Back to home

Privacy Policy

How ImgAI (imgai.ai) collects, uses, stores, and shares personal information, and the rights you can exercise.

Last updated: 2026-09-15

This Privacy Policy ("Policy") applies to ImgAI at https://imgai.ai (the "Service"). Last updated: 15 September 2026.

ImgAI ("ImgAI", "we", "us", or "our") respects your privacy. This Policy explains how we collect, use, store, and share personal information when you use the Service, and the rights you have.

Please read this Policy before using the Service. Using the Service means you have read and agree to it. We may update this Policy from time to time; material changes follow Section 13.

1. Data controller

The data controller for the Service is ImgAI.

2. Personal information we collect

We collect only what we need to provide and operate the Service. Categories we do not collect are not listed here.

2.1 Information you provide

  • Account information: name or display name, email address, and a hashed password. If you sign in with Google or GitHub, we also receive the basic profile those providers authorize (typically email and public display name).
  • Creative content: prompts, reference images, uploads, generated images and videos, and works you choose to make public.
  • Payment information: transaction amounts, payment status, orders, and credit history. We do not store full card numbers — card data is handled by our payment processor (see Section 5).
  • Communications: emails you send to support@imgai.ai and other feedback.

2.2 Information we collect automatically

  • Device and network: IP address, device type, operating system, browser type, time zone, and language preference.
  • Usage: pages visited, features used, and session information.
  • Logs: request times, error logs, and performance data.
  • Anonymous-quota identifier: when you use the free allowance without an account, a signed cookie and your IP record that day's usage to prevent abuse.

We do not collect precise location.

3. How we use your information

  • Provide and maintain the Service (contract): accounts, generation, media library, credits, and subscriptions.
  • Billing and payment (contract): subscriptions, credit packs, and refund review.
  • Customer support (contract / legitimate interests): replies to requests sent to support@imgai.ai.
  • Service notices (legitimate interests): billing, security, and policy updates.
  • Security and fraud prevention (legitimate interests): quotas, disposable-email and abusive sign-ups, and abuse detection.
  • Product improvement and analytics (legitimate interests): understanding feature use when analytics tools are enabled.
  • Legal compliance (legal obligation).

We may aggregate or de-identify data for statistics. That data cannot reasonably identify you.

We do not use your inputs to train our own AI models without your explicit consent. Generation requests are sent to the third-party model providers in Section 5 so we can complete the generation you asked for.

4. Cookies and tracking

  • Strictly necessary (cannot be turned off): sign-in, locale, anonymous free quota, and security.
  • Functional (browser-controllable): language and interface preferences.
  • Analytics (browser-controllable): anonymous or pseudonymous usage statistics when enabled. We may use Google Analytics and/or Plausible.
  • Marketing (browser-controllable): only if ads are enabled. We may use Google AdSense.

You can block or delete cookies in your browser; blocking necessary cookies may prevent sign-in or some features.

5. Sharing and disclosure

We do not sell your personal information, including "sale" as defined under laws such as the CCPA. We share information only in these cases:

  • Service providers: cloud, storage, email, analytics, and support vendors bound by confidentiality. If a third-party chat widget is enabled (for example Crisp or Tawk.to), information you submit there is processed under that provider's policy. Payment card data is processed exclusively by our PCI-DSS compliant payment processor, Waffo Pancake, and is not stored on our servers.
  • AI model providers: prompts, reference images, and other inputs needed to complete a generation are sent to third-party model providers (including Google, OpenAI, and other vendors we integrate from time to time), subject to their terms.
  • Sign-in providers: if you choose Google or GitHub sign-in, we exchange the profile data those providers authorize.
  • Legal and regulatory requests: where required by law, court order, or a lawful request from a public authority.
  • Business transactions: in a merger or acquisition, with prior notice and continuing protection obligations.
  • With your consent: for other purposes only with your explicit prior consent.

Works you choose to publish appear on public pages of the Service.

6. Security

  • Encryption in transit: TLS / HTTPS.
  • Storage: hashed passwords; access-controlled object storage.
  • Access control: least privilege.
  • Periodic review and vulnerability handling.

No method of transmission over the Internet is 100% secure. If a security incident affects your rights, we will notify you and relevant regulators where required within 72 hours of becoming aware of it. Keep your credentials confidential and do not share them.

7. Retention

  • Account and creative data: kept while the account is active. Account deletion takes effect immediately and cannot be undone; we delete or anonymize that data at once. Records we must keep by law are handled under the periods below.
  • Transaction and credit records: typically 7 years for accounting and dispute handling, then deleted or archived.
  • Support emails: typically 2 years, then securely deleted.
  • Security and quota logs: typically 12 months, then securely deleted.

8. Your rights

To exercise the rights below, email support@imgai.ai. We will respond within 30 calendar days. You can also update some details in account settings.

  • To be informed: what we collect and how we use it.
  • Access: a copy of your personal information.
  • Rectification: correct inaccurate or incomplete information.
  • Erasure: request deletion in the circumstances the law allows.
  • Restriction: pause processing in certain cases.
  • Portability: receive your data in a commonly used machine-readable format.
  • Objection: object to processing based on legitimate interests or marketing.
  • Withdraw consent: where processing is based on consent.

If you think we have not handled a request properly, you may complain to your local data-protection authority.

9. Marketing and opt-out

We send service-necessary notices (billing, security, policy updates). We do not currently send marketing emails. If we start, we will ask for consent first and provide a way to opt out. Opting out of marketing does not stop necessary notices.

10. International transfers

The Service is delivered over the internet. Servers, storage, and partners may be in more than one region (including Cloudflare infrastructure and payment or model providers in the United States and elsewhere). For cross-border transfers we use contractual safeguards (including EU Standard Contractual Clauses where they apply) and transfer only to recipients with an adequate level of protection.

11. Children

The Service is for users aged 18 or older, consistent with our Terms of Service. We do not knowingly collect information from anyone under 18. If you believe a minor has given us information, email support@imgai.ai and we will delete it promptly.

12. Third-party links and services

The Service includes third-party links and integrates third-party sign-in, payments, storage, analytics, and AI models. This Policy covers information we collect directly. We are not responsible for third-party practices; review their policies before you use them.

13. Changes

For material changes we will give at least 14 days' notice by a site announcement or email to your registered address, and we will update the date at the top of this page. Continued use after the effective date is acceptance.

14. Contact

This Policy is not legal advice.

ImgAI · https://imgai.ai