Privacy Policy

1. Data we collect

We collect the following categories of personal data:

• Account data: your name, email address, hashed password or federated identity, and account settings.
• Content you submit: chat messages, prompts, briefs, uploaded images or media, and files you provide as references for generation.
• Generated output and metadata: the media we generate for you and associated metadata such as model used, timestamps, and template selections.
• Billing data: subscription plan, credit balance and transactions, and payment identifiers held by our payment processor (we do not store full card numbers).
• Usage and technical data: log data, device and browser information, IP address, and product interaction events.
• Cookies and similar technologies: strictly necessary authentication storage, plus optional analytics and error-monitoring identifiers only after you consent.

2. How we use your data

• To provide, operate, and secure the Service, including authenticating you and running generation workflows.
• To process payments, manage subscriptions, and track credit usage.
• To maintain safety, prevent abuse and fraud, and enforce our Terms of Service.
• To improve the Service, diagnose problems, and develop new features.
• To communicate with you about your account, security, and material changes to the Service.
• To comply with legal obligations and respond to lawful requests.

We do not use your private prompts, uploads, or generated output to train our own foundation models, and we do not sell your personal data.

3. Legal bases for processing (GDPR)

• Performance of a contract: to deliver the Service you request and administer your account and billing.
• Legitimate interests: to secure the Service, prevent abuse, and improve our product, balanced against your rights.
• Consent: for optional analytics, non-essential storage, and marketing communications. You may withdraw analytics consent at any time through Cookie settings in the site footer.
• Legal obligation: to meet accounting, tax, and other statutory requirements.

4. AI generation and third-party processors

Generation is performed with the help of third-party model and infrastructure providers. To run a generation, the content you submit (for example your prompt and any reference media) is transmitted to these providers so they can return a result.

• Eachlabs: orchestrates AI generation workflows. Prompts and reference media required for a run are shared with Eachlabs and its upstream model providers to produce output.
• Model providers: the specific image, video, and text models routed for your request process the inputs needed to generate a result.
• Stripe: processes payments and stores payment method details under its own privacy terms.
• PostHog Cloud EU: processes a deliberately limited set of product events only after consent. We use an opaque internal account ID when you are signed in and do not send your name, email, prompts, chats, uploads, generated media, payment details, provider routing, or URL query strings.
• Error monitoring: activates only when configured and consented to, and processes limited technical diagnostics.

These providers act as our processors or independent controllers under contractual and data-protection commitments. Your content is shared only to the extent needed to deliver the feature you requested.

5. How we share data

We share personal data only with the service providers described above, with professional advisers, in connection with a corporate transaction, or where required by law. We do not sell or share your personal data for cross-context behavioral advertising as those terms are defined under the CCPA.

6. Data retention

We retain personal data for as long as your account is active and as needed to provide the Service. Account and content data are deleted or anonymized within a reasonable period after account closure, except where longer retention is required for legal, tax, security, or dispute-resolution purposes.

7. Security and international transfers

We use technical and organizational measures including encryption in transit, access controls, and abuse monitoring to protect personal data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Where data is transferred outside your region, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an equivalent transfer mechanism.

8. Your rights

Depending on where you live, you may have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your personal data.
• Portability: receive your data in a structured, machine-readable format.
• Restriction and objection: limit or object to certain processing, including processing based on legitimate interests.
• Withdraw consent: withdraw consent for optional processing at any time.
• CCPA rights: know, delete, correct, and opt out of any sale or sharing, without discrimination for exercising these rights.

You can exercise many of these rights directly in account settings, or by contacting us at privacy@aiisajoke.com. We will respond within the timeframes required by applicable law and may need to verify your identity first.

9. Children's privacy

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.

10. Changes and contact

We may update this Policy to reflect changes in our practices or the law. We will post the updated version with a new effective date and, where required, notify you.

Questions or requests: privacy@aiisajoke.com.