Privacy Policy

1. Accounts and authentication

1.1 Registration and sign-in involve your email, account identifier, authentication result and necessary login records, to create the account, verify identity, restore access and protect security. If you set a password, authentication uses password-verification data; passwords are not kept as plaintext account records.

1.2 We store display names and preferences you choose to provide. Optional profile information is not a condition of basic functionality.

1.3 Verification codes, security notices and recovery messages are sent to your email. Do not send support your password or complete verification code. Verification requests should be proportionate to their purpose.

2. Images, prompts and tasks

2.1 We receive original and reference images, prompts, editing instructions and parameters, and generate or store outputs, thumbnails and task records to perform your requests, show previous results and support editing or downloads.

2.2 These files or text may contain personal information, including identifiable likenesses, names, order details and contact information. Files may contain embedded metadata. Remove unrelated information before uploading; do not submit unnecessary identity documents, financial details or health records through ordinary editing features.

2.3 When submitting another person’s likeness or information, you must have appropriate permission or another lawful basis and explain the intended use. We remain responsible for our own duties in handling information received.

2.4 Sensitive information requires a specific purpose, necessity and the notices and separate consent required by applicable law. Ordinary image processing does not by itself mean that identity-recognition profiles are created.

3. Credits, orders and support

3.1 We maintain credit balances, grants, charges and returns, with relevant task or order identifiers, to meter service, reconcile balances and resolve disputes.

3.2 Online payment is not yet available. Before enabling it, we will identify the provider and processing arrangements. Payment may involve order amounts, timestamps, payment status and transaction identifiers; information collected directly by a payment provider must be explained during checkout.

3.3 Support, complaints, refunds and privacy requests involve the contact details, descriptions, screenshots and correspondence you supply and necessary handling records. Avoid providing unrelated personal information.

4. Devices, logs and cookies

4.1 To operate the Service, diagnose failures and prevent attacks, we may record request times, IP addresses, browser and operating-system types, accessed paths, request outcomes and necessary error details. Use is limited to those purposes.

4.2 Necessary cookies or similar technologies maintain sessions, validate authentication requests, prevent cross-site request forgery and retain essential settings. Public-facing identifiers should not contain your password.

4.3 You may remove or restrict cookies through your browser. Restricting necessary cookies may prevent sign-in or disrupt sessions and preferences, but does not remove your statutory privacy rights.

4.4 If we introduce non-essential advertising, analytics or tracking technologies, we will identify their providers, purposes, information and choices and obtain consent where required. Necessary cookie lifetimes depend on session type and security settings. Expiry, sign-out or removal may require you to authenticate again.

5. Purposes and limits

5.1 Purposes include account access, requested image processing, storage and access to your work, credits and orders, support, security, service reliability, and legal retention, investigations or dispute handling.

5.2 Essential service notices are treated separately from marketing. Codes and account, incident or order notices may be necessary; marketing must have a lawful basis and an accessible opt-out.

5.3 We do not sell your personal information. Public case studies, promotional display or unrelated uses of your work require appropriate prior authorisation.

5.4 Material changes in purposes, methods or categories require renewed notice and any necessary authorisation. Truly anonymised information cannot identify a person and cannot be restored to an identifiable form. Removing a name or account identifier alone does not necessarily anonymise data.

6. AI processing and providers

6.1 Selected features may transmit images, prompts and necessary parameters to a model or image-processing provider. Information supplied must correspond to the feature, rather than automatically sending complete account records to every provider.

6.2 Inference to perform a requested task is distinct from training, evaluation or model improvement. Basic service permissions do not include independent general-purpose model training. A proposed additional use requires an explanation of purpose, scope and choices, and appropriate authorisation.

6.3 Provider retention, human review and model-improvement arrangements depend on the product, access method, contract and account settings actually used. We will explain the arrangements applicable to the feature used. Additional uses beyond performing your task require the notices and authorisation applicable by law.

6.4 We retain applicable duties to select, contract with and supervise participating providers. Linking to their policies does not remove our responsibilities.

7. Processors, other recipients and disclosure

Technical providers currently include Google (model processing), Replicate (background removal and enhancement), Alibaba Cloud (image storage and email) and Google Cloud (infrastructure hosting). Providers and information needed vary by feature.

7.1 Technical providers may process information for hosting, storage, email, models or support within an agreed scope. Purpose, duration, categories and access must be limited, with appropriate safeguards.

7.2 If information is supplied to another party independently determining its purposes or methods, we will provide legally required recipient and processing details and obtain separate consent where required. Where information is provided to another independent controller, the relevant recipient and rights contacts must be explained before that disclosure.

7.3 We do not publicly disclose personal information except where you choose publication, separately authorise it, or law allows or requires it. Official requests are assessed for legal basis and disclosures limited to what is necessary.

7.4 Mergers, transfers, dissolution or similar changes affecting the responsible operator require appropriate notice and continuity of protection. A change of processing purposes or methods requires the applicable procedures to be followed.

8. Locations and international transfers

8.1 Account authentication and image storage are deployed in Tokyo, Japan. Third-party model and infrastructure providers may process information in other countries, so information may be handled or stored outside your country or region.

8.2 International transfers require the recipient details, purposes, methods, categories and rights procedures applicable under relevant law, together with separate consent and other steps where legally required.

8.3 Acceptance of this Policy, registration or continued use does not replace legally required separate transfer consent. Contact us under section 14 for arrangements applicable to a feature you use.

9. Retention and deletion

9.1 Retention is determined by purpose, fulfilment, disputes and legal duties. An active account is not by itself a reason to retain every category indefinitely. Information will be deleted or anonymised when its retention period ends or the purpose has been achieved, cannot be achieved or is no longer necessary, subject to applicable law.

9.2 Deleting an image in the workspace first removes the relevant listing or display record. Underlying files, historical task attachments, outputs, thumbnails, logs and backups may not disappear simultaneously. Removing an item from view differs from permanent file erasure.

9.3 Following a valid deletion or closure request, we will verify and delete or anonymise information as required by law. Where legal retention or technical constraints prevent immediate erasure, further handling should be limited to storage and necessary protection, not unrelated reuse.

9.4 Information in backups is removed through backup rotation and deletion procedures. Pending removal, access and use will be restricted, and restoration will include necessary measures to prevent deleted information from returning to ordinary business use.

9.5 If operations cease, we will give required notice and delete, anonymise or otherwise handle information as law requires.

10. Your rights

• Access and copies: review account, task and related information, and request a copy of personal information about you.
• Correction: correct or complete inaccurate information through available controls or by contacting us.
• Deletion: request erasure where the applicable conditions are met.
• Withdrawal and restriction: withdraw consent-based permissions and exercise applicable rights to restrict or object to processing.
• Account closure: request closure of the account and related service, with subsequent data handling under section 9.
• Explanation and redress: request an explanation, seek review of a decision, or complain to the competent authority.

10.1 Use available workspace controls or write to support@eidopix.com. We may verify identity and scope to prevent impersonation, but will not require unrelated material or impose unreasonable barriers.

10.2 We will respond within the period required by applicable law. If a request cannot be fulfilled, we will explain the lawful grounds and available recourse. Other people’s rights, trade secrets and legal retention duties may justify proportionate limits.

10.3 Withdrawal does not affect earlier lawful processing. It stops only processing affected by that withdrawal. A feature may become unavailable when the information is necessary for that feature; unaffected services will not automatically be withdrawn.

11. Information about minors

11.1 Registration is intended for adults aged eighteen or over. We do not target minors for account registration and will investigate and address an ineligible account as required by law.

11.2 Images submitted by adults may nevertheless contain information about minors. Required guardian authorisation and purpose-specific necessity must be addressed when processing a child’s or other minor’s likeness or information.

11.3 A guardian who believes information was submitted without appropriate authority may request verification, restriction or deletion through section 14.

12. Security

12.1 Safeguards must match information types, scale and risks, including access control, secure password storage, necessary transmission and storage protection, permissions management and incident response. Measures must reflect and be maintained for the actual deployment.

12.2 Staff and technical-provider access to content must be limited to service delivery, security, support or another lawful purpose. Administrative access is not permission for arbitrary use.

12.3 If loss, alteration or unauthorised disclosure occurs or may have occurred, we will take remedial measures and provide legally required reports and notifications to authorities and affected individuals.

13. Policy changes

13.1 Revisions will appear on this page. Significant changes in purpose, categories, recipients or rights procedures will be highlighted appropriately; renewed consent will be sought where required.

13.2 A policy update does not authorise arbitrary repurposing of information already collected. Contact us under section 14 to ask about a change or obtain the previous version relevant to you.

14. Contact

Contact us with questions about this Policy or processing, or to make a rights request, complaint or appeal. Describe your request and provide only information necessary to verify and handle it.

Responsible operator: the Eidopix team

Contact address: XXXXX

Privacy requests and complaints: support@eidopix.com

Account and application server locations: XXXXX

Image and file storage locations: XXXXX

Recipients and processing details: XXXXX

Model-provider retention, review and training arrangements: XXXXX

Account and content retention: XXXXX

Deletion-request handling and file-erasure periods: XXXXX

Security and access-log retention: XXXXX

Backup retention and rotation: XXXXX

Cookies and similar technologies: XXXXX