Privacy Policy

What we collect

We collect what you give us, what the platform generates as you use it, and the technical data every web service needs to run safely. We do not receive or store your full card number. That stays with our payment processor.

• Account: email, display name, handle, and profile media you upload
• Creation: prompts, generated media, projects, and the model used for each run
• Usage: which surfaces you use and when, for reliability and improvement
• Device and technical: IP address, browser and device type, and log data, used for security and diagnostics
• Payment: amount, status and a provider reference, but never your card details
• Communications: messages you send support, so we can help and keep a record

Why we collect it, and our legal basis

We only process data for a specific purpose, and each purpose has a lawful basis. Where the basis is consent, you can withdraw it at any time.

• To provide the service you asked for (running generations, saving projects, operating features), on the basis of our contract with you
• To operate Agent Ora’s memory and personalised learning, on the basis of your consent, which you can withdraw
• To bill correctly and prevent fraud, on the basis of our contract and our legitimate interest in a working service
• To keep the platform and its creators safe, on the basis of our legitimate interest in security and integrity
• To meet tax, accounting and other legal duties, on the basis of a legal obligation

AI content and training

Your private creations are yours. They are not used to train third-party foundation models, and they are not sold.

Prompts and media you submit are sent to the AI model provider needed to fulfil that specific run, under that provider’s terms, for that run only.

Agent memory

Agent Ora can remember context to be useful across sessions. That memory exists only where you consent to it, is scoped to your account, and can be withdrawn.

Withdrawing consent deletes the memory rather than merely hiding it.

Who processes your data

We share personal data only with the categories of processor that make the platform work, each bound by contract to use it solely to provide that service and nothing else. We do not sell personal data, and we do not share it for anyone else’s advertising.

• Cloud hosting and database: stores your account, projects and media
• Authentication: verifies your identity and keeps you signed in
• Payment processing: takes payment and handles card data so we never see it
• Transactional email: sends account, billing and security messages
• AI model providers: run the specific generations you request
• Analytics: aggregate usage measurement, only where you allow it

International transfers

The providers above may process data in countries other than your own. Where personal data is transferred across borders, we rely on appropriate safeguards, such as contractual data-protection terms with each processor, so your data keeps a comparable level of protection wherever it is handled.

How long we keep it

We keep personal data while your account is active and for as long as the purpose it was collected for still applies. When you delete something, we delete it. There are two exceptions.

• Financial records we are legally required to retain for tax and accounting
• Immutable audit records of security-relevant actions, which exist to protect you and other creators

Your rights

You have rights over your personal data. We honour requests from Settings or by contacting support, we do not require a reason, and we do not charge for them. Depending on where you live some of these are legal rights; we apply the same standard to everyone.

• Access: get a copy of the data we hold about you
• Rectification: correct data that is wrong or incomplete
• Erasure: delete your data, subject to the retention exceptions above
• Portability: export your data in a portable form
• Restriction and objection: limit or object to certain processing
• Withdraw consent: for anything based on consent, at any time
• Complain: to your local data-protection authority if you are unhappy with how we handled your data

Security

Data is protected in transit and at rest. Access is scoped to what a task needs, administrative access to your content is capability-gated and recorded, and we treat a lapse as an incident rather than an inconvenience.

Children

The platform is not intended for children. We do not knowingly collect data from anyone under the age required in their country to consent to processing. If you believe a child has given us data, contact us and we will remove it.

Changes to this policy

We will update this policy as the product and its processors develop. Material changes are published with a new “last updated” date, and we will not quietly weaken a protection you relied on.

Contact

Privacy questions and rights requests go to support with “Privacy” selected. If something here does not match your experience of the product, we want to know. That is a fault worth telling us about.