Privacy Policy

We collect what we need to run the service: who you are, the prompts and images you work with, your billing status and how the site is used. Every prompt and image is checked by an automated safety screen before it is processed. We never sell your data and we never see your full card number. Email us and we will send you a copy of your data or delete it.

1. What we collect

Account data. Your email address, and — when you sign in with Google — your name and profile picture. If you sign in with an emailed link we receive only your email address. Team seats created by a workspace administrator have an email address, a name and a password, which our sign-in system stores only in hashed form.
Workspace data. The workspaces you belong to, your role in each, and the invitations you send or receive. When you invite someone, we use their email address to send the invitation.
Content you create. The prompts you write, the images you upload or give a tool as input, the images generated for you, and the tags you organise them with. Content in a workspace is visible to that workspace's members.
Billing data. Your plan, subscription status, number of seats and our record of each charge and plan change. Card details go directly to Stripe; we never receive or store your full card number.
Sign-in and security data. For each signed-in session we record the IP address and browser user agent it came from.
Usage data. Pages viewed, features used, generation jobs started and completed, the campaign or link that first brought you to the site, and technical details such as browser, device, language and approximate location derived from your IP address. When you are signed in, this usage record is linked to your account.
Safety records. When a request is refused by our content screening, we keep a record of it: the account and workspace, the tool used, the reason, the prompt and links to the images involved.
Email and support. A record of the service emails we have sent you, and the emails you send us with our replies.

2. Why we use it

To create and secure your account and your workspaces; to run the AI tools and deliver the results; to screen requests against our Content Policy; to take payment and manage your subscription; to send service email such as sign-in links, invitations, receipts and payment notices, and a follow-up after you sign up, which you can unsubscribe from; to understand which parts of the product are used so we can improve them; to detect fraud and abuse; and to comply with our legal and tax obligations.

Where the GDPR applies, our legal bases are performance of a contract (running the service and billing you), legitimate interests (safety screening, security, fraud prevention, product analytics) and legal obligation (accounting records, and reporting material that sexualises minors).

3. Automated safety screening

Every prompt and every input or uploaded image is sent to an automated moderation service before it is processed or stored, to check it against the Content Policy. Requests that are flagged are refused and recorded as described above. If our moderation service is temporarily unavailable, requests are still subject to our providers' built-in safety filters and are logged for later review. Screening is automated; recorded refusals may be reviewed by us. If you think a request was refused in error, email us.

4. We do not train on your content

Supavisual does not use your prompts, uploads or generated images to train AI models, and we do not share them with anyone for that purpose. Your content is processed to produce your result and then stored in your workspace for you.

5. We never sell your data

We do not sell personal data and we do not share it with advertisers or data brokers.

6. Who processes data on our behalf

We use a small number of service providers, each bound to process data only on our instructions:

Google — sign-in, if you choose it (we receive your profile; Google does not receive your activity on Supavisual).
Stripe — payment processing, subscriptions, the billing portal and fraud checks.
Cloudflare — content delivery, protection against attacks, and storage of your uploads and generated images (Cloudflare R2).
Synexa — our AI generation provider. Your prompt and input images are sent to it, solely to produce your result; it may run the request on a third-party model provider.
OpenAI — automated content moderation. Every prompt and input or uploaded image is sent to OpenAI's moderation service for the safety check described in section 3.
Our email service — delivery of sign-in links, invitations, receipts and service notifications.
Our own analytics — usage analytics (Umami) runs on infrastructure we operate ourselves rather than a third-party advertising network.

7. Cookies and local storage

We use cookies that are necessary for the service: keeping you signed in and remembering your language. Your browser's local storage holds a random analytics visitor id, the campaign that first brought you to the site, and interface preferences such as which results you have hidden. Stripe sets its own cookies during checkout. We do not use advertising or cross-site tracking cookies.

Uploaded and generated images are stored under long, random addresses and are not listed publicly. Anyone who has the address of an image can open it, so treat a copied image link like the image itself.

9. How long we keep it

Account, workspace and content — for as long as your account exists, so that your assets remain available to you and your workspace.
Sign-in sessions — a session expires after seven days without use.
Safety records — kept as evidence that our Content Policy is enforced.
Billing records — for as long as tax and accounting law requires, typically seven years, even after an account is deleted.
Usage analytics — retained for product analysis.

10. Your rights

Depending on where you live you may have the right to access, correct, export, delete or restrict the processing of your personal data, and to object to processing based on legitimate interests. To exercise any of these, email [email protected] from the address on your account. We respond within 30 days and we do not charge for it. If you are in the EEA or the UK you may also complain to your local data protection authority.

Deleting your account. Email [email protected] from the address you sign in with. If you own a workspace that has other members, tell us whether the workspace should be deleted too. Only the billing records described in section 9 are kept after deletion.

11. International transfers

Our providers operate globally, so your data may be processed outside your own country, including in the United States. Where data leaves the EEA or the UK we rely on the safeguards our providers offer, such as Standard Contractual Clauses.

12. Children

Supavisual is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, tell us and we will delete it.

13. Security

Traffic is encrypted in transit. We limit internal access to production data to what is needed to operate and support the service. No system is perfectly secure; if a breach affects you we will tell you promptly.

14. Changes

If we make a material change to this policy we will update the "Effective" date above and, where the change significantly affects you, notify you by email.

15. Contact

Privacy questions and requests: [email protected]. See also our Terms of Service.