Legal
Privacy Policy
Last updated: July 30, 2026
1. Data we process
We process account and authentication data, technical and usage information, support requests, transaction records, prompts, reference images, generated results, and metadata needed to operate the service.
2. Purposes and legal grounds
We use data to perform the requested service, authenticate accounts, prevent abuse, process credits and payments, maintain security, meet legal duties, and improve reliability. Where consent is required, it may be withdrawn.
3. Generation content
Prompts, references, and results are private by default. They are sent to providers needed to generate and store the result. Only after you enable gallery permission may an image be manually reviewed and copied to the public gallery with a reviewed prompt and display name. Permission can be withdrawn for future publications, and already published items may be removed through a privacy request.
4. Sharing
We share only what is needed with authentication and payment providers, image-generation providers, infrastructure, storage, and support vendors. Each processor must use data for its contracted purpose and under applicable law.
5. Retention and deletion
Our operational default keeps results for up to 30 days, temporary uploads for up to 24 hours, and failed or quarantined outputs for 24 to 72 hours. Periods may vary for security, disputes, legal obligations, or a setting disclosed in the product.
6. Security
We use encrypted connections, restricted access, private assets, temporary links, audit records, and session controls. No system is infallible; for a relevant incident we will take the measures and give notices required by law.
7. Your rights
You may request access, correction, deletion, portability where applicable, and information about sharing. Brazilian users may exercise rights available under the LGPD. Account closure can be requested through support.
8. Cookies and sessions
We use cookies and local storage essential for login, security, language, and session continuity. When a visit arrives through a campaign or external site, a first-party cookie keeps only source, medium, campaign, content, term, referring domain, landing page, and first/last contact times for up to 90 days. Other URL parameters are not retained in this record. If an account is created, this summary is associated with the registration to measure the first completed generation and first purchase. Privacy-oriented aggregate analytics for visits, interactions, and outbound links operates even if you choose necessary storage only. You may choose necessary storage only or change your choice through Cookie settings in the footer.
9. Contact
Send privacy requests through the support page. Include the account email and enough detail for us to validate and safely handle the request.