Privacy Policy

We collect information that you provide directly to us, including:

• Account Information: When you create an account, we collect your email address and password (stored in hashed form). We never store your password in plain text.
• Profile Information: Any additional information you choose to add to your profile.
• Payment Information: When you purchase a subscription or credit pack, payment is processed through Stripe. We never directly store your credit card number, CVV, or full payment card details. Stripe handles all payment processing in accordance with PCI-DSS standards.
• Third-Party API Keys: If you choose to provide your own API keys (e.g., OpenAI, Ideogram, FLUX via Replicate) through our Bring Your Own Key (BYOK) feature, these keys are encrypted using AES-256-GCM before storage and are never logged, shared, or transmitted to any party other than the respective API provider during your authorized use.
• Contact Information: When you contact us through our contact form, we collect your name, email address, and message content.
• User Input: Text prompts and design parameters you submit to generate AI content through the Services.

When you access or use the Services, we may automatically collect certain information, including:

• Usage Data: Information about how you use the Services, including the number of designs generated, features accessed, credits consumed, and subscription activity.
• Device Information: Information about the device you use to access the Services, including device type, operating system, and browser type.
• Log Data: Server logs that may include your IP address, access times, pages viewed, and referring URL.

When you connect third-party services through the Services (such as Printify), we may receive limited information from those services necessary to facilitate the integration, such as shop names and connection status. We do not receive or store your credentials for those third-party services beyond the API keys you explicitly provide.

We use the following third-party services to operate the Services:

• Supabase: Authentication, database hosting, and file storage. Your account information, profile data, and generated design metadata are stored in Supabase.
• Stripe: Payment processing for subscriptions and credit packs. When you make a payment, your payment information is transmitted directly to Stripe. We never store your full payment card details.
• OpenAI / Ideogram / Replicate (FLUX): AI design and text generation. Text prompts you submit are sent to these services for processing in accordance with their respective privacy policies. When using the platform's default API keys, your prompts are processed through our accounts with these providers. When using BYOK, your prompts are processed through your own accounts.
• Printify: Print-on-demand integration. When you connect your Printify account and create products, design files and product information are transmitted to Printify in accordance with their privacy policy.
• Sentry: Error monitoring and performance tracking. Technical error data (which may include anonymized usage information) is sent to Sentry to help us identify and fix issues.
• Nodemailer / Gmail SMTP: Transactional email delivery. Your email address is used to send account-related notifications.

We may disclose your information if required to do so by law or in the good faith belief that such action is necessary to: (A) comply with a legal obligation; (B) protect and defend the rights or property of the Company; (C) prevent or investigate possible wrongdoing in connection with the Services; (D) protect the personal safety of users of the Services or the public; or (E) protect against legal liability.

If the Company is involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our Website of any change in ownership or uses of your personal information.

Your data is stored using Supabase's cloud infrastructure. Design files and images are stored in Supabase Storage. We retain your account data for as long as your account is active.

We implement industry-standard security measures to protect your personal information, including:

• Encrypted storage of all API keys using AES-256-GCM encryption
• Hashed passwords (never stored in plain text)
• HTTPS encryption for all data in transit
• Row-level security (RLS) policies on database tables
• Server-side authentication checks on all API routes
• Rate limiting to prevent abuse

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

You can access, update, or correct your account information at any time by logging into your account and visiting the Settings page.

You may request deletion of your account and associated personal data at any time by emailing support@aiprintondemand.com. Upon receiving a verified deletion request, we will delete your account and personal information within thirty (30) days, except for information we are required to retain for legal, regulatory, or legitimate business purposes.

You will receive transactional emails related to your account activity (such as welcome emails, subscription confirmations, and credit notifications). These transactional emails are necessary for the operation of the Services and cannot be opted out of while maintaining an active account.

You may remove any third-party API keys you have provided at any time through the Settings page. Upon removal, the encrypted key is deleted from our systems.