Privacy Policy

Account data includes your email, name or nickname, avatar, verification status, sign-in method and session information. Google sign-in provides the basic profile information needed to authenticate you.

Creative data includes prompts, uploaded logos, sketches and reference images, generated images and videos, models and parameters, task status, asset URLs and credit records. You must have permission to submit information concerning others.

Transaction and support data includes orders, products, payment and subscription status, transaction identifiers and information you send to support. Payment card details are handled on the payment provider’s checkout page; our credit and order system does not ask you for full card numbers or security codes.

Technical data can include access and error logs, IP addresses, browser and device information, page visits and performance data. The data depends on the features used and analytics services enabled.

We use this information to authenticate accounts, run generation tasks, store and deliver results, manage credits, reconcile payments, provide support and protect the service. Where a legal basis is required, necessary service processing generally relies on performance of a contract; recordkeeping on legal obligations; security and troubleshooting on applicable legitimate interests; and optional processing requiring consent on valid consent. Using the service does not constitute consent to all optional processing.

Generation requires sending prompts, selected parameters and relevant reference images or file URLs to the AI provider for the task. Integrations include Evolink, Kie and the model services they make available; the actual recipient depends on the selected model and configuration.

Providers may process, retain or review content under their terms, data policies and arrangements with us. We do not promise that every third party refrains from retention or model training. Do not upload passwords, payment credentials or sensitive personal information without authorization. Contact us before submitting brand materials with strict confidentiality requirements.

Sign-in may use Google; login emails are sent through Resend; files are delivered through R2/S3-compatible object storage; hosting and operational providers may process technical logs. We provide information needed for the relevant service purpose.

For purchases, the payment provider or transactional seller identified at checkout and on your receipt processes payment data and shares information needed to deliver credits, subscriptions and reconcile orders. The applicable parties and their privacy policies are disclosed before payment. Mention of a provider in this policy alone does not identify it as the seller of your transaction.

Before image or video generation, text prompts are sent to a content moderation service: sites without Waffo checkout enabled use Evolink, while Waffo-enabled environments use Waffo Prompt Sift. For image generation, reference image links and generated results are also sent to Evolink for review. If moderation rejects the content or is unavailable, the task is not submitted to the generation model or its result is not shown. Each provider processes data under its own privacy notice.

We may disclose information to meet legal obligations, valid judicial or regulatory requests, investigate fraud or protect lawful rights. We do not sell your personal information.

Authentication and security use session cookies. Theme preferences, pending prompts, reference-image drafts, task state and notification choices may be stored in localStorage or sessionStorage. Signing out may not remove every local draft; take care on shared devices.

The site integrates Vercel Analytics and Speed Insights and loads Plausible when configured, for usage and performance analysis. Third-party pages, including checkout and Google sign-in, have their own storage and cookie policies.

You can clear cookies and site data in your browser and disable notifications in browser permissions. Blocking necessary storage may affect sign-in and task recovery. Non-essential analytics that legally require prior consent should only be enabled after that consent is obtained.

Asset-library and creation records use account access controls, but files are delivered through object-storage URLs. Anyone holding an accessible file URL may be able to view or download it; account-level page controls do not mean every file link is private. Do not publicly share sensitive asset links.

Deleting an item from the library or creation list may only hide its record. It does not necessarily immediately erase files in object storage, AI-provider copies or backups. Contact us to request further deletion.

Accounts, creations and assets are retained as needed to provide their features. Orders, credit and security records may need longer retention for accounting, disputes, fraud prevention or legal obligations. Retention depends on the data category, service needs, requests and applicable law, rather than one period for all data.

You may request account closure or deletion. We will verify the request and explain applicable retention requirements, third-party limitations and backup removal arrangements. Keep your own copies of work you need; the service does not promise permanent archiving.

We and our providers may process information outside your country or region. Locations and safeguards depend on the provider and configuration; contact us for information about applicable arrangements. Where required by law, international processing must use applicable transfer mechanisms and safeguards.

Subject to applicable law, you may request access, correction, erasure, a portable copy, restriction of processing, or object to certain processing. You may withdraw consent for consent-based processing without affecting prior lawful processing. You may also complain to the competent data protection authority.

Contact the address below with your account email and the scope of your request. We may ask for information necessary to verify your identity and will handle requests within applicable legal time limits. Do not send passwords or full payment card details.

We use security measures appropriate to the service, but no internet transmission or storage is absolutely secure. Contact us if you suspect unauthorized access.

The service is not directed to children under 13 or below the minimum lawful age in their location. Users below the age of independent contractual capacity should have guardian consent and supervision. Contact us about any improper collection of children’s information.

We will communicate material changes through appropriate means and update the date on this page. A policy change does not replace consent where consent is legally required for new optional processing.

Privacy, data, account, order and technical support requests: supprot@boothai.net.