Privacy Policy

1. Information We Collect

• Account data: name, email address, password hash.
• Authentication data: OAuth identifiers when you sign in via Google.
• Payment data: billing details processed by Stripe or NowPayments. We do not store credit card numbers.
• Uploaded content: photos and reference images you submit for AI processing.
• Generated content: AI-generated images and metadata about them.
• Usage data: IP address, browser type, device information, pages visited, timestamps.
• Cookies and similar technologies: see Section 4.

2. How We Use Your Information

• Provide, operate, and maintain the Service.
• Process payments and manage credits.
• Run AI generation jobs and deliver results to you.
• Communicate updates, security alerts, and support messages.
• Detect, prevent, and address fraud, abuse, and policy violations.
• Comply with legal obligations.
• Improve and develop new features using aggregated, non-identifying data.

We do not sell your personal data.

3. Third-Party Sub-processors

We rely on the following providers to operate the Service:

• Supabase — database and authentication. Stores account data, generated-content metadata, and session tokens. supabase.com/privacy
• Stripe — card payment processing. We never see your full card number. stripe.com/privacy
• NowPayments — cryptocurrency payment processing. nowpayments.io/privacy-policy
• Google OAuth — sign-in with Google. policies.google.com/privacy
• Fal.ai — AI inference. Runs image-generation models on uploaded photos; source images are transmitted for processing. fal.ai/privacy-policy
• Anthropic — AI moderation and assistive features. Anthropic does not train on data submitted via the API. anthropic.com/legal/privacy
• Vercel — hosting and anonymized analytics. vercel.com/legal/privacy-policy

4. Cookies & Tracking

• Essential cookies: authentication sessions and preferences (language, currency).
• Analytics cookies: Vercel Analytics — anonymized aggregate data, no cross-site tracking.

You can disable cookies in your browser settings, but parts of the Service may not function correctly.

5. Data Retention

• Account data: kept while your account is active, then deleted within 30 days of account closure.
• Uploaded source images: deleted within 30 days of upload, unless you delete them earlier.
• Generated images: kept while your account is active and you have not deleted them.
• Payment records: kept for 7 years to comply with tax and accounting obligations.
• Server logs: kept for 90 days.

6. Your Rights (GDPR, CCPA & similar laws)

Depending on your jurisdiction, you have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Erase your data (“right to be forgotten”).
• Restrict or object to processing.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at flivshot@gmail.com. We respond within 30 days.

7. International Transfers

Your data may be processed in countries other than your own, including the United States and the European Union. We rely on Standard Contractual Clauses and other lawful mechanisms to protect transfers.

8. Security

We use industry-standard safeguards including encryption in transit (TLS), encryption at rest, restricted access controls, and regular security reviews. However, no system is completely secure; we cannot guarantee absolute security.

9. Children’s Privacy

The Service is not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be announced via email or in the Service. Continued use after changes constitutes acceptance.

11. Contact

Questions, complaints, or requests? Contact us at flivshot@gmail.com.