This Privacy Policy explains how DEEPHOTAI collects, uses, stores, shares, and protects personal information when you access or use our website, applications, AI tools, and related services.
In this Privacy Policy, “DEEPHOTAI,” “we,” “us,” and “our” refer to the legal entity identified above. “Services” refers to our website, AI chat tools, image-generation tools, image-editing features, video-generation tools, account system, payment services, and related functionality.
By using the Services, you acknowledge that you have read this Privacy Policy.
1. Scope of This Policy
This Privacy Policy applies to personal information processed when you:
- visit the DEEPHOTAI website;
- create or manage an account;
- purchase credits or a subscription;
- use AI chat, image, editing, or video features;
- upload prompts, images, videos, or reference files;
- publish or share content through an available gallery;
- contact customer support;
- receive service or marketing communications;
- interact with cookies or similar technologies.
This Policy does not govern third-party websites or services that operate under their own privacy policies.
2. Age Restrictions
DEEPHOTAI is intended exclusively for adults who are at least 18 years old, or who have reached the legal age of majority in their country if that age is higher.
We do not knowingly allow minors to create accounts or use adult-oriented features. If we become aware that we have collected personal information from an underage person, we may suspend the account and delete the information, subject to legal and security-retention requirements.
A parent or legal guardian who believes that a minor has provided information to DEEPHOTAI may contact us at [PRIVACY EMAIL].
COPPA imposes additional obligations on services directed to children under 13 or services that knowingly collect their personal information. DEEPHOTAI should remain clearly presented and technically configured as an adult-only service. (Federal Trade Commission)
3. Information We Collect
3.1 Account Information
When you register, we may collect:
- your email address;
- username or display name;
- encrypted or hashed account credentials;
- country or approximate location;
- age-confirmation status;
- account preferences;
- subscription and credit balance;
- account creation and activity dates.
We should not have access to your plain-text password.
3.2 Payment and Transaction Information
When you purchase a subscription or credit package, we may collect:
- transaction identifiers;
- purchased plan or credit package;
- payment amount and currency;
- billing country;
- payment status;
- subscription status;
- renewal and expiration dates;
- refund, dispute, and cancellation information.
Payments may be processed by [STRIPE / OTHER PAYMENT PROCESSOR]. The payment processor may collect your payment-card details directly under its own privacy policy.
Unless your implementation states otherwise, DEEPHOTAI does not directly receive or store complete card numbers, card security codes, or online-banking credentials.
3.3 Prompts, Uploads, and Generated Content
When you use our AI tools, we may process:
- chat messages and conversation instructions;
- text prompts and negative prompts;
- uploaded images, videos, and reference files;
- generation parameters and model selections;
- generated images, videos, text, and other outputs;
- editing instructions;
- seeds, aspect ratios, styles, and technical metadata;
- content reports, moderation results, and safety classifications.
This information is required to process your requested generation or editing task.
Your content may be sent to approved third-party AI infrastructure providers identified in Section 7.
3.4 Usage and Technical Information
When you access the Services, we may automatically collect:
- IP address;
- browser and device type;
- operating system;
- language and time zone;
- pages and features accessed;
- login and session information;
- generation requests and processing status;
- error reports and performance data;
- security, fraud, and abuse signals;
- referral URLs;
- cookie and consent preferences.
We may derive an approximate country or region from your IP address. We do not need to collect your precise GPS location unless a feature explicitly requires it and you provide permission.
3.5 Communications
When you contact us, we may process:
- your name and email address;
- the contents of your request;
- screenshots or files you provide;
- account and transaction identifiers;
- previous communications with our support team;
- information needed to investigate the issue.
3.6 Information from Third Parties
We may receive information from:
- payment processors;
- authentication providers;
- hosting and security providers;
- analytics providers;
- affiliate or referral partners;
- fraud-prevention services;
- AI-generation providers;
- legal authorities where required by law.
4. How We Use Personal Information
We may use personal information to:
Provide the Services
This includes creating accounts, processing generations, operating AI models, storing outputs, managing credits, delivering subscriptions, and allowing users to access their history.
Process Payments
We use transaction information to activate plans, add credits, process renewals, issue refunds, investigate payment failures, and maintain financial records.
Maintain Security
We may use information to:
- protect accounts;
- prevent unauthorized access;
- detect fraud and payment abuse;
- identify automated or malicious activity;
- investigate prohibited content;
- protect our infrastructure;
- enforce our Terms of Service.
Provide Customer Support
We use account, technical, and communication information to respond to requests and resolve problems.
Improve the Services
We may analyze aggregated or de-identified usage information to understand feature performance, improve reliability, fix errors, and develop new functionality.
User prompts, uploaded files, and private generations should not be used to train or fine-tune AI models unless this practice is clearly disclosed and the appropriate consent or other legal basis has been obtained.
Choose and publish one accurate statement:
Option A: We do not use private prompts, uploads, or generated content to train our AI models.
or:
Option B: We may use certain content to improve our models only where you have expressly opted in. You may withdraw your participation through your account settings.
Send Service Communications
We may send essential messages concerning:
- account security;
- payment confirmation;
- subscription changes;
- service interruptions;
- important policy changes;
- support requests.
These operational messages are not promotional and may be necessary to provide the Services.
Send Marketing Communications
Where permitted, we may send news, product announcements, promotions, or special offers.
You may unsubscribe using the link included in the message or by contacting us. Objecting to direct marketing must not prevent you from continuing to receive essential account or security messages. Under GDPR principles, users have the right to object to direct marketing. (European Commission)
Comply with Legal Obligations
We may process or preserve information where necessary to comply with:
- tax and accounting requirements;
- court orders;
- valid legal requests;
- regulatory obligations;
- fraud and abuse investigations;
- protection of users and third parties;
- enforcement of our legal agreements.
5. Legal Bases for Processing
Where GDPR, UK GDPR, or similar laws apply, we rely on one or more of the following legal bases:
Performance of a Contract
We process information necessary to create your account, provide AI generations, manage credits, process subscriptions, and deliver requested services.
Legitimate Interests
We may process information for security, fraud prevention, service improvement, technical administration, and protection of our legal rights, provided that these interests are not overridden by your rights.
Consent
We may rely on consent for:
- optional analytics cookies;
- advertising cookies;
- marketing communications;
- optional use of content for model improvement;
- processing that legally requires explicit consent.
You may withdraw consent at any time. Withdrawal does not affect processing already performed before the withdrawal.
Legal Obligation
We may process information to comply with applicable accounting, taxation, consumer-protection, law-enforcement, or regulatory requirements.
The appropriate legal basis must be determined before processing begins and accurately described in the privacy notice. (European Commission)
6. Sensitive Personal Information
Because DEEPHOTAI may process adult-oriented prompts and content, some user submissions could reveal sensitive information, including information concerning a person’s sex life or sexual orientation. Such information may qualify as special-category data under European and UK privacy laws. (ICO)
You should not upload or submit:
- sensitive information about an identifiable third party;
- private or intimate material involving a real person without consent;
- identity documents unless specifically requested for a lawful verification process;
- medical, biometric, or financial information unrelated to the requested service;
- content involving minors or persons who may appear to be minors.
Where explicit consent is legally required, DEEPHOTAI will request that consent separately rather than treating general acceptance of this Privacy Policy as sufficient consent.
We do not use sensitive information to target advertising or infer personal characteristics unrelated to providing the requested service.
7. AI Providers and Content Processing
DEEPHOTAI may use third-party AI models, APIs, cloud-computing platforms, and storage services to generate or edit content.
These providers may receive:
- your prompt;
- uploaded reference files;
- generation settings;
- technical request identifiers;
- the resulting output;
- limited security and diagnostic information.
We contractually require service providers to process information only for authorized purposes where possible. However, each provider may be subject to its own retention, security, and legal obligations.
DEEPHOTAI should disclose:
- whether providers retain prompts or files;
- the provider’s retention duration;
- whether providers may use content for training;
- the countries where processing occurs;
- whether abuse-monitoring copies are retained;
- whether users can request deletion from provider systems.
8. Private and Public Content
User content is treated according to the visibility option selected by the user.
Private Content
Content marked private is accessible through the user’s account and is not intentionally displayed in a public gallery.
Public or Shared Content
Where a public-gallery or sharing feature exists, content becomes publicly accessible only after the user actively chooses to publish or share it.
Public content may reveal:
- the displayed username;
- the generated output;
- publication date;
- model or style information;
- prompt text, where prompt sharing is enabled.
Users should review content carefully before making it public. Removing content from the public gallery does not guarantee that copies previously downloaded, indexed, or shared by other people will disappear.
Remove this section if DEEPHOTAI does not offer a public gallery.
9. Automated Moderation and Abuse Prevention
We may use automated systems to detect:
- illegal or prohibited content;
- suspected involvement of minors;
- non-consensual intimate content;
- fraud and payment abuse;
- malicious prompts;
- attacks against our infrastructure;
- violations of our Terms of Service.
Automated detection may result in a generation being blocked or submitted for additional review.
Where legally required and reasonably available, users may contact support to request human review of an account restriction or moderation decision.
10. Cookies and Similar Technologies
DEEPHOTAI may use cookies, local storage, pixels, and similar technologies.
Essential Cookies
These cookies are necessary for:
- account authentication;
- session management;
- security;
- fraud prevention;
- checkout functionality;
- storing privacy preferences.
Preference Cookies
These remember options such as language, interface preferences, and generation settings.
Analytics Cookies
These help us understand how visitors use the Services and identify performance issues.
Analytics providers may include:
- [GOOGLE ANALYTICS / OTHER PROVIDER]
- [ERROR-MONITORING PROVIDER]
- [PRODUCT-ANALYTICS PROVIDER]
Advertising Cookies
Where advertising or retargeting is used, advertising partners may collect identifiers and browsing activity.
Non-essential cookies should only be activated after obtaining consent where required. Users must be able to change or withdraw their cookie choices.
Additional details should be included in a separate Cookie Policy.
11. How We Share Information
We may share personal information with the following categories of recipients.
Service Providers
This may include providers of:
- website hosting;
- cloud infrastructure;
- AI generation;
- GPU processing;
- file storage;
- content delivery;
- cybersecurity;
- email delivery;
- customer support;
- analytics;
- payment processing;
- accounting;
- fraud prevention.
Professional Advisers
We may share information with lawyers, accountants, auditors, insurers, and compliance specialists where reasonably necessary.
Legal Authorities
We may disclose information where we reasonably believe disclosure is required to:
- comply with applicable law;
- respond to a valid legal request;
- protect a person from serious harm;
- investigate fraud or illegal activity;
- protect DEEPHOTAI’s legal rights.
Corporate Transactions
Information may be transferred in connection with a merger, financing, acquisition, restructuring, sale of assets, or insolvency process.
Where appropriate, we will require the recipient to continue protecting the information under applicable privacy law.
At Your Direction
We may share content when you publish it, generate a sharing link, connect an external service, or otherwise instruct us to disclose it.
12. Sale and Sharing of Personal Information
DEEPHOTAI must choose the statement that accurately reflects its practices.
Option A — No Sale or Advertising Sharing
We do not sell personal information for money. We also do not share personal information for cross-context behavioural advertising as those terms are defined under applicable California law.
Option B — Advertising Sharing Occurs
We may share online identifiers and browsing activity with advertising partners for personalised or cross-context behavioural advertising. Eligible users may opt out through the “Do Not Sell or Share My Personal Information” link or privacy-settings panel.
California privacy law may provide qualifying consumers with rights to know, correct, delete, and opt out of certain sales or sharing of personal information. Covered businesses must also provide appropriate notices and request procedures. (California Attorney General)
Do not publish Option A if advertising pixels, retargeting systems, or partner analytics may legally constitute “sharing.”
13. International Data Transfers
DEEPHOTAI and its providers may process information in countries other than the country where the user lives.
Where required, we use recognized transfer mechanisms such as:
- adequacy decisions;
- Standard Contractual Clauses;
- the UK International Data Transfer Addendum;
- contractual confidentiality and security obligations;
- other safeguards recognized by applicable law.
Users may contact us to request more information about the safeguards applicable to their information.
14. Data Retention
We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, including legal, accounting, security, dispute-resolution, and fraud-prevention requirements.
Before publishing, replace the following values with the actual retention settings:
| Information | Suggested policy entry |
|---|---|
| Account information | While the account is active and for [X days/months] after deletion |
| Private generated content | [X days/months or until manually deleted] |
| Uploaded source files | [X hours/days/months] |
| AI-provider processing copies | [PROVIDER RETENTION PERIOD] |
| Chat history | [X days/months or until deleted] |
| Security and access logs | [X days/months] |
| Support communications | [X years] |
| Billing and transaction records | [X years, according to accounting law] |
| Consent records | While valid and for [X years] afterward |
| Blocked-content or abuse records | [X days/months/years], depending on severity |
When information is no longer required, we may delete it, anonymize it, or isolate it until deletion is technically completed.
Backups may retain deleted information temporarily until normal backup rotation is completed.
15. Security
We use reasonable technical and organizational safeguards appropriate to the nature of the information and the risks involved.
These safeguards may include:
- encryption in transit;
- encrypted storage where appropriate;
- password hashing;
- access controls;
- separation of production and administrative systems;
- restricted employee and contractor access;
- secret and API-key management;
- monitoring and security logging;
- backups and recovery procedures;
- software updates and vulnerability management.
No internet service or storage system can guarantee absolute security. Users are responsible for protecting their passwords, devices, and account access.
Applicable privacy frameworks require organizations to implement security measures appropriate to the risks of processing. (European Commission)
16. Your Privacy Rights
Depending on your location, you may have the right to:
- access personal information held about you;
- receive information about how it is processed;
- correct inaccurate or incomplete information;
- request deletion;
- restrict certain processing;
- object to certain processing;
- withdraw consent;
- receive eligible information in a portable format;
- opt out of certain advertising or data sharing;
- lodge a complaint with a privacy regulator.
Some rights are subject to legal exceptions. For example, we may need to preserve certain transaction, security, fraud, or legal records.
To submit a request, contact:
[PRIVACY EMAIL]
Please include sufficient information to identify your account and the request. We may need to verify your identity before completing it.
We will respond within the period required by applicable law.
European and UK privacy frameworks include rights such as access, correction, deletion, restriction, objection, and portability, depending on the legal basis and circumstances. (ICO)
17. Rights of California Residents
Where the California Consumer Privacy Act applies, California residents may have the right to:
- know the categories and specific pieces of personal information collected;
- know the purposes and categories of recipients;
- request correction;
- request deletion;
- opt out of the sale or sharing of personal information;
- limit certain uses of sensitive personal information;
- receive equal service without unlawful discrimination for exercising privacy rights.
Requests may be submitted through:
Email: [PRIVACY EMAIL]
Request form: [PRIVACY REQUEST URL]
Opt-out page: [DO NOT SELL OR SHARE URL, IF APPLICABLE]
We may verify the request before responding. An authorized agent may submit a request where legally permitted and properly documented.
18. Rights of European Economic Area and UK Users
Users in the EEA or UK may contact us to exercise applicable data-protection rights.
They may also submit a complaint to the supervisory authority in the country where they live, work, or believe an infringement occurred.
Add the following if required:
EU representative: [NAME AND ADDRESS]
UK representative: [NAME AND ADDRESS]
Data Protection Officer: [NAME OR CONTACT EMAIL]
19. Account and Content Deletion
Users may request account deletion through:
- the account settings, where available; or
- [SUPPORT OR PRIVACY EMAIL].
Deleting an account may result in the deletion of stored prompts, generations, and account history, subject to:
- legal-retention obligations;
- billing and accounting records;
- fraud and security investigations;
- unresolved disputes;
- backup-rotation periods;
- content previously made public;
- data already anonymized.
The account interface should explain clearly what will be deleted and what may be retained.
20. Third-Party Services and Links
The Services may contain links to websites, payment pages, social platforms, or other third-party services.
DEEPHOTAI is not responsible for the privacy practices of independent third parties. Users should review the privacy policy of each external service before submitting personal information.
21. Changes to This Privacy Policy
We may update this Privacy Policy to reflect:
- changes to the Services;
- new providers or technologies;
- revised data practices;
- legal or regulatory developments;
- security improvements.
The updated version will display a revised “Last updated” date.
Where a change materially affects user rights or the way personal information is processed, we may provide additional notice through the website, account interface, or email.