Privacy Policy

1. Data controller

The data controller responsible for your personal information is:

• Operator: Hangzhou Yiwan Chuangxiang Network Technology Co., Ltd.
• Unified social credit code: 91330110MAK57QYF6E
• Registered address: Room 2-202, Building 3, Vanke Entrepreneurship Industrial Park, Yuniao Liusu, Liangzhu Street, Yuhang District, Hangzhou, Zhejiang, China
• Phone: +86 198 8323 2077
• Privacy contact: jameswest8823@gmail.com
• Data Protection Officer: not appointed (not required for our current scale of processing).

2. Information we collect

2.1 Information you provide

• Account information: your email address and a password. Passwords are stored only as a salted one-way hash (scrypt); we never store them in plain text.
• Google sign-in: if you choose "Continue with Google", we receive your email address, your Google account identifier and, if Google provides them, your name and profile picture. We do not receive your Google password.
• Profile: a profile picture you upload or generate (optional).
• Content: prompts, text, scripts and chat messages you enter; images, audio and video you upload as references; the images, videos, audio and text generated for you ("Outputs"); and your canvas projects.
• API / MCP keys: if you create an API key for AI agents, we store only a hash and a short prefix of the key, plus its name and when it was created and last used.
• Payment information: purchase amount, credits purchased, payment status and the payment session identifier. We never receive or store your full card number — card data is handled entirely by our payment processor (see section 5).
• Communications: emails and feedback you send to us.

2.2 Information collected automatically

• Device and network: IP address, browser type, operating system and language preference.
• Usage records: for each generation, the model used, the type of task, the credits charged and the time. These records power your usage history and billing.
• Logs: request times, error logs and performance data, used to operate and secure the Service.

We do not collect precise location data, and we do not use third-party analytics or advertising trackers.

3. How we use your information

We do not use your prompts, uploads or Outputs to train AI models. We may aggregate or de-identify data for statistics; such data cannot identify you.

We do not currently send marketing emails. If we start, we will only do so with your consent and every message will include an unsubscribe link (see section 9).

4. Cookies and similar technologies

We use only a small number of first-party cookies and browser storage needed to run the Service:

Apart from the first-visit source cookie listed above, we do not use analytics, advertising or cross-site tracking cookies. You can delete or block cookies in your browser settings; blocking strictly necessary cookies will prevent sign-in.

5. How we share information

We do not sell your personal information, including "selling" or "sharing" as defined by laws such as the CCPA. We share information only as follows:

• Third-party AI model providers: to generate an Output, we send your prompt and any reference files you attach to the third-party AI model provider that runs the model you selected (the model is shown by name in the interface). They process this content to return the Output, under their own terms and policies, which may include short-term retention for abuse monitoring. We do not send them your password or payment details.
• Payment processors: payments are processed by Stripe and, where indicated at checkout, by Waffo Pancake acting as merchant of record. They receive the information needed to process your payment (such as your email and payment details) and handle card data under PCI-DSS. Card data is never stored on our servers.
• Infrastructure providers: our cloud hosting provider and Cloudflare (R2 object storage, which stores uploaded and generated media). They process data only on our instructions.
• Google: if you use Google sign-in, Google processes the sign-in under its own privacy policy.
• Legal requirements: when required by law, court order or a lawful request from authorities, or to protect the rights, safety and property of our users, the public or us — including reporting child sexual abuse material to the relevant authorities.
• Business transfers: in a merger, acquisition or sale of assets, with notice to you and with this policy's protections continuing to apply.
• With your consent: for any other purpose you explicitly agree to.

6. Security

• All traffic is encrypted with TLS (HTTPS).
• Passwords and API keys are stored only as one-way hashes.
• Generated and uploaded media are stored in private storage and served through short-lived signed links.
• Access to production systems is limited to the people who operate the Service, on a least-privilege basis.

No system is perfectly secure. If a security incident affects your personal information, we will notify you and the relevant authorities as required by law, within 72 hours of becoming aware of it where feasible. Please keep your password and API keys confidential.

7. Data retention

Backups are overwritten on a rolling basis and may keep deleted data for up to 90 additional days.

8. Your rights

Depending on where you live, you may have the following rights. To exercise them, email jameswest8823@gmail.com from your account email. We will respond within 30 calendar days.

You can download your works from your account at any time. You can revoke API keys yourself on the MCP page. To delete your account, email us from your account email; we will confirm and complete the deletion within 30 days. If you believe we have not handled your request properly, you may lodge a complaint with your local data protection authority.

9. Marketing communications

We currently send only service-related emails (for example, about purchases, security or changes to our policies). If we send marketing messages in the future, we will ask for your consent first, and you can unsubscribe at any time via the link in each email or by contacting us. Unsubscribing does not affect necessary service notices.

10. International transfers

Our providers operate in several countries, including the United States, so your information may be processed outside the country where you live. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses offered by our providers, and we only use providers that commit to protecting personal data.

11. Children

The Service is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.

12. Third-party links and services

The Service may link to or integrate with third-party websites and services (for example, Google sign-in or payment pages). This policy covers only information we collect. Please review the privacy policies of those third parties.

13. Changes to this policy

We may update this policy from time to time. For material changes we will notify you at least 15 days in advance by email or by a notice on the Service, and we will update the effective date at the top of this page. Continuing to use the Service after the effective date means you accept the updated policy.

14. Contact us

• Privacy and support email: jameswest8823@gmail.com
• Phone: +86 198 8323 2077
• Operator: Hangzhou Yiwan Chuangxiang Network Technology Co., Ltd.
• Mailing address: Room 2-202, Building 3, Vanke Entrepreneurship Industrial Park, Yuniao Liusu, Liangzhu Street, Yuhang District, Hangzhou, Zhejiang, China
• We aim to reply within 2 business days.

See also our Terms of Service.