Privacy Policy

Last updated

This Privacy Policy explains how 30ohm L.P. ("we", "us", "our") collects, uses, stores, and protects your personal data when you use Depicta (depicta.ai). We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR), Greek data protection law (Law 4624/2019), and other applicable privacy legislation.

1. Who We Are

30ohm L.P. is the data controller responsible for your personal data.

2. What Data We Collect

2.1 Data You Provide

Data When Collected
Email address Account registration
Name (if provided) Account registration or OAuth sign-in
Password (hashed, never stored in plaintext) Email/password registration
OAuth tokens Google or GitHub sign-in
Prompts (text descriptions for image generation) Each generation request
Uploaded images (for editing or processing) When you upload images
Images you provide by link (URL) When a request refers to an image by its web address; we download a copy to check it
Newsletter email (and name, if provided) Newsletter signup form on website, or dashboard settings for registered users
Waitlist email When you join the waitlist while registration is limited
Withdrawal statements (your name, if you give it, the purchase you withdraw from, and the date and time) When you withdraw from a purchase
Connected apps (which AI app, such as Claude; when you approved the connection and when the app last used it; the monthly spending limit you set; what the app spent each month; and whether the connection was paused or ended. We store the connection's sign-in tokens only in a form that cannot be turned back into the token) When you connect an app to your account

2.2 Data We Collect Automatically

Data Purpose
IP address Security, fraud prevention, rate limiting
User agent and device information Security, debugging
API call metadata (endpoint, timestamp, response status) Audit logging, service monitoring
Generation metadata (operation type, model used, cost, API key used) Billing, usage dashboards, service improvement
Classifier decisions (allow/deny, category, and a SHA-256 fingerprint of each checked image) Content safety auditing
Session data Authentication, maintaining your login
Image hashes (SHA-256 fingerprint of each image we generate or process, with its watermark ID and a perceptual fingerprint) Provenance verification, the image check (Section 2.5), dispute resolution
Upload fingerprints (SHA-256 fingerprint of each image you upload, with the IP address and user agent of the upload) Recognising repeated uploads of prohibited images, and investigating abuse

2.3 Data We Receive From Third Parties

Source Data Purpose
Stripe Managed Payments (Merchant of Record; separate controller — Stripe Payments Europe, Limited (Ireland) for EU customers, or Stripe, Inc. / Stripe Payments Company (United States) for US customers) Transaction confirmations, transaction amounts, VAT collected, billing country, refunds and chargebacks Recording completed purchases against your account; billing and tax records
Google / GitHub (OAuth providers) Email, name, profile identifier Account authentication

What you must provide. An email address and login details are required to create and use an account. A prompt, and any images the chosen operation needs, are required for each request. Without them we cannot provide the account or the operation. Your name, newsletter subscription and prompt-analysis participation are optional.

Data about other people. Prompts, uploaded images and linked images may contain personal data about other people, such as their names or likenesses. We use it only to carry out the request (legitimate interest, Section 3). We usually cannot identify or contact these people, so we rely on GDPR Article 14(5)(b) and make this information public in this policy.

2.4 Data We Do Not Collect

  • We do not permanently store your images. Generated and processed images are delivered through temporary links that expire after 1 hour, and we delete them shortly afterwards. Images you upload are deleted within 24 hours. Section 6 gives the exact periods. We keep a cryptographic hash (a non-reversible fingerprint) of each generated and uploaded image, and for images we generate or process, a watermark ID and a perceptual fingerprint; see Sections 3 and 6. None of these can be used to reconstruct the image. The AI model provider that processes your request may keep your inputs, or the generated image, for a limited period under its own policy. Section 4.1.1 describes each provider's retention.
  • We do not ask for, and do not want, information about health, religion, political opinions, ethnic origin, sex life or sexual orientation, and we do not use prompts or images to infer it. We do not process photos to identify people. Our Acceptable Use Policy prohibits including such data about anyone in prompts or uploads. If a prompt or image nevertheless contains it, it is handled like any other input: checked, used to carry out your request, and kept only inside the encrypted prompt record for the period in Section 6. If you tell us that a prompt contained such data, we will delete it, unless we must keep it to investigate a breach of our rules or to establish, exercise or defend legal claims (GDPR Art. 17(3)(e)). The model provider may keep it as described in Section 4.1.1, and we cannot delete the provider's copy. Do not upload images of other people unless you are entitled to.

2.5 The Image Check

Anyone can check an image for Depicta's marks at depicta.ai/verify, or through our API.

  • The image goes to our server in France, is checked in memory, and is deleted as soon as the answer is sent. We don't store the image or its fingerprint, and we don't send it to anyone else.
  • A check from the page is not linked to your account, even if you are signed in to your dashboard. A check through the API uses your API key and counts towards its limits.
  • Before a check from the page, Cloudflare Turnstile confirms that you are a person (Section 4.1). It loads only after you choose a file or start entering a link. Cloudflare sees your IP address and browser details, never the image or the link.
  • Our web server logs record your IP address, the time and the address requested, never the image, and we keep them for 2 years for security. To prevent abuse, we also limit how many checks each IP address, or each account using our API, can make, counting them in memory only for up to a day.
  • We do this on the basis of our legitimate interest in offering a free, open check of our AI marks and protecting it from abuse (Art. 6(1)(f)). You can object at any time (Section 7).

3. How and Why We Use Your Data

Purpose Data Used Legal Basis (GDPR Art. 6)
Provide the service — process your requests, generate images, deliver results Account data, prompts, uploaded images, generation metadata Contractual necessity (Art. 6(1)(b))
Account management — registration, authentication, session management Email, name, password hash, OAuth tokens Contractual necessity (Art. 6(1)(b))
Billing and payments — credit purchases, usage tracking, invoicing Transaction data, billing country, credit balance Contractual necessity (Art. 6(1)(b))
Content moderation — screen prompts and input images for prohibited content, check generated images before we store or deliver them, and suspend accounts or pause image generation automatically in the cases described in Section 10.1 Prompts, input images, generated images (a reduced copy, checked in memory), classifier decisions, counts of refused requests and withheld images Contractual necessity (Art. 6(1)(b)) — enforcing our Acceptable Use Policy; Legitimate interest (Art. 6(1)(f)) — preventing the generation of illegal content and protecting the people it could harm
Human content review — checking our classifier's decisions on selected requests: requests it refused, requests it allowed with low confidence, some requests from new accounts, and requests from accounts our systems flag for unusual patterns Prompts, generated images, uploaded images and classifier decisions, shown to the reviewer without your account details Legitimate interest (Art. 6(1)(f)) — ensuring content moderation quality and platform safety
Prompt retention (12 months) — investigating abuse, answering lawful requests from authorities, and legal claims Encrypted prompts, generation metadata, classifier decisions Legitimate interest (Art. 6(1)(f)) — investigating abuse of Depicta, and establishing, exercising or defending legal claims. Where an authority lawfully orders us to keep or disclose specific data, that order is the legal obligation (Art. 6(1)(c)) for that data. You may object (Section 7).
Apps you connect — providing the service through an AI app you connect to your account, such as Claude Connection records (Section 2.1), and the requests the app sends for you Contractual necessity (Art. 6(1)(b))
Securing connected apps — detecting copied sign-in tokens, applying the spending limit you set, pausing a connection after refused requests, and emailing you about new, paused or disconnected connections Connection records, fingerprints of sign-in tokens, the app's refused requests Legitimate interest (Art. 6(1)(f)) — protecting your account and your credits
Security and fraud prevention — detecting abuse, unauthorized access, and anomalous usage IP address, usage patterns, API call metadata, audit logs Legitimate interest (Art. 6(1)(f)) — protecting our service and users
Automated bot protection — verifying that submissions to specific forms (signup, waitlist, newsletter subscription, password reset) and the image check come from human visitors, not automated scripts IP address, browser and device characteristics, interaction signals (such as mouse movement and timing), processed via Cloudflare Turnstile Legitimate interest (Art. 6(1)(f)) — preventing automated abuse, spam, credential-stuffing attacks, and trial-credit farming
Tax and legal compliance — maintaining billing records for Greek tax law Billing records, invoicing data Legal obligation (Art. 6(1)(c)) — Greek accounting and tax law (Law 4308/2014 Art. 7; Law 5104/2024 Arts. 13 and 37)
Prompt analysis program (opt-in only) — analysis of prompts to improve service quality Prompts of opted-in users, analysed without account details; only aggregated results are kept Consent (Art. 6(1)(a)) — separate, explicit consent via dashboard
Service improvement — understanding usage patterns, improving reliability Aggregated, anonymized usage statistics Legitimate interest (Art. 6(1)(f)) — improving the service
Image provenance — maintaining a registry of image fingerprints and watermark IDs for verification, the image check and dispute resolution SHA-256 image hash, watermark ID and perceptual fingerprint, timestamp (only the date once the link to your account is removed), user ID (first 12 months) Legitimate interest (Art. 6(1)(f)) — provenance verification, dispute resolution, fraud prevention. Supports EU AI Act Art. 50 compliance.
The image check — checking an image for our AI marks, at depicta.ai/verify or through our API (Section 2.5) The image, in memory only; IP address in web server logs; for the page, the Cloudflare Turnstile signals Legitimate interest (Art. 6(1)(f)) — offering a free, open check of our AI marks and protecting it from abuse
Upload fingerprints — recognising repeated uploads of prohibited images, and investigating abuse SHA-256 hash of each uploaded image, timestamp, user ID, IP address and user agent Legitimate interest (Art. 6(1)(f)) — preventing abuse of the service
People shown or named in your inputs — processing the personal data of other people that appears in your prompts or uploaded images, to carry out your request Prompts, uploaded images Legitimate interest (Art. 6(1)(f)) — providing the service you asked for. You must have the right to use such content (Acceptable Use Policy).
Website analytics — producing aggregate statistics about how visitors use the website Page address and title, referrer, browser, operating system and device type, browser language, country, and clicks on our own pages; the visitor's IP address and browser details are used to work out the country and to count unique visitors with a one-way code that changes regularly, and Umami does not store the IP address; no cookies Legitimate interest (Art. 6(1)(f)) — improving the website. Self-hosted Umami, no third-party data sharing.
Transactional communications — email verification, password reset, account notifications Email address Contractual necessity (Art. 6(1)(b))
Waitlist — inviting you to register when a place is free. Joining the waitlist does not subscribe you to the newsletter; the only email you get is the invitation Email address, status and dates Steps taken at your request before entering into a contract (Art. 6(1)(b))
Newsletter (opt-in) — product updates, new features, tips, and announcements Email address, name (if provided) Consent (Art. 6(1)(a)) — explicit opt-in via signup form or dashboard toggle. Also compliant with ePrivacy Directive Art. 13(1) / Greek Law 3471/2006 Art. 11.

Legitimate interest assessments: Where we rely on legitimate interest, we have weighed our interests against your rights and freedoms. You can ask us for the details at privacy@depicta.ai. You may object to processing based on legitimate interest at any time (see Section 7).

4. Who We Share Your Data With

We share your personal data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

4.1 Recipients of Personal Data

We share the minimum personal data necessary with the following recipients. Our processors act only on our instructions under a data processing agreement. Stripe Managed Payments is a separate controller (a Merchant of Record), which means it independently determines the purposes and means of processing for the payment data it holds and has its own direct obligations to you under its own privacy notice. Stripe Managed Payments routes self-service transactions through one of two regional MoR entities depending on your billing country: Stripe Payments Europe, Limited (Ireland; registered no. 513174; VAT IE3206488LH) for customers in the EU/EEA, and Stripe, Inc. or Stripe Payments Company (United States) for customers based in the United States.

For direct-purchase customers (Terms of Service, Section 5.3, "Direct purchase"), Stripe Managed Payments is not involved and the data flows differ; any specific arrangements are recorded in the separate purchase agreement.

Recipient Role under GDPR Location Purpose Safeguards
OpenRouter, Inc. Processor (see below for its own purposes) United States AI model routing. OpenRouter receives your prompt, any images you submit with a request, and the generated image. It forwards each generation request to the provider of the AI model you selected (Section 4.1.1), and each content check to our classifier's model provider (below). Section 4.1.2 explains how we restrict which providers OpenRouter may use. Standard Contractual Clauses (SCCs, Module 2), incorporated in OpenRouter's Data Processing Agreement; see Section 5
AI model providers (listed in Section 4.1.1) Sub-processors, engaged by OpenRouter See Section 4.1.1 Generate or edit the image you requested, using the model you selected See Section 4.1.1 and Section 5
Cloudflare, Inc. Processor United States Bot protection via Cloudflare Turnstile — verifies that specific forms (signup, waitlist, newsletter subscription, password reset) and the image check are submitted by humans rather than automated scripts. Processes IP address, browser and device characteristics, and interaction signals to issue a short-lived human-verification token. Cloudflare does not retain personal data beyond what is necessary to issue and validate the token. EU-US Data Privacy Framework (Commission Decision 2023/1795); Standard Contractual Clauses (SCCs) as fallback, via Cloudflare's Data Processing Addendum
Stripe Managed Payments Separate controller (Merchant of Record) Ireland (Stripe Payments Europe, Limited — registered no. 513174, VAT IE3206488LH) for EU customers; United States (Stripe, Inc. or Stripe Payments Company) for US customers For self-service purchases, Stripe Managed Payments is the seller of record: it collects payment from you, calculates and remits VAT, issues the receipt, and handles chargebacks. The MoR entity is determined by your billing country. Stripe independently determines its own purposes for the payment data it holds (including fraud prevention, tax remittance, and regulatory reporting) and applies its own privacy notice. We share with Stripe only the minimum data needed to attribute the transaction to your Depicta account (such as account email and transaction reference). EU customers (Stripe Payments Europe, Limited / Ireland): intra-EEA controller relationship, no separate transfer instrument required. US customers (Stripe, Inc. or Stripe Payments Company): Standard Contractual Clauses (SCCs) under Commission Implementing Decision (EU) 2021/914, supplemented by Stripe's Data Processing Addendum at https://stripe.com/legal/dpa. Stripe's own GDPR notice and DPA govern its processing in both cases.
Scaleway S.A.S. Processor France (EU) Cloud infrastructure, data hosting, object storage, transactional email delivery Data stays within the EU; Data Processing Agreement
Google (Google Workspace) Processor European Union and United States Hosting of our email mailboxes (for example hello@depicta.ai and privacy@depicta.ai), so it holds the emails you send us, our replies, and our internal alert emails, which refer to your account only by an internal reference (for example when a refund needs attention) Google's Cloud Data Processing Addendum; for transfers to Google LLC in the United States, the EU–US Data Privacy Framework (Google LLC is certified) and Standard Contractual Clauses

OpenRouter's own purposes. OpenRouter acts on our instructions when it routes your request. It decides for itself when it categorises a sample of prompts for its own usage statistics (it keeps only anonymous categories), and how it meets its own legal reporting duties, such as reporting apparent child sexual abuse material to the US National Center for Missing & Exploited Children. For those purposes it is a controller under its own privacy policy.

Content classifier. Before we generate an image, and before we process an image you provide (for example resizing, background removal or vectorising), our content classifier checks your prompt and every input image for content that breaks our Acceptable Use Policy and for attempts to manipulate our systems. After an image is generated, and before we store or deliver it, the classifier also checks the generated image. Only a reduced copy of the image is sent for this check, never your prompt. If the image may be content we never deliver, such as sexual content involving children or identifiable real people, we withhold it: it is never delivered, and you are not charged for it. We may keep a copy for up to 7 days for human review (Section 6). The classifier sends what it checks through OpenRouter to Google's Gemini 3.5 Flash model on Google Vertex AI. These requests are pinned to Google Vertex AI endpoints that OpenRouter lists as zero data retention, with no fallback to any other provider.

4.1.1 AI Model Providers

You choose one AI model for each generation request, by its name or alias. An AI assistant or application acting for you can also make that choice. The request is sent through OpenRouter to the provider that operates the selected model, and that provider returns the generated image. A request contains:

  • your prompt;
  • any images you upload for editing, for combining, or as references;
  • in story mode, the text and images of earlier scenes in the same story.

Apart from the content check described in Section 4.1, which goes to Google, only the provider of the model you selected receives the request. We do not add your name, email address, account identifier or API key to these requests, but your prompt or images may themselves contain identifying information.

For generating your image, the provider acts on OpenRouter's instructions, under OpenRouter's agreement with it. If the provider's own safety systems flag your content, the provider may keep and review it, and report it to authorities, including in the United States, under its own policies; for that, it decides for itself how your data is used. We cannot access, correct or delete those copies, but we will pass your erasure requests on through OpenRouter.

The retention periods below are the ones the providers or OpenRouter publish. We cannot verify them independently. Where published sources disagree, the table says so.

Provider Models (aliases) Where your data is processed Retention by the provider Used to train the provider's models? Transfer safeguard
Microsoft (Azure) MAI-Image-2.6 (mai, mai-2.6), MAI-Image-2.6 Flash (mai-fast, mai-flash) A Microsoft Azure "Global Standard" deployment, which may process requests in any region where the model is deployed. The Azure resource that OpenRouter uses is in the United States. OpenRouter lists these endpoints as zero data retention. Microsoft states that its abuse monitoring may still keep prompts and outputs that its safety systems flag, for review. We cannot check each request. No Onward transfer by OpenRouter under its agreement with the provider: EU-US Data Privacy Framework certification (Microsoft Corporation is certified) or Standard Contractual Clauses. See Section 5.
Google (Google Cloud Vertex AI) Gemini 3.1 Flash Image (gemini, gemini-flash, gemini-3.1, nano-banana-2), Gemini 3 Pro Image (gemini-pro, nano-banana-pro), Gemini 3.1 Flash Lite Image (gemini-fast, gemini-lite) Google Vertex AI endpoints: currently the "global" endpoint, and for Gemini 3.1 Flash Image also the United States endpoint. These endpoints are not limited to the EU. OpenRouter lists these endpoints as zero data retention. Google describes an in-memory cache of up to 24 hours, and states that its abuse monitoring may log prompts unless an exemption has been granted. We cannot check each request. No Onward transfer by OpenRouter under its agreement with the provider: EU-US Data Privacy Framework certification (Google LLC is certified) or Standard Contractual Clauses. See Section 5.
Byteplus Pte. Ltd. (Singapore), a ByteDance group company serving ByteDance Seed models Seedream 5 Pro (seedream, seedream-pro) Malaysia (Johor). BytePlus states that customer data may also be processed in Indonesia and/or the EU/EEA. Its documents do not exclude remote access by other ByteDance group companies, including in China; see Section 5. OpenRouter lists this endpoint as zero data retention. BytePlus's documents disagree on how long it keeps inputs and outputs that trigger its content filter: one says 180 days in Malaysia, another "a limited period" in Malaysia or Singapore. Images BytePlus generates stay available at a BytePlus link for 24 hours. We cannot check each request. No. BytePlus states that it does not use customer data to train its models without authorisation. EU Standard Contractual Clauses in BytePlus's data processing addendum with OpenRouter, supplemented by our transfer impact assessment. No EU adequacy decision covers Singapore, Malaysia or Indonesia. See Section 5.
OpenAI GPT Image 2.5 Flare (gpt-image, gpt-image-flare), GPT Image 2.5 Sunburst (gpt-image-pro, gpt-image-sunburst) United States Not zero data retention. OpenAI keeps inputs for up to 30 days for abuse monitoring, or longer where the law requires. It keeps images that it flags as potential child sexual abuse material for manual review. No Onward transfer by OpenRouter under its agreement with OpenAI, which our Standard Contractual Clauses with OpenRouter require to give, in substance, the same protection. OpenAI is not certified under the EU-US Data Privacy Framework. Supplemented by our transfer impact assessment. See Section 5.

Requests to OpenAI's models (gpt-image and gpt-image-pro) go to an endpoint that keeps inputs for up to 30 days for abuse monitoring. OpenRouter lists the other endpoints as zero data retention, but those providers may still keep inputs that their safety filters flag (see the table). Our documentation and AI-assistant instructions never use OpenAI's or ByteDance Seed's models as defaults; they are used only when you or your assistant select them by name. If you do not want a provider to keep a photo of a person, do not upload it.

Images from some providers, including BytePlus, contain that provider's own provenance data (C2PA), which can include its request identifier. We keep it inside the provenance data of the image we deliver, except for Microsoft's MAI-Image models: for those, our own provenance data names the model instead, and Microsoft's is not kept.

Content Credentials in processed images. When we process an image that already carries Content Credentials (C2PA), the result keeps them, including any small preview of the original image they contain. So a cropped image, or one with its background removed, can still carry a preview of the whole original, which anyone you share it with can see in a Content Credentials viewer. Check this before you share a processed image.

4.1.2 How We Restrict Routing

OpenRouter can serve a model through more than one provider endpoint. For every model we use, we pin the request to the single provider named in Section 4.1.1, and switch off OpenRouter's fallback to any other provider. If that provider is unavailable, the request fails; it is not sent elsewhere.

  • Microsoft, Google and ByteDance Seed models. We also send two privacy preferences:
    • data_collection: "deny", which OpenRouter describes as "use only providers which do not collect user data";
    • zdr: true, which restricts the request to that provider's endpoints that OpenRouter lists as zero data retention.
  • OpenAI models. We reach these through OpenRouter's image interface, which does not accept those privacy preferences. The pin to OpenAI, with fallback switched off, is the control.
  • Our content classifier is pinned in the same way to Google Vertex AI, with zdr: true.
  • What these settings do not cover. They restrict which providers may process your data. They do not govern how OpenRouter itself handles your data; OpenRouter's terms, its privacy policy and our agreement with OpenRouter do that. OpenRouter states that:
    • it does not store prompts or responses unless the customer opts in to logging, and we have not opted in;
    • it stores request metadata, such as token counts and latency;
    • it samples a small number of prompts to categorise usage and stores those categorisations anonymously.

4.2 Other Disclosures

We may disclose your data:

  • To comply with legal obligations — when a law, or a binding order of a competent authority, requires it. A request alone is not a legal obligation. We assess demands from authorities outside the EU under GDPR Article 48 and Chapter V before disclosing anything
  • To protect rights and safety — when necessary to enforce our Terms, prevent fraud, or protect the safety of our users or the public
  • In connection with a business transfer — if 30ohm L.P. is involved in a merger, acquisition, or asset sale, your data may be transferred to the successor entity. We will notify you before your data becomes subject to a different privacy policy.
  • In connection with service discontinuation — if we permanently discontinue Depicta, we will provide reasonable opportunity to export your personal data before shutdown. After shutdown, remaining data will be handled according to our standard retention schedule (Section 6), including deletion of personal data and retention of billing records as required by law.

We do not sell your personal data. We do not share your data with advertisers.

4.3 AI Apps You Connect

If you connect Depicta to an AI app, such as Claude by Anthropic, the app's provider sends us your requests and receives our results: short references, download links that expire after one hour, a small preview of each image, links to our upload page, the names of pictures you add, the cost and your balance. The provider handles your conversation, including our results, under your own agreement with it, not on our behalf. For Claude, see Anthropic's privacy policy. We never learn your account with the app's provider. For requests that the app sends for you, we don't receive your IP address; we record your account and the connection. Pictures you add in Depicta's panel inside the app go from your browser straight to us, and results shown in the panel load straight from us into your browser, so for those we receive your IP address and browser details, as on our website.

5. International Data Transfers

Your data is primarily processed and stored in the European Union (France, via Scaleway).

When your data is transferred outside the EU/EEA, we ensure adequate protection through:

  • OpenRouter (United States): Transfer is governed by Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914), Module 2, incorporated in OpenRouter's Data Processing Agreement, and supplemented by our transfer impact assessment. OpenRouter is not certified under the EU-US Data Privacy Framework. The routing settings described in Section 4.1.2 limit which model providers may receive your data. They do not change how OpenRouter itself handles your data.
  • AI model providers (reached through OpenRouter; see Section 4.1.1): OpenRouter forwards each request to the provider of the model you selected. These are onward transfers. Our SCCs with OpenRouter require it to bind each provider, by written contract, to give your data in substance the same protection:
    • Microsoft (Azure "Global Standard" deployment; the resource OpenRouter uses is in the United States) and Google (Vertex AI "global" and United States endpoints): Microsoft Corporation and Google LLC are certified under the EU-US Data Privacy Framework. Our transfer impact assessment for OpenRouter covers both routes.
    • Byteplus Pte. Ltd. (Singapore; processing in Malaysia, possibly also Indonesia or the EU/EEA): No EU adequacy decision covers Singapore, Malaysia or Indonesia. BytePlus's data processing addendum with OpenRouter incorporates the EU Standard Contractual Clauses under Irish law. BytePlus belongs to the ByteDance group, and its documents do not rule out remote access to the data by group companies in China, whose law can require companies to cooperate with state intelligence work. Our transfer impact assessment for this route considers that risk. If it matters to you, choose another model.
    • OpenAI (United States): OpenAI is not certified under the EU-US Data Privacy Framework. The transfer relies on OpenRouter's contract with OpenAI under our SCCs, and is supplemented by our transfer impact assessment.
  • Cloudflare (United States): Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), which the European Commission has found to provide an adequate level of protection for transfers of personal data to certified US organizations. As a fallback — to maintain continuity if the DPF is invalidated by future litigation — Cloudflare's Data Processing Addendum also incorporates Standard Contractual Clauses (SCCs) (Commission Decision 2021/914). The data transferred is limited to the technical signals needed for bot verification (IP address, browser characteristics, and interaction signals). We have conducted a transfer impact assessment for this processing.
  • Stripe Managed Payments: For EU customers, the Merchant of Record is Stripe Payments Europe, Limited (Ireland) — an intra-EEA controller relationship, so no separate transfer instrument is required for personal data that remains with the EU MoR entity. For US customers, the Merchant of Record is Stripe, Inc. or Stripe Payments Company (United States); transfers to the US MoR entity are governed by Standard Contractual Clauses (SCCs) under Commission Implementing Decision (EU) 2021/914, supplemented by Stripe's published Data Processing Addendum at https://stripe.com/legal/dpa.

You can ask for a copy of the safeguards we hold for any of these transfers by writing to privacy@depicta.ai.

6. How Long We Keep Your Data

Data Category Retention Period After Expiry
Prompts (including prompts of refused requests) 12 months from submission Permanently deleted
Generation metadata (model, cost, timestamp) 12 months from generation Permanently deleted
Classifier decisions (allow/deny, category, fingerprint of each checked image, including each generated image we check; never the generated image itself) 12 months Permanently deleted
Generated and processed images Deleted normally within 15 minutes after the 1-hour delivery link expires, and in any case within 24 hours Permanently deleted
Uploaded images (for editing or processing) Deleted within 24 hours of upload Permanently deleted
Checked copies of images you provide by link Deleted when the request finishes, and in any case within 24 hours. The model provider receives only a temporary link to this copy Permanently deleted
Story working copies (the story text, scene prompts and character portraits that keep a story consistent while it is generated) Until the story finishes, and in any case within 3 hours after it ends or stops Permanently deleted
Human review samples (prompts, generated images, uploaded images, classifier decisions) 7 days from sampling Permanently deleted. If we suspect content is unlawful, we keep the request record, the prompt and the image hash, and follow the instructions of the competent authority. We keep the image itself only while we decide whether to report it and, if we report it, until the authority no longer needs it.
Account data (email, name, preferences) Until account closure (name and password are removed at once, and the email address is replaced by a one-way fingerprint; the rest, including the fingerprint, is deleted within 30 days), or until inactive account closure (see Terms of Service, Section 13.3) Permanently deleted
Billing and invoicing data As long as Greek tax and accounting law requires: at least 5 years from the end of the year in which the related tax return is due, and longer while a tax audit or dispute is pending Permanently deleted
Audit logs (API access, authentication events) 12 months. Log entries for purchases, credit grants, expiry and forfeiture, refunds and refund decisions, withdrawals and payment disputes are kept for 5 years as evidence in disputes, without IP address or user agent after the first 12 months Permanently deleted
Web server access logs (IP address, user agent, the address requested without any query parameters, response status) 2 years on our service's servers, for security and to investigate abuse, then deleted within a few days. On the server that hosts our website analytics: up to 5 years, for security, and traffic statistics derived from them for as long as they help us Permanently deleted
Application logs (IP address, an internal user ID, request details; no prompts or email addresses) Up to 30 days Permanently deleted; not included in backups
Session data (login session, IP address, user agent) Until the session ends (at most 7 days), then deleted within 7 days Permanently deleted
Connected apps (connection records) While the connection is active, then 12 months after it is disconnected or ends. A connection ends if the app doesn't finish setting it up within about an hour, if the app doesn't use it for 30 days, and in any case after 180 days Permanently deleted
Sign-in data of connected apps (sign-in tokens, stored only as fingerprints, and one-time sign-in codes) Tokens: deleted at once when the connection is disconnected or ends, and otherwise within 10 minutes after they expire. Sign-in codes: deleted within 20 minutes after they are used or expire Permanently deleted
Short-lived connection data (pending sign-ins, upload codes, upload batches, and records that stop a repeated request from running twice) Pending sign-ins: 30 minutes. Upload codes, with the names of the pictures: 30 minutes if unused, otherwise until the upload's link expires, at most 90 minutes after the code was created. Repeat-request records: 2 minutes after the request finishes, or 1 hour if it never finishes. Upload batches (one for each request to add pictures, with how many were added): a day after they expire. Each is deleted within 10 minutes after these times Permanently deleted
Image hashes (SHA-256, with the watermark ID and perceptual fingerprint of images we generate or process) 12 months linked to your account We remove the link to your account and keep only the hash, the date, the file type and, for images we generated or processed, the watermark ID and perceptual fingerprint, which we treat as no longer identifying you
Upload fingerprints (SHA-256, with IP address and user agent) 12 months linked to your account We remove the link to your account, the IP address and the user agent, and keep only the hash, a timestamp and the file type, which we treat as no longer identifying you
Prompt analysis data (opted-in users) Prompts of opted-in users are marked as available for analysis and are kept and deleted on the same 12-month schedule as other prompts Any results we keep are aggregated statistics that contain no prompt text
Website analytics (Umami statistics) As long as they help us compare how the website is used over time Permanently deleted
Waitlist entries Deleted 12 months after you joined if you were never invited, or 30 days after your invitation is used or expires (invitations expire after 90 days) Permanently deleted
Newsletter subscription data (non-registered subscribers) Until unsubscription or deletion request. A sign-up that is never confirmed is deleted after 7 days Permanently deleted
Service emails we send you (purchase confirmations, withdrawal and refund notices, suspension and account notices) Purchase confirmations: as long as the billing records; withdrawal and refund notices: 5 years after sending, without your address after your account is deleted; suspension and account notices: 12 months Permanently deleted
Emails you send us (support, refunds, privacy requests), and our replies Emails about a purchase, refund, withdrawal or payment dispute: as long as the related billing records. Privacy requests and our replies: 3 years after the request is closed. Other emails: 2 years after the last message Permanently deleted

The periods above cover data that we hold. Copies selected for human review are kept for up to 7 days, as shown above, even where the ordinary copy is deleted sooner. Specific records may be kept longer where a binding preservation order applies or they are needed for an identified legal claim; we keep only those records, review the need, and delete them when the reason ends. Deleted data can remain in our backups for up to about 6 months; we do not restore it from backups except to recover from an incident. Retention by the AI model provider that processes a request is set by that provider; Section 4.1.1 describes it.

When you delete your account:

  • Your name and password are removed from the account at once, and your email address is replaced by a one-way fingerprint, used only to recognise a withdrawal or request you send us from that address. The rest of your account data, including the fingerprint, is permanently deleted within 30 days. Closing cannot be undone, so export your data first if you want a copy
  • Prompts are pseudonymized (your identity is removed) for the remainder of the 12-month retention window, then permanently deleted
  • We immediately remove the link to your account from image hashes and upload fingerprints, and delete the IP address, user agent and other references kept with them, unless a legal hold applies (Section 6). We keep only the hash, its date or time, the file type and, for images we generated or processed, the watermark ID and perceptual fingerprint, for provenance verification, and treat them as no longer identifying you.
  • Billing data is retained for the period in the table above, regardless of account status (legal obligation)

When your account is closed due to inactivity (see Terms of Service, Section 13.3):

  • Account data is permanently deleted immediately — no grace period applies
  • Prompts, image hashes, and billing data are handled the same as voluntary account deletion (above)

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

Right What It Means
Access (Art. 15) Request a copy of the personal data we hold about you
Rectification (Art. 16) Request correction of inaccurate personal data
Erasure (Art. 17) Request deletion of your personal data where Article 17 applies. We may keep specific data where an exception applies (for example a legal obligation, or a legal claim), and we will explain any refusal
Restriction (Art. 18) Request that we limit how we process your data in certain circumstances
Data portability (Art. 20) Receive your data in a structured, machine-readable format
Objection (Art. 21) Object to processing based on legitimate interest
Withdraw consent (Art. 7(3)) Withdraw consent for consent-based processing (prompt analysis program, newsletter) at any time, without affecting the lawfulness of prior processing

How to exercise your rights:

  • Email privacy@depicta.ai with your request
  • We respond without undue delay and within one month of receiving your request. If a request is complex, or you send several, we may extend this by up to two further months and will tell you why within the first month
  • If we have reasonable doubts about who is making the request, we may ask you to confirm your identity
  • Exercising your rights is free of charge unless requests are manifestly unfounded or excessive

Data you can export from your dashboard (we first email you a confirmation link, so that only you can start an export):

  • Account information, including linked Google or GitHub sign-ins
  • Usage history, generation metadata and image-processing operations
  • Credit and transaction history, including withdrawals and refunds
  • Prompts linked to your account, including those of refused requests, and the content-check decisions on them
  • Sign-in sessions and upload fingerprints, with their IP addresses and browser details
  • Your connected apps, with their limits, monthly spending and status
  • Copies of the suspension notices we sent you, and a list of the other service emails we sent you
  • Your waitlist entry, if you joined the waitlist
  • Whether a request of yours was selected for human review, and when

We leave out information only where the law allows us to withhold it, for example where giving it could prejudice the prevention or investigation of a crime (GDPR Art. 23). If the dashboard export is not available for your account, ask at privacy@depicta.ai and we answer within the time limits above.

Note: Generated images are not included in the dashboard export, because we delete them shortly after delivery (Section 6). If we still hold an image of yours when you make an access request, for example a human-review copy, we include it in our answer.

8. Prompt Analysis Program

If you opt in to the prompt analysis program (via your dashboard settings):

  • What happens: Your prompts may be analysed, without your account details, to identify patterns that help us improve prompt templates, model routing, and service quality. The prompt text itself may still contain personal data
  • Discount: You receive a 3% discount on per-image costs while opted in
  • Consent: This processing is based on your explicit consent (GDPR Art. 6(1)(a)), obtained separately from accepting the Terms of Service
  • Withdrawal: You can opt out at any time through your dashboard. Withdrawing stops any further analysis of both earlier and future prompts; the discount stops from your next generation. Prior processing remains lawful.
  • How your prompts are used: Analysis uses your prompts without your account details, and we keep only aggregated results that contain no prompt text. If you withdraw your consent, we stop analysing your prompts at once; they are then kept only for the 12-month safety retention in Section 6, like all other prompts.

The prompt analysis program is entirely separate from the 12-month safety retention described in Section 6, which applies to all users regardless of opt-in status.

9. Newsletter

You may subscribe to our newsletter to receive product updates, new features, tips, and announcements about Depicta. Subscribing is entirely optional and is not required to use the service.

9.1 How to Subscribe

  • Website visitors: Use the newsletter signup form on our website. You must provide your email address and give explicit consent by checking the subscription checkbox (not pre-ticked). We use a confirmation email (double opt-in) to verify your email address and your intent to subscribe.
  • Registered users: Toggle the newsletter preference on or off in your dashboard settings at any time.

9.2 What We Send

Our newsletter may include:

  • Product updates and new features
  • Tips for getting the most out of Depicta
  • New AI model availability
  • Company announcements

We do not include third-party advertisements in the newsletter. We do not use third-party email marketing services — the newsletter is sent through our own email infrastructure. We do not share subscriber email addresses with other companies for marketing purposes.

Analytics: We measure newsletter performance only in aggregate, through campaign tags in links. We do not track whether you open an email or which links you click.

9.3 How to Unsubscribe

You can unsubscribe at any time through any of these methods:

  • Click the unsubscribe link included in every newsletter email
  • Toggle off the newsletter in your dashboard settings (registered users)
  • Email hello@depicta.ai with subject line "Unsubscribe"

Unsubscription takes effect immediately. You will not receive further newsletters after unsubscribing. Transactional emails (password resets, account notifications, security alerts) are unaffected by your newsletter preference — those are sent under contractual necessity, not consent.

Newsletter delivery is based on your explicit consent (GDPR Art. 6(1)(a)), in compliance with the ePrivacy Directive (Directive 2002/58/EC, Art. 13(1)) as transposed into Greek law (Law 3471/2006, Art. 11).

You may withdraw consent at any time using any of the methods in Section 9.3, without affecting the lawfulness of processing performed before withdrawal.

9.5 Non-Registered Subscribers

If you subscribe to the newsletter without creating a Depicta account, we collect and process only your email address (and name, if you choose to provide it) for the sole purpose of delivering the newsletter, and, when you sign up, the bot check described in Section 3. This data is not used for any other purpose and is permanently deleted when you unsubscribe.

10. Automated Decision-Making

10.1 Content Classifier and Account Suspension

Our automated content classifier screens all prompts and uploaded images before processing, and checks each generated image before we store or deliver it. The classifier decides whether to allow or deny each request, and whether to deliver or withhold each generated image. A denial prevents the generation from proceeding, and a withheld image is never delivered; we may keep a copy for up to 7 days for human review. Refusing an individual request, or withholding a generated image, is not a decision that produces legal effects for you or similarly significantly affects you: you are not charged, and you can rephrase the request or appeal.

Our systems may also suspend an account automatically, as a temporary safety measure, when the classifier detects a suspected child sexual abuse image, when an account has an unusually high number of requests within 24 hours that our content check refused as breaking our rules, or when it detects repeated attempts within 24 hours to bypass our content safeguards. Only refusals since a person last lifted a suspension count. Refusals caused by a fault on our side, and our checks of generated images, never lead to an automatic suspension. We email you when this happens, with the reason and how to contest it. The suspension is temporary: a person then decides whether it stands.

If, within 24 hours, our checks withhold several generated images from your account, or withheld images whose cost we absorb add up to more than a set amount, we may pause image generation on your account until a person has reviewed it, usually within one business day. If we haven't reviewed it within 48 hours, the pause usually ends on its own; in the most serious cases, it lasts until a person has reviewed it. Your account, credits and payments are not affected, and a pause never counts toward a suspension. We email you when the pause starts and when it is lifted.

We also pause a connected app after three of its requests, or of the pictures added through it, are refused within an hour, and email you. You can resume it yourself on your Connections page. The refusals still count as described above.

To the extent GDPR Article 22 applies to a temporary suspension or a pause, we rely on Article 22(2)(a): our contract with you prohibits the conduct that triggers a suspension and provides for the pause, and acting while a person checks is necessary to enforce that contract. Your safeguards are:

  • a person promptly reviews every automatic suspension and every pause, including a pause that has ended on its own, has authority to overturn it, and lifts it if it was wrong;
  • you can give your view and contest a suspension or a pause by writing to hello@depicta.ai, and a person will review it within 5 business days;
  • we do not close an account on automated grounds alone.

Separately, some requests are selected for human review (requests the classifier refused, flagged or allowed with low confidence, some requests from new accounts, and requests from accounts flagged for unusual patterns), to check the classifier's decisions (see Section 3 and our Terms of Service, Section 10.2). The reviewer sees the content without your account details unless prohibited content is identified and escalation is required.

Appeals:

  • You can appeal any content moderation decision through the process described in our Acceptable Use Policy
  • Appeals are reviewed by a human
  • You are not charged for rejected requests

10.2 Low Balance Restrictions

When your credit balance falls below certain thresholds, available models and quality settings are automatically restricted. This is the agreed effect of the credit system described in our Terms of Service, applied in the same way to everyone; it does not produce legal or similarly significant effects for you.

11. Cookies

Depicta itself sets no cookies. The dashboard keeps you signed in with an item in your browser's session storage, which is deleted when you close the tab. Cloudflare Turnstile protects our sign-up, waitlist, newsletter and password-reset forms, and the image check, from bots, and loads only on those forms, or when you choose a file or start entering a link to check. When you open the checkout, Stripe sets cookies to prevent payment fraud. All of this is strictly necessary for the service you ask for, so we do not ask for consent. We use no tracking or advertising cookies.

Website analytics: We use Umami, a privacy-focused analytics tool, self-hosted on our own servers in the EU. It produces usage statistics (page address and title, referrer, browser, operating system and device type, browser language, country, and clicks on our own pages) to help us improve the website. It uses your IP address and browser details to work out your country and to count unique visitors with a one-way code that changes regularly; Umami itself does not store your IP address. We keep these statistics for as long as they help us compare how the website is used over time. No cookies are set, it honours your browser's Do Not Track signal, and no data is shared with third parties.

For complete details, see our Cookie Policy.

12. Children's Privacy

Depicta is not intended for users under 16 years of age. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly. If you believe a child under 16 has created an account, please contact us at privacy@depicta.ai.

13. Data Security

We implement technical and organizational measures to protect your data, including:

  • Encryption in transit — all data transmitted via TLS 1.2 or higher
  • Encryption at rest — prompts encrypted with AES-256-GCM
  • Password hashing — passwords are hashed using a strong, modern algorithm and never stored in plaintext
  • API key hashing — API keys are hashed and never stored in plaintext
  • Access control — principle of least privilege for all internal access
  • Audit logging — every authenticated request to our administrative interfaces, including any access to personal data through them, is logged
  • Isolated content classifier — runs in a separate container with no shared state
  • Regular security reviews — dependency scanning, configuration audits

No system is perfectly secure. If you discover a security vulnerability, please report it to security@depicta.ai.

14. Changes to This Policy

We may update this Privacy Policy from time to time.

Material changes — changes that introduce new categories of personal data collection, new data sharing with third parties, new processing purposes, reduced retention protections, or changes to your GDPR rights — will be communicated as follows:

  • We will notify you at least 30 days before the changes take effect
  • Notification will be sent to your registered email address and posted on the website
  • Where the change is made by a provider rather than by us (for example, a model provider changes its own retention), we will update this policy without undue delay and, where possible, before more of your data is sent to that provider
  • The updated policy will display the new "Last updated" date

Non-material changes — such as corrections of typographical errors, clarifications that do not alter the scope of data processing, formatting adjustments, or updates to contact information — take effect when posted on the website. We will update the "Last updated" date but are not required to notify you by email.

If you do not agree with the changes, you may close your account before they take effect.

15. How to Contact Us

For any questions or requests related to your privacy or personal data:

We aim to respond to all privacy-related inquiries within one month.

16. Your Right to Complain

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with a supervisory authority.

Hellenic Data Protection Authority (HDPA)

  • Greek name: Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (ΑΠΔΠΧ)
  • Address: 1-3 Kifissias Ave., 115 23 Athens, Greece
  • Phone: +30 210 6475600
  • Email: contact@dpa.gr
  • Website: www.dpa.gr

If you reside in another EU Member State, you may also contact the data protection authority in your country of residence.