Privacy Policy

a) Information you provide directly

• Account information: name, email address, and password (or your Google account identifier, if you sign in with Google) when you register.
• Two-factor authentication: if you enable it, an authenticator app secret is stored to verify sign-in codes. We never see or store the codes themselves.
• Payment information: the Service currently operates on a Free tier only — we do not collect or process any payment information today. If paid plans launch, billing details will be handled by a PCI-compliant payment processor, and this policy will be updated first.
• Profile information: optional website URL, company name, or profile photo.
• Communications: messages you send us via support channels or email.

b) Information generated through your use of the Service

• Images and files you upload for processing (background removal, upscaling, etc.).
• Text prompts and generation settings you submit.
• AI-generated images produced by the Service on your behalf.
• Credits consumed, generation history, and tool usage logs.

c) Automatically collected information

• Log data: IP address, browser type, device type, pages visited, time and date of visits.
• Cookies and similar tracking technologies (see Section 5).
• Performance and error data to monitor service reliability.

We use the information we collect for the following purposes:

• To create and manage your account, authenticate you, and (if enabled) verify two-factor sign-in codes.
• To manage your credit balance and, once paid plans launch, to process payments.
• To deliver AI-generated images and run the tools you request.
• To improve the quality, performance, and reliability of our models and infrastructure.
• To send transactional emails (receipts, generation notifications, password resets).
• To send marketing communications — only with your explicit consent, and you may opt out at any time.
• To comply with legal obligations and enforce our Terms of Service.
• To detect and prevent fraud, abuse, and security incidents.
• To respond to your support requests and feedback.

Important: We do not use your uploaded images or generated outputs to train our AI models without your explicit opt-in consent. Your creative content belongs to you.

We do not sell your personal information. We may share it only in these limited circumstances:

• Service providers: trusted third parties who assist in operating our platform — Supabase (database, authentication, and file storage), Vercel (hosting and cookie-free web analytics), and, as our email capability comes online, Resend (transactional email delivery). These providers are contractually bound to protect your data.
• AI inference providers: images and prompts are transmitted to fal.ai (image generation and editing models, including Flux and Gemini image models) and, for caption generation, Hugging Face-hosted models, to produce your results. These are governed by their respective data processing agreements.
• Legal requirements: if required by law, court order, or to protect the rights, property, or safety of OpusGen AI, our users, or the public.
• Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred. We will provide notice before your information is transferred.

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data is retained while your account is open and for up to 90 days after deletion to allow recovery.
• Generated images are stored for 30 days after creation, then automatically deleted unless you explicitly save them.
• Uploaded source images used for tool processing are deleted within 24 hours of processing.
• Billing records are retained for 7 years as required by financial regulations.
• You may request immediate deletion of your account and associated data by contacting us at privacy@opusgenai.com.

We use the following types of cookies:

• Essential cookies: required for authentication, session management, and security. Cannot be disabled.
• Analytics: we use Vercel Web Analytics, which is cookie-free by design — it does not set tracking cookies or build a cross-site profile of you.

See our Cookie Policy for the full list of cookies we use. You can manage cookies through your browser settings; note that disabling essential cookies will prevent you from using core features of the Service.

Depending on your location, you may have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure ('right to be forgotten'): request deletion of your personal data, subject to legal retention requirements.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to restrict processing: request that we limit how we use your data.
• Right to object: object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: withdraw any consent you have previously given at any time.

To exercise any of these rights, email us at privacy@opusgenai.com. We will respond within 30 days (or as required by applicable law). EU/UK residents may also lodge a complaint with their local data protection authority.

OpusGen AI is based in the United States. If you access our Service from outside the U.S., your information may be transferred to, stored, and processed in the U.S. or other countries where our service providers operate.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we implement appropriate safeguards for international transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure your data receives an adequate level of protection.

We implement industry-standard technical and organisational measures to protect your information, including:

• Encryption in transit (TLS/HTTPS) for all traffic, and encryption at rest provided by our infrastructure providers (Supabase/Postgres).
• Row Level Security (database-enforced access policies) restricting which rows a user's session can read or write, in addition to application-level checks.
• Optional two-factor authentication (TOTP) you can enable on your account for an additional sign-in factor.
• Server-side admin allowlisting for any privileged action — administrative access is never granted based on client-supplied data.

Despite these measures, no security system is impenetrable. In the event of a data breach that poses a risk to your rights, we will notify you as required by applicable law.

Our Service is not directed at children under the age of 13 (or 16 in the EEA/UK). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately at privacy@opusgenai.com and we will delete such information promptly.

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new "Last Updated" date, and by sending an email notification to registered users at least 14 days before changes take effect.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: