Privacy policy

1. Summary

Your projects are saved in your browser, not on our servers.

We hold an email address for your account, the status of your subscription, and content-free records of AI requests.

When you use an AI feature, only the content that request needs is sent to our AI providers.

We do not sell your personal data and we do not use advertising or third-party analytics cookies.

2. Data that stays on your device

Your projects, imported files, edit history, generated results and Agent conversations are saved in your browser’s local storage on your device. They are not uploaded to us for storage, and we cannot view, restore or delete them. You can remove them by clearing this site’s data in your browser.

3. Personal data we collect

Account data: your email address, the date your account was created, whether your email is verified, and sign-in session data.

Subscription data: the identifiers and status of your customer record and subscription at Paddle, your billing period dates, and records of refunds or payment disputes. We do not receive or store your card number or other payment credentials.

AI usage records: for each AI request, an identifier, its type and state, timestamps, its cost, and a cryptographic fingerprint of the request. These records do not contain your project, your instructions or any image.

Technical data: our hosting provider processes IP addresses and request metadata in order to deliver and protect the Service.

Communications: the content of messages you send us.

4. Content processed for AI features

When you use an AI feature, the content that the request needs — for example your instruction, a description of the layers involved, or the picture to be separated — is sent through our server to our AI providers to produce the result. We process it only for the duration of that request and do not write it to our logs or databases. We do not use it to train AI models.

AI providers may retain request data for a limited period under their own policies, for example to detect abuse. We do not control that retention and cannot guarantee that providers retain nothing.

5. How we use personal data and our legal bases

To provide the Service and your account, verify your subscription before running paid features, and measure usage against your allowance (performance of our contract with you).

To secure the Service, prevent fraud and abuse including refund abuse, reconcile billing, and respond to your messages (our legitimate interests in running a safe and sustainable service).

To keep accounting records and comply with legal requests (legal obligation).

6. Who we share data with

We share personal data only with service providers that process it on our behalf or as described below:

Supabase — account authentication and the database that holds account, subscription and usage records.

Paddle — checkout, payments, invoicing, tax and refunds. Paddle acts as Merchant of Record and is an independent controller of the payment data it collects. When a refund is requested, we may tell Paddle how much of the period’s usage allowance has been used.

Vercel (AI Gateway) and OpenAI — processing of AI requests.

Cloudflare — hosting, content delivery and security.

Resend — delivery of account emails such as verification and password reset.

We may also disclose data where required by law or to protect our rights. We do not sell personal data or share it for cross-context behavioural advertising.

7. Cookies

We use only cookies that are strictly necessary: to keep you signed in and to remember your language. We do not use advertising cookies or third-party analytics.

8. Retention

Account, subscription and usage records are kept while your account exists and afterwards for as long as required for accounting, tax and dispute purposes. Messages you send us are kept for as long as needed to handle them. Content processed for AI features is not retained by us after the request completes.

9. Security

Data is encrypted in transit. Access to account and billing records is restricted to server-side code, and records are separated by account. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International transfers

Our service providers operate in several countries, so personal data may be processed outside the country where you live. Where required, such transfers rely on appropriate safeguards provided by those providers, such as standard contractual clauses.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to certain processing, and to withdraw consent. To exercise these rights or to delete your account, email us. We respond within 30 days. We may need to keep certain records where the law requires it.

You may also lodge a complaint with the data protection authority where you live.

12. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy. If a change is material, we will notify account holders by email or in the Service. The date at the top of this page shows the current version.