Terms of Use
1. Operator
Hair Atelier AI (“Service”) is operated by:
Nostro box j.d.o.o.
Jurja Ves III odv. 5, 10000 Zagreb, Croatia
OIB: 58661874766
Brand: Nostro Box AI
Contact: sales@nostroboxai.app
2. Business use, acceptance and authority
The Service is intended for professional and business use by hair salons and other users expressly authorised by Nostro box j.d.o.o. It is not offered as a consumer service for private household use.
By accessing or using the Service, you agree to these Terms and the Privacy Policy. Where express electronic acceptance is requested, access to the Service is conditional on that acceptance.
If you accept these Terms on behalf of a salon, company or other business (“Customer”), you confirm that you are authorised to bind that Customer to these Terms. User accounts are intended for persons aged 18 or older, may be created or assigned by an administrator, and are not transferable unless we expressly approve otherwise.
For Free Trial access, electronic acceptance of these Terms, the Privacy Policy and the Trial Data Processing Terms in Annex A forms the applicable agreement for the Trial period. The Service may record the user ID, date and time of acceptance, and the version of the accepted documents for compliance and evidentiary purposes.
3. What the Service does
Hair Atelier AI allows an authorised user to upload or capture a photograph, select a hairstyle and/or hair color, and request an AI-generated visual preview. The Service may also automatically estimate visible current hair length for compatibility guidance.
AI generation is probabilistic. Results can vary between requests, can contain visual inaccuracies and may alter details beyond the intended hairstyle. The result must be used as a consultation aid, not as a precise simulation or professional guarantee.
4. Hair color and manufacturer references
On-screen color swatches and AI-generated colors are approximate digital previews. They are not manufacturer-certified digital swatches and do not guarantee the outcome of a real chemical color treatment. Actual results depend on starting hair color, hair condition, lighting, formulation, developer, technique and other salon factors.
Product names, shade codes and trademarks belonging to third parties remain the property of their respective owners. Their appearance in the Service is for identification and consultation/reference purposes and does not imply endorsement unless expressly stated.
5. Your photographs, client permissions and lawful use
You retain any rights you hold in photographs you upload. You grant Nostro box j.d.o.o. and its contracted service providers a limited right to process the photograph only as necessary to provide, secure and support the Service.
You must not upload a photograph unless you have the legal right and an appropriate legal basis to do so.
- If the photograph depicts you, you must be entitled to submit it for the requested processing.
- If it depicts another adult, you must have that person's permission or another valid legal basis.
- If it depicts a minor, you must have the required parental/legal guardian authorisation and other lawful basis required by applicable law.
- Professional/salon users are responsible for providing any required privacy notice to their clients and establishing an appropriate legal basis before uploading client photographs.
- The Service must not be used for biometric identification, unlawful profiling or any purpose unrelated to the intended salon consultation use.
6. Free Trial
Hair Atelier AI may be made available to selected professional users on a limited Free Trial basis so that a salon can evaluate the Service before entering into a paid commercial agreement.
- The Trial may be limited by duration, number of AI generations, functionality, number of users or other reasonable evaluation conditions.
- Trial credits are a one-time allowance and do not renew automatically.
- The Trial ends when the Trial period expires, the Trial credits are consumed, access is withdrawn, or another plan is assigned.
- No payment obligation or automatic paid subscription arises solely because the Trial is used or expires.
- Any continuation as a paid customer is subject to separately agreed commercial terms or a B2B service agreement.
- We may extend, restrict or terminate Trial access where reasonably necessary for evaluation management, security, misuse prevention, legal compliance or service capacity.
The Customer's obligations regarding lawful use of photographs and personal data apply during the Free Trial in the same way as during paid professional use. Annex A governs processing carried out by Nostro box j.d.o.o. on behalf of a Trial Customer.
7. Prohibited use
You may not use the Service:
- for unlawful, fraudulent, deceptive, abusive or infringing purposes;
- to upload images you are not authorised to process;
- to harass, exploit or misrepresent another person;
- for biometric identification, deceptive impersonation or unlawful profiling;
- to interfere with, probe, reverse engineer, overload or bypass the Service's security or credit controls, except where mandatory law expressly permits otherwise;
- to resell account access or credits without our written authorisation.
8. Plans and credits
The Service uses generation credits.
- Free Trial: a one-time credit allowance that does not renew automatically.
- Starter, Professional and Studio: included generation credits renew at the beginning of the Customer's individual billing cycle, determined by the applicable activation/subscription date and the agreed commercial terms. Unused included recurring credits do not carry forward into the next billing cycle.
- One-time extra credits: additional credits purchased or manually assigned outside the recurring plan remain available until used, unless different conditions are expressly stated when they are granted or purchased.
- One generation: a completed AI generation normally consumes one credit.
Where the Service detects a technical failure before a completed AI result is produced, a reserved credit is designed to be restored automatically. A completed result still consumes a credit even if the user dislikes the aesthetic result or chooses to generate again.
Credit values and plan allowances may be changed in accordance with applicable commercial terms. Credits are account-based, non-transferable and have no cash value unless expressly stated otherwise.
References in the interface to a billing or credit cycle concern the credit allowance. Pricing, invoicing, payment, renewal, cancellation and other paid-subscription conditions are governed by the separate commercial terms or B2B service agreement applicable to the Customer.
9. Availability and generation interruptions
The Service depends on internet connectivity and third-party infrastructure and AI services. We do not guarantee uninterrupted or error-free availability.
The application should remain open and the device screen active while an AI generation is running where the current technical implementation requires this. Switching applications, suspending the browser or locking the device may interrupt delivery of the generated result.
10. Generated results and permitted use
Subject to applicable law and third-party rights, the Customer may download and use generated results for lawful professional salon consultation and its own business presentation purposes, provided it holds the necessary rights and permissions relating to the source photograph and persons depicted.
We do not warrant that an AI output is unique, free of errors, suitable for a specific commercial purpose, or that similar output will not be generated for another user.
11. Intellectual property in the Service
The Hair Atelier AI software, interface, branding, design, text, databases, documentation and other Service materials, excluding user-provided content and third-party materials, are owned by or licensed to Nostro box j.d.o.o. The Customer receives only a limited, revocable, non-exclusive right to use the Service in accordance with these Terms and applicable commercial terms.
12. Third-party services and subprocessors
The Service relies on third-party providers for AI processing, authentication, database/backend functionality, hosting, serverless functions and email delivery. Their availability and technical behavior can affect the Service.
Where a third party processes personal data on behalf of Nostro box j.d.o.o. in its role as processor, that processing is governed by Annex A and the applicable data-protection arrangements with the relevant subprocessor.
13. Account security
The Customer is responsible for maintaining the confidentiality of its login credentials and for reasonable security of the devices and networks used to access the Service. Users must notify us without undue delay if they suspect unauthorised access to their account.
14. Account suspension and termination
We may disable or terminate an account where reasonably necessary for security, suspected misuse, violation of these Terms, legal compliance, non-payment under separately agreed commercial terms, expiration of a Trial, or discontinuation of the Service. Where appropriate and legally required, we will provide notice.
15. Disclaimer
Hair Atelier AI is a visual consultation tool. It is not professional medical advice, dermatological advice, chemical-treatment safety advice or a substitute for a qualified hair professional's assessment of hair/scalp condition.
To the maximum extent permitted by applicable law, the Service is provided without a guarantee that AI output will be accurate, aesthetically satisfactory, technically uninterrupted or identical to a real-world salon result.
16. Liability
To the maximum extent permitted by applicable law, Nostro box j.d.o.o. is not liable for indirect or consequential losses arising solely from reliance on an AI preview, the actual outcome of a hairdressing procedure, unlawful uploading of content by the Customer, an interrupted generation, account misuse for which the Provider is not responsible, or acts/omissions of independent third-party service providers.
Nothing in these Terms excludes or limits liability that cannot legally be excluded or limited.
17. Privacy and data protection
Our processing of account, contact, security and other personal data for our own purposes is described in the Privacy Policy.
Where the Customer uploads client photographs or other personal data for salon consultation purposes, the Customer generally acts as controller and Nostro box j.d.o.o. acts as processor on the Customer's behalf. For Free Trial users, the processing terms required for that relationship are set out in Annex A below. For paid customers, a separately signed B2B service agreement and its DPA may replace or supplement Annex A.
18. Changes to the Service or Terms
We may update the Service and these Terms to reflect technical, commercial, security or legal changes. If a change materially affects the Customer's rights or the data-processing terms and applicable law requires notice or renewed acceptance, we will provide notice and, where appropriate, require renewed electronic acceptance.
19. Governing law and disputes
These Terms are governed by the laws of the Republic of Croatia, subject to mandatory provisions of EU law that apply.
Before starting formal proceedings, the Customer is encouraged to contact us at sales@nostroboxai.app so that we can try to resolve the issue.
20. Contact
Nostro box j.d.o.o.
Jurja Ves III odv. 5, 10000 Zagreb, Croatia
OIB: 58661874766
sales@nostroboxai.app
Annex A – Trial Data Processing Terms (Article 28 GDPR)
A. Roles and scope
The Customer is the controller of personal data that it chooses to process through the Service for salon consultation purposes. Nostro box j.d.o.o. is the processor in relation to processing carried out on the Customer's documented instructions.
B. Subject matter and duration
The subject matter is the processing necessary to provide the Hair Atelier AI visual consultation Service, including receipt of a photograph, temporary technical processing, transmission to relevant infrastructure and AI subprocessors, generation of a visual result, security and technical support.
The processing lasts for the duration of the Trial and, for individual photographs, only for as long as reasonably necessary to perform the requested generation, operate necessary transient technical processes and comply with applicable legal or security obligations.
C. Nature and purpose of processing
Processing may include collection by upload/camera, transmission, temporary hosting or buffering, automated AI analysis and transformation, generation of an output image, retrieval/display of the result, security logging and deletion. The purpose is to provide and secure the Hair Atelier AI salon consultation functionality.
D. Types of personal data and categories of data subjects
| Personal data | Photographs/images, visible physical appearance and hairstyle information, user/account identifiers, and technical data necessary to process a generation request. |
|---|---|
| Data subjects | Salon clients or other persons whose photographs are lawfully submitted, and authorised salon users where their account/technical data is processed in connection with the request. |
The Service is not intended to perform biometric identification and the Customer must not instruct the Service to process images for that purpose.
E. Documented instructions
Nostro box j.d.o.o. shall process personal data only on documented instructions from the Customer, including these Terms, the Customer's use of Service functionality and other lawful written instructions accepted by the Provider, unless processing is required by applicable Union or Member State law. Where legally permitted, the Provider shall inform the Customer before carrying out processing required by such law.
If the Provider reasonably believes that an instruction infringes the GDPR or other applicable Union or Member State data-protection law, it shall inform the Customer without undue delay and may suspend the affected processing until the matter is resolved.
F. Confidentiality and security
The Provider shall ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations. The Provider shall implement technical and organisational measures appropriate to the risk, including reasonable access controls, credential protection, protection of communications, service security and limitation of retention.
G. Subprocessors
The Customer grants the Provider general written authorisation to engage subprocessors necessary to provide the Service. The Provider shall impose data-protection obligations on subprocessors that are substantially equivalent to the relevant obligations in this Annex, as required by Article 28 GDPR.
Relevant categories/providers may include:
| OpenAI / AI model provider | AI image processing and generation where the requested function uses an AI image API. |
|---|---|
| Vercel / cloud hosting | Hosting of the web application, serverless functions and technical infrastructure required to deliver the Service. |
| Supabase / backend platform | Authentication, user accounts, credits/usage and related business/technical data. Client photographs are not intended for permanent storage in the application database. |
| Email / infrastructure providers | Transactional email delivery and supporting infrastructure where relevant to account administration and security. |
On request, the Provider shall make available current information on relevant subprocessors. Where required by Article 28 GDPR, the Provider shall inform the Customer of intended material additions or replacements so the Customer has an opportunity to object on reasonable data-protection grounds.
H. International transfers
Where processing involves a transfer of personal data outside the European Economic Area to a country for which no applicable adequacy decision exists, the Provider shall ensure that an appropriate transfer mechanism and safeguards are used in accordance with the GDPR, including Standard Contractual Clauses where applicable.
I. Data subject rights
Taking into account the nature of processing, the Provider shall reasonably assist the Customer, through appropriate technical and organisational measures where possible, in responding to requests by data subjects exercising their GDPR rights.
If the Provider directly receives a request relating solely to personal data processed on behalf of the Customer, it shall forward the request to the Customer unless authorised or legally required to respond otherwise.
J. Personal data breaches and compliance assistance
The Provider shall notify the Customer without undue delay after becoming aware of a personal data breach relating to personal data processed on the Customer's behalf and shall provide information reasonably available to it to support the Customer's applicable notification obligations.
Taking into account the nature of the processing and the information available to it, the Provider shall provide reasonable assistance with the Customer's obligations relating to security, data-protection impact assessments and prior consultation where applicable.
K. Deletion and return
Hair Atelier AI is designed so that client photographs are not permanently stored in the Provider's application database after generation is completed. Photographs may nevertheless be temporarily transmitted to and processed by contracted infrastructure and AI providers as necessary to complete a request, subject to their applicable contractual retention and security arrangements.
On termination of the Trial, the Provider shall, at the Customer's choice and to the extent applicable and technically available, delete or return personal data under its control as processor, unless applicable law requires continued retention. Temporary backups or transient technical copies may remain until the ordinary deletion cycle, subject to continued safeguards.
L. Demonstration of compliance and audits
The Provider shall make available information reasonably necessary to demonstrate compliance with Article 28 GDPR and shall allow for and contribute to reasonable audits or inspections by the Customer or an auditor mandated by the Customer.
Audits must be requested with reasonable prior notice, carried out during business hours and conducted in a manner that does not unnecessarily disrupt the Provider's business, compromise system security or disclose confidential information relating to other customers. Where an audit request exceeds a reasonable standard scope, the parties may agree in advance on reimbursement of reasonable actual costs.
M. Customer obligations as controller
The Customer remains responsible for:
- the lawfulness, fairness and transparency of collecting and uploading personal data;
- providing any required privacy information to salon clients;
- establishing and documenting an appropriate legal basis and obtaining any required permissions or consents;
- ensuring that instructions to the Provider comply with applicable data-protection law;
- using the Service only for the professional consultation purposes permitted by these Terms.
N. Electronic form and precedence
This Annex is intended to constitute the binding processor terms required by Article 28 GDPR for the Free Trial relationship and is concluded electronically when an authorised Trial user accepts these Terms on behalf of the Customer.
If the Customer later enters into a separately signed Hair Atelier AI B2B Service Agreement containing a Data Processing Agreement, that later agreement shall govern the processor relationship from its effective date and shall prevail in the event of a conflict.
These Terms are intended for B2B use of Hair Atelier AI. They should be reviewed periodically as the Service, subprocessors, commercial model and applicable law evolve.