what we do with it, we ask again. You can decline and still use the catalogue.

If you tick the updates box

We use your email to tell you about new faces and releases, on the basis of your consent. Every message carries a way to stop, and you can also write to us.

What we don't do

We do not sell personal data, we do not share it with advertisers, we run no advertising or analytics trackers, and we make no automated decisions that produce legal effects for anyone.

Cookies

The site does not use advertising or analytics cookies, which is why it does not greet you with a banner. It stores two things in your browser: the session that keeps you signed in, and a local copy of the catalogue so the grid appears immediately when you come back. Both are strictly necessary to provide the service you asked for. Clearing your browser data removes them, and signing out clears the catalogue copy.

Who else touches the data

We keep the platform small on purpose. Two providers process data on our behalf:

• Google Cloud / Firebase — hosting, database, file storage, authentication and server functions. Our database is in Belgium and our storage and functions are in Belgium, so catalogue and account data stay in the European Union.
• Resend — delivery of the emails we send. It is based in the United States, so message content passing through it leaves the EU under the safeguards its data processing agreement provides.

Both are bound by data processing agreements. We do not pass personal data to anyone else unless the law requires it.

How long we keep it

• Contact messages: up to two years from the last exchange, unless they become part of a contract, in which case they follow it.
• Account data: for as long as your organisation has access, plus the period required by commercial and tax law.
• Usage records: up to two years, after which they survive only as aggregate figures that identify nobody.
• Consent records: for as long as the consent is relied on, plus the period needed to prove it was given. These are not deleted on request, because deleting the proof of a permission is not in anyone's interest.
• Marketing consent: until you withdraw it.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit or object to what we do with it, or to receive it in a portable form. Where we rely on consent, you can withdraw it at any time, and doing so does not affect what was done before.

Write to faces@bana.studio. We answer within one month. If you think we have handled it badly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos.

The models are not personal data

Worth saying plainly, because it is the question we get most: the faces in the catalogue are generated from written descriptions. They are not photographs of real people, no real person's image was used to make them, and they carry nobody's personal data.

Changes

If we change this policy we raise the version number at the top. If the change affects something you consented to, we ask again rather than assume.

The rules for using the catalogue are set out separately in our Terms of Use.