Roles
We act as a Data Controller for user accounts and as a Processor when handling uploaded and generated media per your instructions.
Purposes of Processing
- User authentication and account management.
- AI image processing and enhancement.
- Payments, subscriptions, and credits.
- Security, fraud prevention, and service reliability.
- Analytics and product improvement (aggregate/limited data).
Categories of Data
- Identity data: name, email, account IDs.
- Financial data: payment tokens, invoices (processed via provider).
- Content data: uploads, prompts, generated outputs, metadata.
- Technical data: IP, device, logs, usage metrics.
Storage & Locations
Data is stored with reputable cloud providers. Backups are performed periodically and rotated.
Subprocessors
- Authentication provider (account and session management).
- Payment processor (transactions, subscriptions, invoicing).
- Cloud hosting, storage, CDN, and database services.
- Error monitoring and analytics tools (limited, optional).
Retention
- Media retained while your account is active, until you delete it.
- Account and billing records retained per legal requirements.
- Backups retained for a limited period and then rotated.
Security Measures
- Transport encryption (HTTPS), scoped API keys, RBAC.
- Rate limiting, access auditing, and anomaly detection.
- Least-privilege access and periodic reviews.
Data Subject Rights
To request export or deletion, please visit our GDPR/CCPA Requests page.