Privacy Policy

Unlike a file host, we do keep what you generate: your prompt text and the resulting image are stored so they appear in your Creations gallery until you delete them.

Your prompt and, in edit mode, the image you upload are sent to our AI generation provider (OpenRouter) to produce the result. They process this data only to return the generated image to us, as our sub-processor.

Your images and prompts are private: they are never published, and only you can see them. A photo you upload for an edit is private in the same way.

Account details: your name, email address, and — if you sign in with Google — your Google profile picture.

Product data: every prompt you submit, every image you generate, and simple counters (likes, downloads) attached to them.

Account activity: a log of what happened on your account — sign-up, each generation and whether it succeeded, credit movements, plan changes, and which page sent you to pricing. We use it to run the service, find faults and see which parts are used. Most of it is deleted after a hundred and eighty days; credit movements are kept so your credit history stays complete.

Your IP address: we use it to limit how often a few actions can be repeated from the same connection — signing up, asking for a password reset — so the service cannot be flooded. For that count it is held briefly in memory only. The one place it is stored is the earlier publish consent records described below.

Reminder emails: we may occasionally write to you based on what your account shows — you signed up but have not generated anything, your credits ran out, you started a checkout without finishing it, or your plan ended. Every such email carries an unsubscribe link and one click stops all of them. Account emails — sign-in, password, payment receipts — are not affected, because they answer something you did.

If you subscribe: your customer record at Stripe, including the plan and the state of the subscription. Card details go straight to Stripe and never reach us.

Stripe also notifies us of each payment event, and we keep a copy of those notifications for ninety days so we can investigate a payment that went wrong. They contain what Stripe sends us — your email, name, billing address and the plan — never card numbers.

Earlier publish consent records: the service used to let you publish images to a public gallery, and each time you confirmed publishing we stored the date, your IP address, your browser’s user-agent, the page language and the version of the terms you accepted. Publishing no longer exists and no new records are created; the ones already made are kept to prove that consent if an image is ever disputed.

To run the service you asked for, to show your gallery back to you, to apply the limits of your plan, to take payment, and to protect the service from misuse.

We process your personal data on the following legal bases, under Article 6 of the GDPR and Article 5 of the Turkish Personal Data Protection Law (KVKK):

Performance of our contract with you: your account, generating and storing your images, your plan and your payments.

Legal obligation: keeping billing and tax records for as long as the law requires.

Legitimate interest: keeping the service secure, preventing abuse and limiting how often actions can be repeated, the account activity log, publish consent records as evidence, and service emails such as the reminders described above, which you can stop with one click.

Consent: the Microsoft Clarity analytics cookies. You can withdraw your consent at any time through “Cookie settings” at the bottom of every page, and you can stop reminder emails with the unsubscribe link in each one. Withdrawing does not affect processing that took place before.

OpenRouter (and the AI model it routes your request to), to generate your images. Google, if you choose to sign in with it. Stripe, for payments. Microsoft, through Clarity, which measures how the site is used. Our hosting provider, which runs the servers the site sits on. Our storage provider, where the images you generate are kept. Our email provider, for account emails such as verification and password reset. Nobody else, and we do not sell data.

Some of the providers named above — OpenRouter and the AI model it routes your request to, Stripe, Google sign-in, Microsoft Clarity, and our hosting, storage and email providers — may process your data outside your country, including in the United States.

For these transfers we rely on safeguards recognised by law, such as the European Commission’s Standard Contractual Clauses (Chapter V of the GDPR) and, for data transferred from Turkey, the standard contracts under Article 9 of the KVKK or, where the law requires it, your explicit consent.

Generated images and prompts are kept until you delete them or close your account. Account and billing records are kept while your account exists and for as long as tax rules require afterwards.

Earlier publish consent records are kept until the limitation period for legal claims about the image has passed — even after you delete the image or close your account — because they are our evidence that you agreed to publish it.

You can ask for a copy of your data, ask us to correct it, or ask us to delete your account and everything attached to it. Write to ltd.bilgisam@gmail.com and we will answer within thirty days.

You do not have to wait for us for the first and the last of those: your account page has a button that downloads all of your data and another that deletes your account, and both work immediately.

In full, you have the right to access your data, to have it rectified or erased, to restrict or object to its processing, to data portability, to withdraw your consent at any time, and not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. If you are in Turkey, you also have the rights set out in Article 11 of the KVKK. Send any such request to ltd.bilgisam@gmail.com.

You can also lodge a complaint with a supervisory authority: in the EU, the data protection authority of the country where you live; in Turkey, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

Bilgisam Ltd, —. Data questions: ltd.bilgisam@gmail.com