Privacy Policy

1. Information we collect

1.1 Account & identity

• Name, email address, and profile image from Google Sign-In (or similar auth)
• Account identifiers and session/authentication tokens

1.2 Billing & transactions

• Purchase history, pack type, amounts, timestamps, and credit balances
• Payment status and limited transaction metadata from payment processors (we do not store full card numbers on our servers; cards are handled by the payment provider)

1.3 Content you provide

• Product images and reference images you upload
• Text inputs (e.g. product details for listing copy)
• AI-generated outputs stored in your workspace history

1.4 Usage & technical data

• Generation logs, feature usage, credit consumption
• IP address, browser/device type, approximate location derived from IP
• Cookies and similar technologies (see Section 8)
• Analytics events (e.g. Google Analytics) if enabled on the site

2. How we use information

• Provide, operate, and improve the Service
• Authenticate users and secure accounts
• Process purchases, deliver credits, and handle refunds
• Generate AI outputs you request
• Send transactional messages (billing, security, support replies)
• Detect fraud, abuse, chargebacks, and security threats
• Comply with legal, tax, and accounting obligations
• Measure product performance via aggregated analytics

We do not sell your personal information.

3. Legal bases (where applicable)

Depending on your location, we process data based on: performance of a contract (providing the Service you request); legitimate interests (security, product improvement, fraud prevention); consent (where required for cookies/marketing); and legal obligations (tax, regulatory requests).

4. AI processing & subprocessors

To generate photos, videos, or listing copy, uploaded images and related inputs may be transmitted to third-party AI providers (for example MuAPI and underlying model vendors) solely to fulfil your request. Do not upload sensitive personal data, images of children, or content you are not authorized to process. AI providers process data under their terms and security practices.

5. Sharing of information

We share information only as needed with:

• Service providers: hosting (e.g. Vercel), database (e.g. Neon), authentication (e.g. Google / NextAuth), AI APIs, analytics, and email infrastructure
• Payment processors / merchants of record: such as Stripe, Paddle, or similar, to process payments and refunds
• Legal & safety: when required by law, court order, or to protect rights, safety, and integrity of the Service
• Business transfers: in connection with a merger, acquisition, or asset sale, subject to confidentiality

6. International transfers

Our providers may process data in countries other than yours (including the United States, India, and EU regions). Where required, we rely on appropriate safeguards offered by those providers (such as standard contractual clauses) and contractual protections.

7. Retention

• Account data is kept while your account is active and for a reasonable period afterward for security, fraud prevention, and legal compliance
• Transaction records are retained as required for tax and accounting (often several years)
• Uploaded images and generation history may be retained to power your workspace; you may request deletion (see Section 9)
• Logs may be retained for shorter operational windows and then deleted or aggregated

8. Cookies & analytics

We use essential cookies for authentication and session security. We may use analytics tools (such as Google Analytics) to understand traffic and improve the product. You can control cookies through your browser settings; disabling essential cookies may break sign-in. Where required by law, we will obtain consent for non-essential cookies.

9. Your rights

Subject to applicable law, you may request: access to your personal data; correction of inaccurate data; deletion of your account/data; restriction or objection to certain processing; and a portable copy of data you provided. To exercise these rights, email contact@fotobudi.com from your account email. We may need to verify your identity. We will respond within a reasonable period (typically within 30 days where legally required). Some data cannot be deleted immediately if we must retain it for legal, billing, or security reasons.

10. Children

The Service is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided data, contact us and we will take appropriate steps to delete it.

11. Security

We use industry-standard measures appropriate to our size and risk profile, including encrypted transport (HTTPS), access controls, and trusted cloud providers. No method of transmission or storage is 100% secure; you use the Service at your own risk regarding residual security risk.

12. Changes

We may update this Privacy Policy. The "Last updated" date will change when we do. Material changes will be posted on this page and, where appropriate, communicated by email or in-product notice.

13. Contact

Privacy requests: contact@fotobudi.com
Related: Terms · Refunds · Support