Privacy Policy

1. INFORMATION WE COLLECT

We collect information that you provide directly to us, information we collect automatically when you use our Services, and information from third-party sources. The categories of personal information we collect include:

Personal Information You Provide

• Account Information: When you create an account, we collect your email address, name, and password (or authentication credentials if you sign in via Google OAuth).
• Payment Information: When you purchase credits or subscriptions, we collect billing details processed through Stripe, Inc. We do not directly store your full credit card number, expiration date, or CVV — this data is handled exclusively by Stripe (PCI DSS Level 1 certified).
• User Content: Text prompts, images, audio files, and other media you upload to or generate through our Services.
• Communications: Information you provide when you contact our support team, submit feedback, or participate in surveys.
• Profile Information: Any additional information you choose to add to your account profile.

Biometric and Facial Data

Certain features of our Services process data that may be classified as biometric data under applicable laws, including the Illinois Biometric Information Privacy Act (BIPA), Quebec's Law 25, and the EU General Data Protection Regulation (GDPR). This includes:

• Facial Geometry Data: When you use face swap, face enhancement, head swap, skin detailing, or avatar generation features, facial images you upload are processed to extract facial geometry and features necessary for AI generation. This data is used solely for the purpose of producing the requested AI-generated output.
• Voice Biometric Data: When you use voice cloning or voice generation features, audio samples you upload are processed to create voice models. These voiceprints are used solely for generating AI voice outputs associated with your account.
• Purpose Limitation: Biometric data is processed exclusively to provide the AI generation features you request. It is not used for identification, surveillance, authentication, or any purpose other than content generation.
• No Sale or Sharing: We do not sell, lease, trade, or otherwise share your biometric data with any third party, except as strictly necessary for the AI processing infrastructure described in Section 6 (specifically, a third-party GPU cloud infrastructure provider for inference processing).
• Retention: Uploaded facial images and voice samples are retained in your account for as long as you maintain the content. You may delete biometric data at any time through your account dashboard. Upon account deletion, all biometric data is permanently deleted within 30 days.
• Consent: By uploading facial images or voice samples to our Services, you provide your informed, written consent to the collection, processing, and storage of this biometric data for the purposes described above. You may withdraw consent at any time by deleting the uploaded content or your account.

BIPA Notice (Illinois Residents)

If you are a resident of Illinois, the Illinois Biometric Information Privacy Act (740 ILCS 14, "BIPA") requires us to provide you with the following specific disclosures before collecting your biometric data:

• What We Collect: When you use face swap, face enhancement, head swap, skin detailing, avatar generation, or voice cloning features, we collect biometric identifiers including facial geometry data (from uploaded images) and voiceprints (from uploaded audio). These constitute "biometric identifiers" and "biometric information" as defined by BIPA.
• Purpose of Collection: Biometric data is collected solely for the purpose of providing the AI content generation features you request. It is not used for identification, verification, surveillance, or any purpose other than generating the specific AI output you requested.
• Storage and Retention: Biometric data is stored on encrypted servers (Supabase) for as long as you maintain the content in your account. Upon content deletion or account deletion, biometric data is permanently destroyed within 30 days. Imagera AI will permanently destroy biometric data when: (a) the initial purpose for collecting the data has been satisfied; or (b) within 3 years of the individual's last interaction with the Services, whichever occurs first.
• No Sale or Disclosure: We do not sell, lease, trade, or otherwise profit from your biometric data. We do not disclose biometric data to any third party except as strictly necessary for the AI processing infrastructure (a third-party GPU cloud infrastructure provider for inference), and only under contractual obligations that prohibit that provider from retaining or using the data for any other purpose.
• Written Release: By uploading facial images or voice samples and using the biometric-dependent features of our Services, you execute a written release authorizing Imagera AI to collect, capture, store, and use your biometric identifiers and biometric information as described in this notice. This constitutes a "written release" as required by 740 ILCS 14/15(b).
• Your BIPA Rights: You have the right to: (a) access information about biometric data collected from you; (b) request deletion of your biometric data at any time; (c) revoke your consent to biometric data collection (by deleting content or your account). To exercise your BIPA rights, contact us at support@imagera.ai with the subject line "BIPA Request."

Universal Data Processing Across All Features

The following applies to all features of our Services — including all current and future AI generation, editing, enhancement, cloning, training, and processing tools. When you use any feature of our Services:

• Inputs You Provide: Any media you upload (images, videos, audio, text prompts, reference files) is processed by our AI infrastructure to generate the requested output. We collect and temporarily process this data solely for the purpose of providing the feature you requested.
• Biometric Data: Features that process faces, voices, or body movements may extract biometric identifiers (facial geometry, voiceprints, body pose data). This data is classified as sensitive personal information under PIPEDA, GDPR, BIPA, and other applicable laws. It is processed exclusively for content generation and is never used for identification, surveillance, or profiling.
• AI Model Training (LoRA): If you use our LoRA training feature to create custom AI models based on your images (e.g., your face, a product, or a style), the training data you provide is used solely to build a model associated with your account. Trained models are private to your account and are not shared with other users or used by Imagera AI for any other purpose. You may delete your trained models at any time.
• Generated Outputs: All AI-generated content is stored in your private vault. We do not access, review, share, or use your generated content except: (a) as required by law or valid legal process; (b) to enforce our Terms of Service and content safety policies; or (c) to provide technical support at your request.
• No Cross-Feature Data Sharing: Data you provide to one feature is not used by other features unless you explicitly initiate such use (e.g., using a generated image as input to another tool).
• No Third-Party Model Training: None of your inputs, outputs, or data from any feature is used to train, fine-tune, or improve any AI models — whether our own or third-party models — without your explicit opt-in consent.

Information Collected Automatically

• Usage Data: Generation history, credit consumption, feature usage patterns, and interaction logs.
• Device and Browser Information: Browser type and version, operating system, device type, screen resolution, and unique device identifiers.
• Network Information: IP address, internet service provider, and approximate geographic location derived from your IP address.
• Log Data: Access times, pages viewed, referring URL, and actions taken within the Services.
• Cookie Data: Information collected through cookies, pixels, and similar tracking technologies (see Section 7).

Information from Third Parties

• Google OAuth: If you sign in with Google, we receive your name, email address, and profile picture from Google.
• Stripe: Payment confirmation, subscription status, and transaction identifiers.
• Analytics Providers: Aggregated and anonymized usage data from Google Tag Manager and Microsoft Clarity.

2. HOW WE COLLECT INFORMATION

We collect information through the following methods:

• Direct Collection: When you register for an account, make a purchase, submit content for AI processing, or contact us.
• Automated Collection: Through cookies, web beacons, log files, and similar technologies when you interact with our Services.
• Third-Party Collection: From authentication providers (Google), payment processors (Stripe), and analytics services (Google Analytics, Microsoft Clarity).
• AI Processing: When you use our AI generation tools, we process your input prompts and uploaded media to generate the requested output.

3. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

Service Delivery

• To create, maintain, and secure your account
• To process AI generation requests (images, videos, voices, music, avatars, and related content)
• To manage your credits, subscriptions, and billing
• To store your generated content in your personal vault
• To provide customer support and respond to your inquiries

Service Improvement

• To analyze usage patterns and optimize platform performance
• To improve AI generation quality, speed, and reliability
• To develop new features and tools
• To conduct research and analytics on platform usage

Communication

• To send service-related communications (account updates, generation status, billing notifications)
• To send marketing communications (with your consent, where required)
• To notify you of changes to our Terms of Service or Privacy Policy

Security and Legal

• To detect, prevent, and address fraud, abuse, and security issues
• To enforce our Terms of Service and other policies
• To comply with applicable laws, regulations, and legal processes
• To protect the rights, property, and safety of Imagera AI, our users, and the public

4. AI-GENERATED CONTENT AND DATA

Given the nature of our AI-powered Services, this section addresses how we handle data related to AI content generation specifically:

• Input Processing: When you submit prompts or upload media for AI processing, your inputs are sent to our AI infrastructure (hosted on secure third-party GPU cloud servers) for generation. Inputs are processed in real-time and are not used to train or improve our AI models unless you explicitly opt in to such a program.
• Generated Outputs: AI-generated content (images, videos, audio, etc.) is stored in your personal vault on our secure Supabase infrastructure. This content is accessible only to you unless you choose to share it.
• Prompt Data: We may retain your generation prompts in association with your account for the purpose of providing generation history and allowing you to re-run or reference previous generations.
• No Model Training: We do not and will not use your personal content, prompts, uploaded media (including facial images and voice samples), or generated outputs to train, fine-tune, evaluate, or improve any AI or machine learning models — whether our own or those of any third party — without your explicit, informed, and separately obtained opt-in consent. Our third-party AI processing providers are contractually prohibited from using your data to train their models. If this policy ever changes, we will obtain fresh, explicit consent from affected users before any such use.
• Uploaded Media: Images, videos, and audio files you upload for processing (e.g., for image upscaling, video enhancement, voice cloning) are processed and stored securely. You may delete this content at any time through your account dashboard.
• Voice Data: If you use our voice cloning or voice generation features, the audio samples you provide are processed to create voice models associated with your account. You are responsible for ensuring you have the right to use any voice samples you upload.

5. LEGAL BASES FOR PROCESSING

We process your personal information based on the following legal grounds:

• Contract Performance: Processing necessary to perform our contract with you (e.g., providing the Services, managing your account, processing payments).
• Legitimate Interests: Processing necessary for our legitimate business interests (e.g., improving our Services, fraud prevention, security), provided these interests do not override your rights and freedoms.
• Consent: Processing based on your explicit consent (e.g., marketing communications, optional analytics). You may withdraw your consent at any time.
• Legal Obligations: Processing necessary to comply with applicable laws, regulations, and legal processes (e.g., tax requirements, law enforcement requests).

6. DATA SHARING AND THIRD-PARTY SERVICES

We never sell your personal information or generated content to third parties.

We share your information only with the following categories of service providers, and only to the extent necessary to operate and improve our Services:

• Supabase: Database hosting, authentication, and secure storage of your account data and generated content. Supabase provides row-level security and encrypted storage.
• Stripe, Inc.: Payment processing and subscription management. Stripe processes your payment information directly and is PCI DSS Level 1 certified. Stripe never has access to your generated content.
• GPU Cloud Infrastructure: AI model inference infrastructure. Our third-party GPU cloud provider processes your generation inputs (prompts and uploaded media) to produce AI-generated outputs. Processing occurs on secure GPU servers under contractual data-protection obligations.
• Cloudflare: Application hosting, content delivery network (CDN), DDoS protection, and security services.
• Google (OAuth): Authentication for users who choose to sign in with Google. Google only provides us with your basic profile information.
• Google Tag Manager & Microsoft Clarity: Anonymous analytics to understand how users interact with our Services and to improve the user experience. These services collect anonymized and aggregated data only.
• ElevenLabs: Voice synthesis and speech recognition for AI Companion voice call features. Processes voice audio in real time for text-to-speech and speech-to-text conversion. Audio is not permanently stored by ElevenLabs after processing.

We may also disclose your information if required to do so by law, or if we believe in good faith that such disclosure is necessary to: (a) comply with legal process or governmental requests; (b) enforce our Terms of Service; (c) protect the rights, property, or safety of Imagera AI, our users, or the public; or (d) detect, prevent, or address fraud, security, or technical issues.

In the event of a merger, acquisition, bankruptcy, or other corporate transaction, your personal information may be transferred to the acquiring or successor entity. We will notify you of any such change in ownership or control.

Sub-Processor Obligations

All third-party service providers listed above ("sub-processors") are contractually required to:

• Process personal data only in accordance with our documented instructions and this Privacy Policy.
• Implement appropriate technical and organizational security measures to protect your data.
• Not use your personal data, biometric data, or generated content for their own purposes, including model training.
• Promptly notify us of any data breach or security incident involving your data.
• Delete or return all personal data upon termination of the service relationship, unless retention is required by law.

We maintain a current list of sub-processors and will notify users of any material changes to this list. If you object to a new sub-processor, you may terminate your account and request deletion of your data.

7. COOKIES AND TRACKING TECHNOLOGIES

We use the following types of cookies and tracking technologies:

Essential Cookies

Required for the basic functionality of our Services, including authentication, session management, and security. These cookies cannot be disabled without impairing core functionality.

Analytics Cookies

Used to understand how users interact with our Services, measure performance, and identify areas for improvement. We use Google Analytics and Microsoft Clarity for this purpose. Analytics data is collected in anonymized and aggregated form.

Functional Cookies

Used to remember your preferences (such as language, theme, and display settings) and provide enhanced functionality.

Managing Cookies

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse cookies or alert you when cookies are being sent. Please note that disabling essential cookies may affect the functionality of our Services. We do not use third-party advertising cookies or tracking pixels for advertising purposes.

8. DATA RETENTION

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Specific retention periods include:

• Account Data: Retained for as long as your account is active. Upon account deletion, your data will be removed within 30 days, except as required by law.
• Generated Content: AI-generated images, videos, voices, music, and avatars remain in your vault until you delete them or until account deletion. You can delete individual items at any time.
• Payment Records: Retained for 7 years to comply with financial and tax regulations.
• Usage and Analytics Data: Retained in anonymized form for up to 24 months for service improvement purposes.
• Communication Records: Support tickets and correspondence retained for up to 3 years for quality assurance and legal compliance.
• Backup Data: Some backup data may persist for up to 90 days following deletion for disaster recovery purposes.
• Biometric Data (Facial Images and Voice Samples): Retained for as long as you maintain the content in your account. Deleted within 30 days of content deletion or account deletion. Biometric data is not retained in any form after deletion, except where required by law or to comply with a valid legal hold.
• Content Safety Logs: Records of content generation requests flagged by our safety systems may be retained for up to 24 months for compliance and law enforcement cooperation purposes. These logs contain metadata (timestamps, prompt summaries, violation categories) but do not store the generated content itself.

When data is no longer needed, we securely delete or anonymize it in accordance with industry best practices.

9. DATA SECURITY

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• HTTPS/TLS encryption for all data transmitted between your device and our servers
• Supabase's built-in security features including row-level security (RLS) and encrypted storage at rest
• Secure authentication via Supabase Auth with industry-standard protocols (bcrypt password hashing, JWT tokens)
• Payment data handled exclusively by Stripe (PCI DSS Level 1 certified) — we never store your full card details
• Generated content stored in Supabase Storage with per-user access controls
• Infrastructure hosted on Cloudflare Workers with DDoS mitigation
• AI processing performed on secure, isolated third-party GPU servers
• Regular security reviews and monitoring of our infrastructure
• Access controls limiting employee access to personal data on a need-to-know basis

While we take reasonable measures to protect your information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee the absolute security of your data.

Data Breach Notification

In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm to affected individuals, we will:

• Notify the Office of the Privacy Commissioner of Canada as required by PIPEDA's Breach of Security Safeguards Regulations.
• Notify affected individuals as soon as feasible, and in any event within 72 hours of becoming aware of the breach where required by GDPR, or as soon as feasible under PIPEDA.
• Provide clear information about the nature of the breach, what data was affected, what steps we are taking, and what steps you can take to protect yourself.
• Maintain records of all data breaches, including those that do not meet the notification threshold, for a minimum of 24 months.
• Notify relevant supervisory authorities in the EEA where the breach affects EU/EEA residents, in compliance with GDPR Article 33.

10. INTERNATIONAL DATA TRANSFERS

Our Services are hosted in the United States. If you access our Services from outside the United States, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those of your country of residence.

By using our Services, you expressly consent to the transfer of your data to the United States and its processing in accordance with this Privacy Policy. We take appropriate measures to ensure that your data receives an adequate level of protection, including:

• Using service providers that maintain appropriate data protection certifications (e.g., Stripe's PCI DSS certification)
• Implementing standard contractual clauses where required by applicable law
• Applying technical and organizational safeguards regardless of where data is processed

Our third-party service providers may process data in various locations. We require all service providers to maintain appropriate security measures and to process personal data only in accordance with our instructions and this Privacy Policy.

11. YOUR PRIVACY RIGHTS

Depending on your location and applicable law, you may have the following rights regarding your personal information:

• Right of Access: Request a copy of the personal data we hold about you, including your generated content.
• Right to Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Erasure (Right to Be Forgotten): Request deletion of your personal data, subject to certain exceptions (such as legal obligations to retain data).
• Right to Data Portability: Request your personal data in a structured, commonly used, and machine-readable format, or request transfer of your data to another service provider.
• Right to Restrict Processing: Request that we limit how we process your personal data under certain circumstances.
• Right to Object: Object to our processing of your personal data for direct marketing or where processing is based on legitimate interests.
• Right to Withdraw Consent: Where we process your data based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Complain: Lodge a complaint with your local data protection authority if you believe your privacy rights have been violated.

To exercise any of these rights, please contact us at support@imagera.ai with the subject line "Privacy Request." We will respond to your request within 30 days, or sooner as required by applicable law. We may need to verify your identity before processing your request.

Right to Removal of Non-Consensual Intimate Imagery (TAKE IT DOWN Act)

Under the United States TAKE IT DOWN Act (effective 2025) and Canadian Criminal Code Section 162.1, if you are depicted in non-consensual intimate imagery — including AI-generated or digitally manipulated imagery ("digital forgeries") — hosted on or generated through our Services, you have the right to request its removal. To submit a removal request:

• Contact us at support@imagera.ai with the subject line "NCII Removal Request."
• Provide sufficient information to identify the content and your identity as the depicted individual (we will handle this information with strict confidentiality).
• We will remove or disable access to the identified content within 48 hours of receiving a valid request.
• If the same content reappears on our platform, we will take reasonable steps to remove all known copies and prevent re-posting.
• We will not require you to view the imagery as a condition of processing your removal request.
• The account responsible for generating or uploading the offending content will be subject to immediate termination and may be reported to law enforcement.

Minors (or their parents/guardians) may submit removal requests for any intimate imagery, regardless of whether consent was initially given. We encourage victims to also report to the Canadian Centre for Child Protection and the NCMEC Take It Down program.

Account Deletion

You may request complete deletion of your account and all associated data by contacting us at support@imagera.ai with the subject line "Account Deletion Request." Upon receiving a verified deletion request:

• Your account will be deactivated immediately and all active subscriptions will be cancelled.
• All personal information, generated content, uploaded media (including biometric data), and generation history will be permanently deleted within 30 days.
• Payment records will be retained for 7 years as required by tax and financial regulations, but will be dissociated from your identity where technically feasible.
• Anonymized, aggregated analytics data that cannot be used to identify you may be retained.
• Content safety logs related to flagged violations may be retained for law enforcement cooperation as described in our Terms of Service.
• Backup copies may persist for up to 90 days after deletion due to our backup retention cycle, after which they will be permanently destroyed.

12. CALIFORNIA PRIVACY RIGHTS (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information:

• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell your personal information. If this ever changes, you will have the right to opt out.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
• Right to Correct: You have the right to request that we correct inaccurate personal information.
• Right to Limit Use of Sensitive Information: You have the right to limit our use of sensitive personal information to purposes necessary to provide the Services.

To exercise these rights, contact us at support@imagera.ai or submit a request through the privacy settings in your account dashboard. We will verify your identity before processing your request. You may also designate an authorized agent to make a request on your behalf.

If you have a complaint that is not satisfactorily resolved, you may contact the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite N 112, Sacramento, California 95834 or by telephone at (800) 952-5210 or (916) 445-1254.

13. EUROPEAN PRIVACY RIGHTS (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and applicable local laws provide you with additional rights regarding your personal data:

• All rights listed in Section 11 above apply.
• We process your data based on the legal bases described in Section 5 (contract performance, legitimate interests, consent, and legal obligation).
• You have the right to lodge a complaint with your local supervisory authority.
• Where we rely on consent, you may withdraw it at any time by contacting us or adjusting your account settings.
• Where we rely on legitimate interests, you may object to processing, and we will cease processing unless we have compelling legitimate grounds that override your interests, rights, and freedoms.

For data transfers outside the EEA, we rely on standard contractual clauses and other appropriate safeguards as described in Section 10.

14. CHILDREN'S PRIVACY

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe that a child under 18 has provided us with personal information, please contact us immediately at support@imagera.ai.

Parents and guardians who discover that a child under 18 has created an account with us may request deletion of the child's account and all associated data by contacting us at support@imagera.ai.

15. MARKETING AND COMMUNICATIONS

By creating an account, you agree to receive service-related communications (account confirmations, billing notifications, security alerts, and service updates). These communications are essential to the provision of our Services and cannot be opted out of while your account is active.

With your consent (where required by law), we may send you marketing communications including promotional offers, product updates, newsletters, and content creation tips. You may opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Adjusting your communication preferences in your account settings
• Contacting us at support@imagera.ai

Opting out of marketing communications does not affect service-related communications, including billing reminders, security notifications, or changes to our Terms of Service or Privacy Policy.

16. THIRD-PARTY LINKS

Our Services may contain links to third-party websites, applications, or services that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the privacy policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. The inclusion of any link does not imply endorsement by Imagera AI. This Privacy Policy does not apply to any third-party websites or services.

17. CHANGES TO THIS PRIVACY POLICY

We reserve the right to update or modify this Privacy Policy at any time. When we make changes, we will update the "Last updated" date at the top of this page. For material changes that significantly affect how we handle your personal information, we will provide additional notice through one or more of the following methods:

• A prominent notice on our website
• An email notification to the address associated with your account
• An in-app notification when you next use the Services

Your continued use of the Services after any changes to this Privacy Policy constitutes your acceptance of the revised policy. We encourage you to review this Privacy Policy periodically. If you do not agree to the revised Privacy Policy, you must stop using our Services and may request deletion of your account and data.