Privacy Policy

Effective date: 2026-09-18

1. Data controller

The controller of personal data is PBEODEV Piotr Ożóg, Leśna 329, 37-204 Gorzyce, Polska, tax identification number PL7941797603, referred to below as the “Controller”. Questions concerning personal data may be sent to support@artiogen.ai. The Controller has not appointed a data protection officer.

This Policy covers artiogen.ai, the application at app.artiogen.ai, Accounts, payments, correspondence and Generations. Capitalised terms have the meanings given in the Terms of Service.

2. Processing roles

The Controller determines the purposes and means of processing Account, security, billing, support and content data needed to provide the Service. External Model providers, infrastructure vendors and email vendors generally process data on the Controller's instructions to the extent determined by the relevant agreement and selected service.

Paddle acts as Merchant of Record and as a separate controller of buyer data. Google acts as a separate controller for its sign-in service. The owner of a particular Model may act as a further processor or a separate controller under its own terms.

3. Data we process

• Account: email address, password hash, display name, language, Account status, email verification date and last sign-in date.
• External sign-in: the sign-in provider, its persistent user identifier, email address, verification status and name supplied during sign-in.
• Sessions and security: session-token hash, session identifier, salted IP-address hash, browser and device information, sign-in time and result, access attempts, security events and Account activity history.
• MFA: second-factor status, encrypted TOTP secret, recovery-code hashes, use dates and short-lived sign-in challenges. The Controller does not store TOTP or recovery codes in plain text.
• Generations and material: prompts, uploaded files, parameters, selected Model, Inputs, Outputs, thumbnails, technical file metadata, tags, time, result and Generation cost. Material may contain personal data of people depicted or described by the User.
• Billing: Plan, Credit balance and pools, transactions, usage, payment-operator customer and subscription identifiers, status and payment events. The Controller does not receive a full card number or security code.
• Consents and contracts: the accepted version of the Terms, time of acceptance and technical data needed to demonstrate it.
• Correspondence: reports, complaints and other messages, and data needed to handle them.

4. Sources of data

Data comes from the User, their device and activity within the Service, from Google when Google sign-in is selected, from Paddle in connection with a payment, and from Model providers while a Generation is performed. Third-party data may come from Input supplied by the User. The User should provide such data only when an appropriate legal basis exists.

5. Purposes and legal bases

• Creating and operating an Account, authentication, performing Generations, storing material, and administering Plans and Credits — Article 6(1)(b) GDPR, performance of a contract.
• Billing, accounting and tax records, and responses to authorities — Article 6(1)(c) GDPR, compliance with a legal obligation.
• Protecting the Service and Accounts, preventing fraud and abuse, enforcing the Terms, and establishing, exercising or defending legal claims — Article 6(1)(f) GDPR, legitimate interests.
• Handling complaints, infringement reports and data-subject rights — Article 6(1)(b), (c) or (f) GDPR depending on the matter.
• Messages necessary for Account operation, security, payments and material service changes — Article 6(1)(b), (c) or (f) GDPR. The Controller does not currently operate a marketing newsletter.

Providing Account data and data needed for a Generation is voluntary, but the relevant function cannot be provided without it. The Controller does not request special-category data. A User must not place such data in Input unless the Controller expressly enables the relevant function and identifies an appropriate legal basis and safeguards.

6. Data recipients

Data may also be disclosed to legal and accounting advisers, insurers, auditors, a purchaser of the business and public authorities where a legal basis exists. The Controller does not sell personal data or disclose it to third parties for their marketing.

7. AI providers, retention and training

A Generation route may involve fal or Replicate and the owner of the selected Model. A primary provider may be replaced by a fallback provider during a failure. Input may therefore be sent to more than one provider only where the first request was unambiguously not accepted; in an uncertain state, the Service should not automatically send a second billable request.

• fal: its public API terms state that fal does not use Client Content to create or train its products or services, except for Models or third-party APIs marked as excluded from enterprise protections. By default, fal may store Input and Output payloads; retention and deletion options depend on settings, file type and Model terms.
• Replicate: its documentation states that API prediction data — Input and Output parameters, values and files, and logs — is removed after one hour by default. Its terms permit processing to provide the service, train a derivative model expressly requested by the customer, and compile aggregated and anonymised data. Additional Model-owner terms may apply.

The Controller does not use Input or Output to train its own models. It cannot, however, guarantee an unconditional training prohibition or identical retention practices for every external Model owner. Users should therefore not submit sensitive data, secrets or third-party data without a proper legal basis and risk assessment.

8. Transfers outside the EEA

Some recipients process data in the United States or other countries outside the European Economic Area. Depending on the entity, transfers rely on a European Commission adequacy decision, EU-U.S. Data Privacy Framework certification, European Commission standard contractual clauses, binding corporate rules or another mechanism permitted by law.

• fal provides a DPA containing standard contractual clauses and subprocessors.
• Cloudflare relies on the EU-U.S. Data Privacy Framework and contractual safeguards.
• The Salesforce group publishes binding corporate rules and standard contractual clauses.
• The United Kingdom is covered by a European Commission adequacy decision.
• Replicate's public documents currently identify neither an EEA transfer mechanism nor a public DPA for an ordinary API account. A route involving Replicate may be made available to a User in the EEA only after appropriate processor terms and a transfer basis have been secured. Disclosure in this Policy does not itself replace them.

A copy of applicable safeguards may be requested at support@artiogen.ai, subject to protection of confidential information.

9. Retention periods

• Account data — for the contract term and afterwards until billing and claims are closed.
• Input, Output and material in the Controller's storage — while needed to provide the User's library and, following a verified deletion request, until deletion from active systems is complete. Permanent deletion is currently handled on request through support@artiogen.ai.
• Data held by Model providers — as described in section 7 and the terms of the relevant Model; this may be shorter or longer than storage by the Controller.
• Billing and accounting data — for the period required by tax and accounting law.
• Sessions and tokens — until expiry, use or revocation. Hashes of used recovery codes may remain as a security record until MFA is disabled or the Account is deleted.
• Audit logs and security events — for the period needed to detect abuse, investigate incidents and defend claims, determined by event severity and applicable limitation periods.
• Correspondence — until the matter is closed and then for the period needed to defend claims.

Data may be retained longer where required by law, preservation of evidence, a dispute or an authority's order. Backup copies are removed or overwritten according to the cycle of the relevant infrastructure. Deleted data is not restored to ordinary use unless necessary for disaster recovery, compliance with a legal obligation or preservation of a legal claim.

10. Data-subject rights

A person may request access, a copy, rectification, erasure, restriction of processing, data portability, or object to processing based on legitimate interests. Where consent is the basis, it may be withdrawn without affecting earlier processing.

A request may be sent to support@artiogen.ai. The Controller may ask for information needed to confirm identity. It responds without undue delay, normally within one month; this period may be extended where the law permits. Some rights are subject to statutory limitations, which will be explained in the response.

A complaint may be lodged with the President of the Polish Personal Data Protection Office or a supervisory authority in the country of the person's habitual residence, place of work or the alleged infringement.

11. Cookies and device storage

The static site at artiogen.ai does not use analytics or advertising cookies and does not load external tracking scripts. Structured data embedded in the site does not track visitors.

The application at app.artiogen.ai uses only mechanisms necessary for sessions, CSRF protection, temporary Google sign-in state, MFA challenges and language preferences. They do not require consent because they are necessary for a requested function or security. Checkout may load the Paddle script; Paddle applies its own mechanisms under its policy.

12. Security

Measures include HTTPS, password hashing, token and IP-address hashing, MFA-secret encryption, access restrictions, private file storage, short-lived signed URLs, audit logs and access controls. No system can provide an absolute security guarantee. A suspected vulnerability or breach should be reported to support@artiogen.ai without publicly disclosing other people's data.

13. Automated decisions and moderation

The Service may automatically reject Input, rate-limit activity, select a provider route or flag an event as risky. Automation is used to perform the contract and maintain security. It is not used for credit, employment or other decisions producing legal effects of similar significance for the User. A material Account restriction may be challenged through support@artiogen.ai.

14. Changes to this Policy

This Policy may change when law, the Service, a vendor or processing practices change. Once the Service has customers, the Controller will notify them of a material change by email and within the Service at least 14 days in advance, unless law or urgent security requires a different period. Earlier versions remain available at dated addresses.