Privacy Policy

1. Information we collect

We collect account details such as your name, email address, authentication records, and basic security data including IP address and user agent. When you use the service, we process prompts, settings, uploaded images, generated images, task history, credit balances, and support communications.

A third-party payment processor handles checkout information according to the payment option you choose. We receive transaction identifiers, payment status, pack details, and limited billing metadata, but we do not store full card numbers, wallet private keys, or recovery phrases.

2. How we use information

We use information to authenticate you, operate image tools, submit requested generation jobs, store and deliver results, process purchases, prevent fraud and abuse, provide support, maintain service reliability, and comply with legal obligations.

Depending on the activity and applicable law, our legal bases are performance of our service contract, legitimate interests in security, fraud prevention and service improvement, compliance with legal obligations, and consent where required. We do not use your private uploads or generated results to train our own general-purpose AI models.

3. Cookies and similar storage

We use strictly necessary cookies or similar storage to keep you signed in, protect accounts, prevent abuse, and remember preferences such as language. These technologies are required for requested functionality. We do not currently use advertising cookies or sell cross-site browsing profiles.

4. Service providers, sharing, and transfers

We use hosting and infrastructure providers, an AI service provider, third-party payment processors, and optional sign-in and transactional-email services. These providers process only the information needed for their role and may process it in other countries under their own privacy and security terms.

Input images and prompts required for a generation request are sent to our AI service provider. Generated files are copied into our private storage after completion so they remain available through your authenticated account.

We do not sell personal information. We may also disclose the minimum necessary information to comply with a valid legal request, protect users or the service, complete a merger or asset transaction with continuing privacy protections, or act with your direction or consent. International processing is subject to applicable provider contracts and legally recognized transfer safeguards where required.

5. Retention and deletion

Uploaded images, generated images, and completed task history are retained for up to 100 days, then automatically removed from active storage. Security, payment, ledger, and legal records may be retained longer where needed for fraud prevention, accounting, disputes, or legal compliance.

Removing a result from your account hides it from your result gallery and task history. Stored files remain subject to our 100-day retention and scheduled cleanup. You can contact us to request data or account deletion. Some transaction records may remain in a restricted form when retention is legally required. Provider-side temporary files may follow the provider's shorter retention period.

6. Security

We use access controls, private object storage, short-lived signed provider links, encrypted transport, webhook verification, rate limits, and least-necessary data access. No internet service can guarantee absolute security.

If a security incident is likely to affect your rights, we will notify affected users and relevant authorities as required by applicable law. You are responsible for protecting your credentials and telling us promptly about suspected unauthorized access.

7. Your privacy rights

Subject to applicable law, you may request information about processing, access, correction, deletion, restriction, a portable copy, or objection to certain processing, and you may withdraw consent without affecting earlier lawful processing. You may also revoke optional Google access through your Google account.

Send a request to support@image-to-image.org. We may verify your identity before acting and aim to respond within 30 calendar days, or within the period required by local law. You may also complain to the data-protection authority where you live.

8. Children

The service is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from a child. If you believe a child has provided information, contact us so we can investigate and delete it where required.

9. Third-party services

Third-party sign-in, payment, AI, and linked services operate under their own privacy notices. This policy covers information controlled by Image To Image and does not replace a third party’s notice for data it independently controls.

10. Policy changes

We may update this policy as the service or law changes. Where practical, we will give at least 15 days’ notice of material changes through your registered email or an in-product notice and will identify the new effective date.

11. Contact

For privacy requests or questions, email support@image-to-image.org.