Privacy Policy

Account information

• Email address or phone number used for registration
• Bcrypt-hashed password (we never store plaintext passwords)
• Optional referral code at signup

Usage information

• Prompts you submit and reference images you upload
• AI-generated images and their associated metadata (model, resolution, timing)
• Credit purchase orders (amount, timestamp, transaction ID)

Technical information

• IP address, device type, browser user-agent
• Login timestamps and access logs (for fraud prevention and compliance)
• Cookies strictly necessary for session management (no third-party advertising cookies)

• Service delivery: process image generation requests, maintain credit balance, deliver results
• Payment processing: forward order details to our authorized merchant of record
• Content safety: scan prompts and generated images via automated moderation systems before delivery
• Fraud prevention: detect and block abusive use, account compromise, and chargeback fraud
• Customer support: respond to inquiries and resolve disputes
• Legal compliance: respond to lawful requests from competent authorities

We do not sell your personal information, share it with advertisers, or use it to train AI models.

We share the minimum necessary data with the following processors:

• AI model providers (OpenAI-compatible endpoints, fal.ai for upscaling): receive only your prompt text and reference image URLs needed to fulfill the generation. No account-identifying data is sent.
• Payment processor (Merchant of Record): receives the customer email, billing address, and order amount as required to process the transaction. Card details are entered on the processor’s secure page and never reach our servers.
• Email & SMS providers: receive your email/phone number for verification codes and transactional notices.
• Cloud storage (Alibaba Cloud OSS, Hong Kong region): stores your generated images at rest with private bucket policies and signed-URL access.
• Content-safety APIs: receive the prompt text and image URL for moderation checks; results are logged for compliance.

• Generated images: retained while your account is active; deleted within 30 days after account deletion or upon request.
• Prompts and chat history: same as generated images.
• Access logs and audit logs: retained for at least 6 months as required by applicable law.
• Payment records: retained for at least 5 years as required by tax and accounting regulations.
• Moderation decisions: retained for 180 days for compliance review.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Object to or restrict certain processing
• Receive a portable copy of your data
• Lodge a complaint with your local data-protection authority

To exercise these rights, email zp.zhang@agi-come.com. We respond within 30 days.

We use industry-standard measures to protect your data: TLS encryption in transit, encrypted database at rest, password hashing with bcrypt, restricted internal access, and automated suspicious-activity detection. No system is 100% secure; in the unlikely event of a breach affecting your data, we will notify affected users and the relevant authority within 72 hours.

Our infrastructure is hosted in Hong Kong. If you access the Service from another country, your data will be transferred to and processed in Hong Kong. We rely on standard contractual clauses or equivalent safeguards for cross-border transfers where required.

The Service is not intended for individuals under 18. We do not knowingly collect data from minors. If we learn that we have collected such data, we will delete it promptly.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notice at least 7 days before they take effect.

For privacy questions or to exercise your rights, email zp.zhang@agi-come.com.