Privacy Policy

1. Introduction

Welcome to CM Studio, LLC (“we,” “our,” or “us”). We provide a comprehensive cosmetic formulation web application that empowers businesses and individuals to manage proprietary formulas, raw material inventory, client relationships, production lifecycles (including batches and samples), testing procedures, regulatory documentation, and AI-driven formulation suggestions (collectively, the “Services”).

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Services. This policy applies to all users globally, with specific provisions for residents of the United States and the European Economic Area (EEA), United Kingdom (UK), and Switzerland.

2. Information We Collect

We collect information directly from you, automatically through your use of the Services, and through third-party integrations.

• Account & Contact Information: Name, email address, phone number, physical address, and company name.
• Financial Information: We use Stripe to process payments and subscriptions. We do not directly store your full credit card numbers; this data is securely handled by Stripe.
• User Content & Production Data: Files, raw material data, proprietary formulas, production batch records, sample tracking, testing results, and regulatory documentation you upload or generate.
• Client Management Data: Information you input regarding your own clients or customers (e.g., names, contact info, project briefs) to manage them within our platform. (Note: For our B2B users, we process this specific data strictly on your behalf as a “Data Processor” according to our Data Processing Agreement).
• AI Interaction Data & Chat History: Prompts, queries, and parameters you input into our AI formulation assistant. We securely store logs of your AI conversations within your account so you can view your past sessions and reference previous work at any time.
• Usage & Device Data: IP address, browser type, interaction metrics, and device identifiers.

3. Artificial Intelligence & OpenAI

Our Services utilize artificial intelligence powered by the OpenAI API to provide formulation suggestions and regulatory insights. We apply commercially reasonable safeguards to protect your proprietary formulation data.

• Your Chat History is Stored by Us: To provide you with a seamless experience, CM Studio, LLC securely stores your AI conversation history within our own databases (hosted on Google Cloud) so you can access your past formulation logs whenever you log in.
• No Data Training: We do not use your proprietary User Content, formulas, or chat history to train our own foundational AI models. OpenAI does not use data submitted through its API to train or improve its models unless we explicitly opt in. OpenAI may retain API inputs, outputs, and conversation state in accordance with its data retention policies.

4. How We Use Your Information & Legal Basis

For users in the EU/UK, the GDPR requires us to state our legal basis for processing. We use your data for the following purposes:

Data Category	Purpose of Processing	EU Legal Basis (GDPR)
Account & Financial Info	To provide the platform, process subscriptions via Stripe, and manage your account.	Performance of a Contract
User Content, Production & Client Data	To host your files, facilitate batch tracking, manage your client CRM features, and provide AI formulation suggestions.	Performance of a Contract
Contact Information	To send transactional emails and support replies via Mailgun, and account or marketing communications via Omnisend.	Performance of a Contract / Legitimate Interest / Consent (for marketing)
Usage & Device Data	To maintain platform stability and security and, where consent is required, provide analytics through Google Analytics.	Legitimate Interest (stability and security) / Consent (analytics)
All Categories	To comply with legal obligations, tax laws, and court orders.	Legal Obligation

5. How We Share Your Information & Subprocessors

We do not sell your personal information for monetary compensation. We share information with trusted third-party service providers necessary to run our platform. Their legal role may vary depending on the processing activity:

• Cloud Hosting, Database, Storage & Caching: Google Cloud (hosts the application and provides database, file storage, caching, real-time application, task processing, and operational logging services).
• Payment Processing: Stripe.
• Transactional Email: Mailgun.
• Email & Marketing: Omnisend.
• AI & Machine Learning: OpenAI.
• Address Search: Google Maps Platform, including Google Places.
• Analytics & Advertising: Google Analytics and LinkedIn.
• Cookie Consent Management: CookieYes.

6. Retargeting and the “Sale” or “Sharing” of Data (US State Laws)

While we do not sell your data for money, we use cookies and tracking pixels (specifically Google Analytics and the LinkedIn Pixel) to serve you retargeted advertisements after you leave our site.

Where consent is required, CookieYes prevents non-essential analytics and advertising technologies from loading until you grant consent. You may withdraw consent or change your preferences at any time through our cookie preferences.

Under certain US state laws (including the California Privacy Rights Act (CPRA), and similar laws in VA, CO, TX, etc.), sharing data with advertising platforms for cross-context behavioral advertising is considered “selling” or “sharing” data.

• Your Right to Opt-Out: US residents have the right to opt out of this sharing. You can do so through our cookie preferences, managed by CookieYes.

7. International Data Transfers

CM Studio, LLC is based in the United States, and Personal Data may be processed in the United States and other countries where our service providers operate. Where Applicable Data Protection Law restricts an international transfer, we use appropriate safeguards, including the European Commission’s Standard Contractual Clauses where applicable, together with supplementary measures where required. You may contact us to request additional information about the safeguards applicable to your Personal Data.

8. Your Privacy Rights

A. US State Privacy Rights

Depending on your US state of residence, you have the right to:

• Know/Access: Request a copy of the personal information we hold about you.
• Delete: Request the deletion of your personal information.
• Correct: Request corrections to inaccurate data.
• Opt-Out: Opt out of targeted advertising via our cookie manager.

B. European (GDPR) Privacy Rights

If you are located in the EEA, UK, or Switzerland, you have the right to:

• Access & Portability: Receive your data in a structured, machine-readable format.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your data.
• Restrict/Object: Object to our processing or restrict how we use your data.
• Withdraw Consent: Withdraw consent for marketing emails at any time.

To exercise any of these rights, please email us at support@cmstudioplus.com. We will respond within the period required by applicable law. For requests governed by the GDPR, this is generally one month, subject to legally permitted extensions.

9. Data Security and Retention

We implement commercially reasonable administrative, technical, and organizational safeguards, leveraging Google Cloud infrastructure, to protect your data, intellectual property (formulas), and client records. We retain account and formula data while your account is active and thereafter for a limited period as reasonably necessary to provide data export or account-recovery options, comply with legal obligations, resolve disputes, enforce our agreements, prevent fraud, maintain security, and complete normal backup lifecycles. Data is then deleted or de-identified in accordance with our retention procedures, subject to legal holds and regulatory retention requirements.

10. Contact Us

If you have questions regarding this Privacy Policy, please contact us at:

CM Studio, LLC
1213 S 30th Ave, Hollywood, Fl, USA
support@cmstudioplus.com