Privacy Policy

1. INFORMATION WE COLLECT

We collect information that you provide directly to us, information we collect automatically when you use our Services, and information from third-party sources. The categories of personal information we collect include:

Personal Information You Provide

• Account Information: When you create an account, we collect your email address, name, and password (or authentication credentials if you sign in via Google OAuth).
• Payment Information: When you purchase credits or subscriptions, we collect billing details processed through our payment processors — Stripe, Inc. and, for transactions denominated in Indian Rupees, Razorpay Software Private Limited. We do not directly store your full credit card number, expiration date, CVV, UPI, or bank details — this data is handled exclusively by the payment processor (Stripe is PCI DSS Level 1 certified).
• User Content: Text prompts, images, audio files, and other media you upload to or generate through our Services.
• Communications: Information you provide when you contact our support team, submit feedback, or participate in surveys.
• Profile Information: Any additional information you choose to add to your account profile.

Biometric and Facial Data

Certain features of our Services process data that may be classified as biometric data under applicable laws, including the Illinois Biometric Information Privacy Act (BIPA), Quebec's Law 25, and the EU General Data Protection Regulation (GDPR). This includes:

• Facial Geometry Data: When you use face swap, face enhancement, head swap, skin detailing, or avatar generation features, facial images you upload are processed to extract facial geometry and features necessary for AI generation. This data is used solely for the purpose of producing the requested AI-generated output.
• Voice Biometric Data: When you use voice cloning or voice generation features, audio samples you upload are processed to create voice models. These voiceprints are used solely for generating AI voice outputs associated with your account.
• Purpose Limitation: Biometric data is processed exclusively to provide the AI generation features you request. It is not used for identification, surveillance, authentication, or any purpose other than content generation.
• No Sale or Sharing: We do not sell, lease, trade, or otherwise share your biometric data with any third party, except as strictly necessary for the AI processing infrastructure described in Section 6 (specifically, a third-party GPU cloud infrastructure provider for inference processing).
• Retention: Uploaded facial images and voice samples are retained in your account for as long as you maintain the content. You may delete biometric data at any time through your account dashboard. To have every stored file deleted when you close your account, see Section 8 (Account Data).
• Consent: By uploading facial images or voice samples to our Services, you provide your informed, written consent to the collection, processing, and storage of this biometric data for the purposes described above. You may withdraw consent at any time by deleting the uploaded content or your account.
• Third-Party Uploads — Allocation of Roles: Where you upload the face, voice, or other biometric identifier of a person other than yourself, then as between you and Imagera AI, you are the party that collects that data for the purposes of applicable biometric-privacy laws, and you are responsible for the notices and consents those laws require (see Section 10.10 of our Terms of Service). Imagera AI processes such uploads solely as your service provider, on your instructions, for the sole purpose of returning the output you request.

BIPA Notice (Illinois Residents)

If you are a resident of Illinois, the Illinois Biometric Information Privacy Act (740 ILCS 14, "BIPA") requires us to provide you with the following specific disclosures before collecting your biometric data:

• What We Collect: When you use face swap, face enhancement, head swap, skin detailing, avatar generation, or voice cloning features, we collect biometric identifiers including facial geometry data (from uploaded images) and voiceprints (from uploaded audio). These constitute "biometric identifiers" and "biometric information" as defined by BIPA.
• Purpose of Collection: Biometric data is collected solely for the purpose of providing the AI content generation features you request. It is not used for identification, verification, surveillance, or any purpose other than generating the specific AI output you requested.
• Storage and Retention: Biometric data is stored on encrypted servers (Supabase) for as long as you maintain the content in your account. When you delete a file it is removed from your account, and on a verified request we delete all files stored under your account within 30 days (Section 8). Imagera AI will permanently destroy biometric data when: (a) the initial purpose for collecting the data has been satisfied; or (b) within 3 years of the individual's last interaction with the Services, whichever occurs first.
• No Sale or Disclosure: We do not sell, lease, trade, or otherwise profit from your biometric data. We do not disclose biometric data to any third party except as strictly necessary for the AI processing infrastructure (a third-party GPU cloud infrastructure provider for inference), and only under contractual obligations that prohibit that provider from retaining or using the data for any other purpose.
• Written Release: By uploading facial images or voice samples and using the biometric-dependent features of our Services, you execute a written release authorizing Imagera AI to collect, capture, store, and use your biometric identifiers and biometric information as described in this notice. This constitutes a "written release" as required by 740 ILCS 14/15(b).
• Your BIPA Rights: You have the right to: (a) access information about biometric data collected from you; (b) request deletion of your biometric data at any time; (c) revoke your consent to biometric data collection (by deleting content or your account). To exercise your BIPA rights, contact us at support@imagera.ai with the subject line "BIPA Request."

Universal Data Processing Across All Features

The following applies to all features of our Services — including all current and future AI generation, editing, enhancement, cloning, training, and processing tools. When you use any feature of our Services:

• Inputs You Provide: Any media you upload (images, videos, audio, text prompts, reference files) is processed by our AI infrastructure to generate the requested output. We collect and temporarily process this data solely for the purpose of providing the feature you requested.
• Biometric Data: Features that process faces, voices, or body movements may extract biometric identifiers (facial geometry, voiceprints, body pose data). This data is classified as sensitive personal information under PIPEDA, GDPR, BIPA, and other applicable laws. It is processed exclusively for content generation and is never used for identification, surveillance, or profiling.
• AI Model Training (LoRA): If you use our LoRA training feature to create custom AI models based on your images (e.g., your face, a product, or a style), the training data you provide is used solely to build a model associated with your account. Trained models are private to your account and are not shared with other users or used by Imagera AI for any other purpose. You may delete your trained models at any time.
• Generated Outputs: All AI-generated content is stored in your private vault. We do not share or use your generated content for our own purposes except: (a) as required by law or valid legal process; (b) to enforce our Terms of Service and content safety policies; (c) to provide support; or (d) to operate, secure, and fix the Services. Authorized staff access is logged (see Section 6).
• No Cross-Feature Data Sharing: Data you provide to one feature is not used by other features unless you explicitly initiate such use (e.g., using a generated image as input to another tool).
• No Third-Party Model Training: None of your inputs, outputs, or data from any feature is used to train, fine-tune, or improve any AI models — whether our own or third-party models — without your explicit opt-in consent.

Information Collected Automatically

• Usage Data: Generation history, credit consumption, feature usage patterns, and interaction logs.
• Device and Browser Information: Browser type and version, operating system, device type, screen resolution, and unique device identifiers.
• Network Information: your IP address is received with each request and used for security, fraud and abuse prevention, safety enforcement, and to derive an approximate location. We store your full IP address in our sign-in session records, security logs, signed-consent records (such as the Unrestricted agreement), and content-safety records. In our analytics, consent-to-terms, and anti-abuse records we store only a truncated network portion or a non-reversible hash, together with your internet service provider and approximate location. See Section 8 for how long each is kept.
• Log Data: Access times, pages viewed, referring URL, and actions taken within the Services.
• Cookie Data: Information collected through cookies, pixels, and similar tracking technologies (see Section 7).

Information from Third Parties

• Google OAuth: If you sign in with Google, we receive your name, email address, and profile picture from Google.
• Stripe: Payment confirmation, subscription status, and transaction identifiers.
• Analytics and Advertising Partners: usage, measurement, and conversion data from the analytics and advertising services described in Section 6 and Section 7.

2. HOW WE COLLECT INFORMATION

We collect information through the following methods:

• Direct Collection: When you register for an account, make a purchase, submit content for AI processing, or contact us.
• Automated Collection: Through cookies, web beacons, log files, and similar technologies when you interact with our Services.
• Third-Party Collection: From authentication providers (Google), payment processors (Stripe, Razorpay), and the analytics and advertising services listed in Section 6.
• AI Processing: When you use our AI generation tools, we process your input prompts and uploaded media to generate the requested output.

3. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

Service Delivery

• To create, maintain, and secure your account
• To process AI generation requests (images, videos, voices, music, avatars, and related content)
• To manage your credits, subscriptions, and billing
• To store your generated content in your personal vault
• To provide customer support and respond to your inquiries

Service Improvement

• To analyze usage patterns and optimize platform performance
• To improve AI generation quality, speed, and reliability
• To develop new features and tools
• To conduct research and analytics on platform usage

Communication

• To send service-related communications (account updates, generation status, billing notifications)
• To send marketing communications (with your consent, where required)
• To notify you of changes to our Terms of Service or Privacy Policy

Security and Legal

• To detect, prevent, and address fraud, abuse, and security issues
• To enforce our Terms of Service and other policies
• To comply with applicable laws, regulations, and legal processes
• To protect the rights, property, and safety of Imagera AI, our users, and the public

4. AI-GENERATED CONTENT AND DATA

Given the nature of our AI-powered Services, this section addresses how we handle data related to AI content generation specifically:

• Input Processing: When you submit prompts or upload media for AI processing, your inputs are sent to our AI infrastructure (hosted on secure third-party GPU cloud servers) for generation. Inputs are processed in real-time and are not used to train or improve our AI models unless you explicitly opt in to such a program.
• Generated Outputs: AI-generated content (images, videos, audio, etc.) is stored in your personal vault on our secure Supabase infrastructure. This content is accessible only to you unless you choose to share it. Video files are subject to plan-based storage retention windows and are automatically deleted when their window ends — see Section 8 (Data Retention).
• Prompt Data: We may retain your generation prompts in association with your account for the purpose of providing generation history and allowing you to re-run or reference previous generations.
• No Model Training: We do not and will not use your personal content, prompts, uploaded media (including facial images and voice samples), or generated outputs to train, fine-tune, evaluate, or improve any AI or machine learning models — whether our own or those of any third party — without your explicit, informed, and separately obtained opt-in consent. Our third-party AI processing providers are contractually prohibited from using your data to train their models. If this policy ever changes, we will obtain fresh, explicit consent from affected users before any such use.
• Uploaded Media: Images, videos, and audio files you upload for processing (e.g., for image upscaling, video enhancement, voice cloning) are processed and stored securely. You may delete this content at any time through your account dashboard.
• Voice Data: If you use our voice cloning or voice generation features, the audio samples you provide are processed to create voice models associated with your account. You are responsible for ensuring you have the right to use any voice samples you upload.

5. LEGAL BASES FOR PROCESSING

We process your personal information based on the following legal grounds:

• Contract Performance: Processing necessary to perform our contract with you (e.g., providing the Services, managing your account, processing payments).
• Legitimate Interests: Processing necessary for our legitimate business interests (e.g., improving our Services, fraud prevention, security), provided these interests do not override your rights and freedoms.
• Consent: Processing based on your explicit consent (e.g., marketing communications, optional analytics). You may withdraw your consent at any time.
• Legal Obligations: Processing necessary to comply with applicable laws, regulations, and legal processes (e.g., tax requirements, law enforcement requests).

6. DATA SHARING AND THIRD-PARTY SERVICES

We never sell your personal information or generated content to third parties.

We share your information only with the following categories of service providers, and only to the extent necessary to operate and improve our Services:

• Supabase: Database hosting, authentication, and secure storage of your account data and generated content. Supabase provides row-level security and encrypted storage.
• Stripe, Inc.: Payment processing and subscription management. Stripe processes your payment information directly and is PCI DSS Level 1 certified. Stripe never has access to your generated content.
• Razorpay Software Private Limited: Payment processing for transactions denominated in Indian Rupees. Razorpay processes your payment information directly under its own privacy policy and applicable Reserve Bank of India regulations; we do not store your full card, UPI, or bank details. For any payment processor we use (including Stripe and Razorpay), when a transaction is disputed we disclose the dispute-evidence records described in Section 9 of our Refund Policy — registration, consent, transaction, and service-delivery records — to the processor, the relevant card or payment network, and the issuing bank, as necessary to establish and defend legal claims and to prevent fraud.
• AI Model Providers and GPU Infrastructure: several third-party AI model and inference providers, located mainly in the United States and in other countries, process your generation inputs (prompts, uploaded media, and settings) to produce the output you request, and some operate their own content-safety systems. Language-model features (such as the AI Companion, prompt enhancement, and assistants) send your text to large-language-model providers through a routing service.
• Cloudflare: Application hosting, media storage, content delivery network (CDN), DDoS protection, and security services.
• Resend: Delivery of account, transactional, and product emails.
• Google (OAuth): Authentication for users who choose to sign in with Google. Google provides us with your basic profile information.
• Analytics: Google Analytics (through Google Tag Manager), Microsoft Clarity (which records sessions — clicks, scrolling, and page content — to show how pages are used), Statsig (product analytics, experiments, and session replay, identified by your account ID and email), PostHog (product analytics — which pages and tools lead to sign-ups and purchases, identified by your account ID, with no session recording; if you accepted analytics cookies at checkout, our servers also tell PostHog when a payment, refund or subscription change happens), and Ahrefs Web Analytics (page-view statistics). We also record the pages you visit while signed in, linked to your account, to understand and improve user journeys.
• Advertising Measurement: the Meta Pixel and Meta Conversions API, the Reddit Pixel and Reddit Conversions API, and Google Ads measurement tags. These tell advertising platforms that a visit, sign-up, or purchase came from one of our ads. Server-side conversion reports send hashed identifiers (such as a hashed email address), your IP address, and browser details. The browser pixels follow your cookie choices. Server-side sign-up and purchase reports are sent for users in the European Economic Area, the United Kingdom, and Switzerland only with consent; for users elsewhere they are sent unless you opt out by emailing support@imagera.ai with the subject line "Advertising opt-out".
• Sentry: Error and performance monitoring. When something breaks, Sentry receives technical details that can include your account ID, email, IP address, and — for a sample of sessions — a replay of the screen at the time of the error. The Imagera Code command-line app sends short problem reports to Sentry when it crashes or a task fails; API keys, email addresses and file paths are removed first, and no code, prompts or files are sent. You can turn these reports off by setting IMAGERA_TELEMETRY=0.
• ElevenLabs: Voice synthesis and speech recognition for AI Companion voice call features. Processes voice audio in real time for text-to-speech and speech-to-text conversion. Audio is not permanently stored by ElevenLabs after processing.

We may also disclose your information if required to do so by law, or if we believe in good faith that such disclosure is necessary to: (a) comply with legal process or governmental requests; (b) enforce our Terms of Service; (c) protect the rights, property, or safety of Imagera AI, our users, or the public; or (d) detect, prevent, or address fraud, security, or technical issues.

In the event of a merger, acquisition, bankruptcy, or other corporate transaction, your personal information may be transferred to the acquiring or successor entity. We will notify you of any such change in ownership or control.

Sub-Processor Obligations

All third-party service providers listed above ("sub-processors") are contractually required to:

• Process personal data only to provide their service to us, in accordance with their agreements with us.
• Implement appropriate technical and organizational security measures to protect your data.
• Not use your generation inputs or outputs to train their models, where their terms with us provide for this. We select AI providers whose business terms state that customer inputs and outputs are not used for training.
• Notify us of any data breach or security incident involving your data.

The categories above describe our current service providers. We update this section when they change materially. If you object to a provider, you may close your account and request deletion of your data.

Staff access. Authorized Imagera staff can access account records, prompts, uploaded media, and generated content where needed to operate and secure the Services, provide support, investigate safety or abuse reports, handle payment disputes, and fix errors. Every such staff access is logged.

7. COOKIES AND TRACKING TECHNOLOGIES

We use the following types of cookies and tracking technologies:

Essential Cookies

Required for the basic functionality of our Services, including authentication, session management, and security. These cookies cannot be disabled without impairing core functionality.

Analytics Cookies

Used to understand how users interact with our Services, measure performance, and identify areas for improvement. We use Google Analytics, Microsoft Clarity (including session recordings), Statsig, and Ahrefs Web Analytics. Some of this data is linked to your account (see Section 6).

Advertising and Conversion Measurement

We use the Meta Pixel, the Reddit Pixel, and Google Ads measurement tags, and their server-side conversion APIs, to measure whether our advertising leads to visits, sign-ups, and purchases. They may set cookies such as _fbp, _fbc, and _rdt_uuid. See our Cookie Policy for details.

Functional Cookies

Used to remember your preferences (such as language, theme, and display settings) and provide enhanced functionality.

Managing Cookies

You can manage your choices at any time with the "Cookie Preferences" link in our footer, and through your browser settings. Where the law requires opt-in consent (for example in the EU, the UK, and Quebec), optional analytics and advertising cookies are off until you accept them; elsewhere they are on by default and you can turn them off. Disabling essential cookies may affect the functionality of our Services.

8. DATA RETENTION

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Specific retention periods include:

• Account Data: Retained for as long as your account is active. When you delete your account, your profile, credits, generation history, settings, and linked analytics records are deleted straight away, except the records described below that we keep for legal reasons. Files you uploaded or generated are not all removed automatically yet: before deleting your account, delete any files you want gone from your vault, or email support@imagera.ai with the subject line "Delete my files" and we will delete the files stored under your account within 30 days of a verified request.
• Generated Content (images and audio): AI-generated images, voices, music, and avatars remain in your vault until you delete them or until account deletion. You can delete individual items at any time.
• Generated and Uploaded Video — Plan-Based Storage Retention: Video files are subject to a storage retention window that depends on your plan — from 7 days for free or lapsed accounts up to 90 days on the highest paid tiers, as shown in your plan's features. After the applicable window, video files may be automatically and permanently deleted from storage by a scheduled cleanup process at any time, and cannot be recovered. Download any video you wish to keep before its retention window ends. Retention windows apply per file from its creation date; a lapsed subscription reverts your videos to the free-tier window.
• Storage Allowance — Automatic Removal of Older Files: Each account has a total storage allowance covering both generated and uploaded media, which depends on your plan — from 512 MB on free accounts up to 100 GB on the highest paid tier, as shown in your account's storage section. If an upload would exceed your allowance, we may automatically and permanently delete your oldest stored items to make room, and will tell you what was removed. Favourited items, media used in a shared project or a public link, profile photos, trained model files and their training data, and anything created in the last 24 hours are never removed this way. You can see your current usage at any time in your account settings, and you can free space yourself by deleting items you no longer need.
• After a Subscription Ends: If your subscription lapses or is cancelled, your stored media is kept for at least 60 days from the date entitlement ends and may then be permanently deleted. Re-subscribing at any point during that window stops the deletion. We show the exact deletion date in your account settings for the whole period. This is separate from, and in addition to, the per-file video retention windows described above.
• Payment Records: Our payment processors (Stripe and Razorpay) keep transaction records under their own legal obligations. We keep our own purchase and credit records while your account exists; we may keep the records needed for tax, accounting, and payment-dispute purposes for as long as the law requires.
• Usage and Analytics Data: Usage, device, and page-journey records linked to your account are kept while your account exists and are deleted when you delete it; page-journey summaries are kept afterwards only with your account identifier removed. Data held by our analytics and advertising providers is kept under their own retention settings.
• Communication Records: Support tickets and correspondence retained for up to 3 years for quality assurance and legal compliance.
• Backup Data: Some backup data may persist for up to 90 days following deletion for disaster recovery purposes.
• Biometric Data (Facial Images and Voice Samples): Stored as the image or audio files you uploaded, for as long as you keep them in your account. When you delete a file, it is removed from your account; see Account Data above for files that remain after account deletion.
• Content Safety Logs: When our safety systems block a request, we record your account ID and email, your IP address, the feature used, the category, the matched terms, and the time. These records are kept for 24 months from creation, including after you delete your account, for safety enforcement, legal compliance, and law-enforcement cooperation. They do not store the generated content itself.
• Consent Records: Records of your acceptance of our Terms and of any signed agreement (such as the Unrestricted agreement) — including the date and time, the version accepted, your IP address, and your browser details — are kept while your account exists and for 24 months after you delete it, to evidence the agreement in any dispute.
• Preservation and Legal Holds: Notwithstanding the periods above and any deletion request, we may preserve specific records — including account records, uploaded and generated content, and generation logs — for as long as reasonably necessary where we receive legal process or a preservation demand; where preservation is required by law (including obligations attaching to CSAM reports and Canada's notice-and-notice regime); where litigation, arbitration, a regulatory investigation, or a payment dispute involving the material is pending or reasonably anticipated; or where preservation is reasonably necessary to establish, exercise, or defend legal claims (GDPR Article 17(3)(e)). Material preserved on this basis is held solely for that purpose, is not restored to your account, and is deleted when the preservation purpose ends. See Section 27.2 of our Terms of Service.

When data is no longer needed, we securely delete or anonymize it in accordance with industry best practices.

9. DATA SECURITY

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• HTTPS/TLS encryption for all data transmitted between your device and our servers
• Supabase's built-in security features including row-level security (RLS) and encrypted storage at rest
• Secure authentication via Supabase Auth with industry-standard protocols (bcrypt password hashing, JWT tokens)
• Payment data handled exclusively by Stripe (PCI DSS Level 1 certified) — we never store your full card details
• Generated content stored in Supabase Storage with per-user access controls
• Infrastructure hosted on Cloudflare Workers with DDoS mitigation
• AI processing performed on secure, isolated third-party GPU servers
• Regular security reviews and monitoring of our infrastructure
• Access controls limiting employee access to personal data on a need-to-know basis

While we take reasonable measures to protect your information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee the absolute security of your data.

Data Breach Notification

In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm to affected individuals, we will:

• Notify the Office of the Privacy Commissioner of Canada as required by PIPEDA's Breach of Security Safeguards Regulations.
• Notify affected individuals as soon as feasible, and in any event within 72 hours of becoming aware of the breach where required by GDPR, or as soon as feasible under PIPEDA.
• Provide clear information about the nature of the breach, what data was affected, what steps we are taking, and what steps you can take to protect yourself.
• Maintain records of all data breaches, including those that do not meet the notification threshold, for a minimum of 24 months.
• Notify relevant supervisory authorities in the EEA where the breach affects EU/EEA residents, in compliance with GDPR Article 33.

10. INTERNATIONAL DATA TRANSFERS

Our Services are hosted in the United States. If you access our Services from outside the United States, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those of your country of residence.

By using our Services, you expressly consent to the transfer of your data to the United States and its processing in accordance with this Privacy Policy. We take appropriate measures to ensure that your data receives an adequate level of protection, including:

• Using service providers that maintain appropriate data protection certifications (e.g., Stripe's PCI DSS certification)
• Implementing standard contractual clauses where required by applicable law
• Applying technical and organizational safeguards regardless of where data is processed

Our third-party service providers may process data in various locations. We require all service providers to maintain appropriate security measures and to process personal data only in accordance with our instructions and this Privacy Policy.

11. YOUR PRIVACY RIGHTS

Depending on your location and applicable law, you may have the following rights regarding your personal information:

• Right of Access: Request a copy of the personal data we hold about you, including your generated content.
• Right to Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Erasure (Right to Be Forgotten): Request deletion of your personal data, subject to certain exceptions (such as legal obligations to retain data).
• Right to Data Portability: Request your personal data in a structured, commonly used, and machine-readable format, or request transfer of your data to another service provider.
• Right to Restrict Processing: Request that we limit how we process your personal data under certain circumstances.
• Right to Object: Object to our processing of your personal data for direct marketing or where processing is based on legitimate interests.
• Right to Withdraw Consent: Where we process your data based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Complain: Lodge a complaint with your local data protection authority if you believe your privacy rights have been violated.

To exercise any of these rights, please contact us at support@imagera.ai with the subject line "Privacy Request." We will respond to your request within 30 days, or sooner as required by applicable law. We may need to verify your identity before processing your request.

Right to Removal of Non-Consensual Intimate Imagery (TAKE IT DOWN Act)

Under the United States TAKE IT DOWN Act (effective 2025) and Canadian Criminal Code Section 162.1, if you are depicted in non-consensual intimate imagery — including AI-generated or digitally manipulated imagery ("digital forgeries") — hosted on or generated through our Services, you have the right to request its removal. To submit a removal request:

• Contact us at support@imagera.ai with the subject line "NCII Removal Request."
• Provide sufficient information to identify the content and your identity as the depicted individual (we will handle this information with strict confidentiality).
• We will remove or disable access to the identified content within 48 hours of receiving a valid request.
• If the same content reappears on our platform, we will take reasonable steps to remove all known copies and prevent re-posting.
• We will not require you to view the imagery as a condition of processing your removal request.
• The account responsible for generating or uploading the offending content will be subject to immediate termination and may be reported to law enforcement.

Minors (or their parents/guardians) may submit removal requests for any intimate imagery, regardless of whether consent was initially given. We encourage victims to also report to the Canadian Centre for Child Protection and the NCMEC Take It Down program.

Account Deletion

You can delete your account yourself in Account settings, or request deletion of your account and associated data by contacting us at support@imagera.ai with the subject line "Account Deletion Request." Upon receiving a verified deletion request:

• Any active subscription must be cancelled before the account can be deleted (Account settings shows how).
• Your profile, credits, generation history, settings, and linked analytics records are deleted.
• Files you uploaded or generated are not all removed automatically yet: before deleting your account, delete any files you want gone from your vault, or email support@imagera.ai with the subject line "Delete my files" and we will delete the files stored under your account within 30 days of a verified request.
• Records needed for tax, accounting, and payment disputes may be kept as the law requires.
• De-identified, aggregated analytics that cannot be used to identify you may be kept.
• Content safety logs and consent records are kept as described in Section 8.
• Specific records subject to a preservation obligation or legal hold under Section 8 (Preservation and Legal Holds) — including where litigation, a regulatory investigation, or a payment dispute is pending or reasonably anticipated — are retained until the preservation purpose ends, and are then deleted.
• Backup copies may persist for up to 90 days after deletion due to our backup retention cycle, after which they will be permanently destroyed.

12. CALIFORNIA PRIVACY RIGHTS (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information:

• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell your personal information. If this ever changes, you will have the right to opt out.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
• Right to Correct: You have the right to request that we correct inaccurate personal information.
• Right to Limit Use of Sensitive Information: You have the right to limit our use of sensitive personal information to purposes necessary to provide the Services.

To exercise these rights, contact us at support@imagera.ai or submit a request through the privacy settings in your account dashboard. We will verify your identity before processing your request. You may also designate an authorized agent to make a request on your behalf.

If you have a complaint that is not satisfactorily resolved, you may contact the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite N 112, Sacramento, California 95834 or by telephone at (800) 952-5210 or (916) 445-1254.

13. EUROPEAN PRIVACY RIGHTS (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and applicable local laws provide you with additional rights regarding your personal data:

• All rights listed in Section 11 above apply.
• We process your data based on the legal bases described in Section 5 (contract performance, legitimate interests, consent, and legal obligation).
• You have the right to lodge a complaint with your local supervisory authority.
• Where we rely on consent, you may withdraw it at any time by contacting us or adjusting your account settings.
• Where we rely on legitimate interests, you may object to processing, and we will cease processing unless we have compelling legitimate grounds that override your interests, rights, and freedoms.

For data transfers outside the EEA, we rely on standard contractual clauses and other appropriate safeguards as described in Section 10.

14. CHILDREN'S PRIVACY

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe that a child under 18 has provided us with personal information, please contact us immediately at support@imagera.ai.

Parents and guardians who discover that a child under 18 has created an account with us may request deletion of the child's account and all associated data by contacting us at support@imagera.ai.

15. MARKETING AND COMMUNICATIONS

By creating an account, you agree to receive service-related communications (account confirmations, billing notifications, security alerts, and service updates). These communications are essential to the provision of our Services and cannot be opted out of while your account is active.

We may send you marketing communications including promotional offers, product updates, newsletters, and content creation tips. Under Canada's Anti-Spam Legislation (CASL) and similar laws, we send these with your express consent or, where the law allows, on the basis of implied consent arising from your relationship with us — for example, for up to 6 months after you create an account or contact us, and for up to 2 years after a purchase. Every marketing email identifies Imagera AI and includes a working unsubscribe link, and we act on unsubscribe requests within 10 business days. You may opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Adjusting your communication preferences in your account settings
• Contacting us at support@imagera.ai

Opting out of marketing communications does not affect service-related communications, including billing reminders, security notifications, or changes to our Terms of Service or Privacy Policy.

16. THIRD-PARTY LINKS

Our Services may contain links to third-party websites, applications, or services that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the privacy policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. The inclusion of any link does not imply endorsement by Imagera AI. This Privacy Policy does not apply to any third-party websites or services.

17. CHANGES TO THIS PRIVACY POLICY

We reserve the right to update or modify this Privacy Policy at any time. When we make changes, we will update the "Last updated" date at the top of this page. For material changes that significantly affect how we handle your personal information, we will provide additional notice through one or more of the following methods:

• A prominent notice on our website
• An email notification to the address associated with your account
• An in-app notification when you next use the Services

Your continued use of the Services after any changes to this Privacy Policy constitutes your acceptance of the revised policy. We encourage you to review this Privacy Policy periodically. If you do not agree to the revised Privacy Policy, you must stop using our Services and may request deletion of your account and data.