Privacy Policy

1. Information we collect

1.1 Account information

When you sign in with Google, we receive profile information such as your name, email address, and profile picture from your Google account (as permitted by your Google settings).
We store an internal user ID and account metadata in Supabase.

1.2 Content you provide

Prompts, reference images, generation settings, favorites, and generation history you create in the Service.
Support messages you send to us.

1.3 Payment information

Payments are processed by Stripe. We do not store full card numbers. Stripe provides us with transaction IDs, plan or pack details, and payment status.

1.4 Usage and technical data

Device and browser type, IP address, pages visited, and approximate location derived from IP.
Logs related to generation jobs, errors, and abuse prevention.
Cookies and similar technologies needed for sign-in and session management.

2. How we use information

Provide, maintain, and improve the gallery and generation features.
Process payments, grant credits, and prevent fraud.
Authenticate users and secure accounts.
Send service-related messages (e.g., billing or security notices).
Enforce our Terms, moderate content, and comply with law.
Analyze aggregated usage to improve product quality (not to sell personal data).

3. How we share information

3.1 Service providers

We share data with subprocessors only as needed to run Artref:

Supabase — authentication, database, and account storage.
Stripe — payment processing.
Google — OAuth sign-in.
WaveSpeed and other AI providers — prompts and reference inputs for generation (outputs returned to you).
Hosting providers (e.g., Vercel or Cloudflare) — application delivery and logs.

3.2 Legal and safety

We may disclose information if required by law, to protect users and the public, or to enforce our Terms.

3.3 No sale of personal data

We do not sell your personal information. We do not share it for cross-context behavioral advertising.

4. Data retention

Account data is kept while your account is active.
Generation history and favorites are retained until you delete them or close your account.
Billing records may be kept as required for tax and accounting.
Logs may be retained for a limited period for security and debugging.

5. Your rights and choices

Access or update account information through your profile or by contacting us.
Request deletion of your account and associated data (subject to legal retention requirements).
Opt out of non-essential communications.
Depending on your location, you may have additional rights under GDPR, CCPA, or similar laws — contact us to exercise them.

6. Security

We use industry-standard measures including encrypted connections (HTTPS), access controls, and secure payment handling via Stripe. No system is 100% secure; use a strong Google account and report suspicious activity.

7. Children

Artref is not directed at children under 13. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided data and we will delete it.

8. International users

Artref is operated from the United States. If you access the Service from other regions, your information may be processed in the U.S. and other countries where our providers operate.

9. Changes to this Policy

We may update this Policy. The effective date at the top will change when we do. Continued use after updates means you accept the revised Policy.