Privacy Policy

Introduction

This Privacy Policy explains how Pictura ("we", "us", "our") handles your personal information when you use our website and AI image tools (the "Service"). Pictura is an independent service and is not affiliated with OpenAI.

If anything in this policy is unclear, please open a support ticket and we will help.

Information We Collect

Information you give us

• Account details: your email address, name and password (stored only in hashed form). If you sign in with Google or GitHub, we receive your name, email address and profile picture from that provider.
• Photos you upload: for example product photos, old family photos or selfies for headshots. These photos may show faces and other personal details.
• Prompts and settings: the text you type and the options you choose, such as style and aspect ratio.
• Support messages: what you write in support tickets.

Information created when you use the Service

• Generated images and history: the images you create and a record of each generation (tool used, prompt, time, credits spent and status).
• Credits and purchases: your credit balance, subscription status, order numbers and payment history.
• Technical data: IP address, browser and device type, and log data needed to run and secure the Service and to prevent abuse.
• Cookies: see the Cookies section below.

How We Use Your Information

We use your information to:

• Create and manage your account and keep you signed in.
• Run the tools you ask for: send your uploads and prompts for AI processing and return the results to you.
• Save your results in My Images so you can view and download them later.
• Track credits, process payments and subscriptions, and refund credits automatically when a generation fails.
• Send transactional emails, such as verification and password reset messages.
• Answer your support tickets.
• Prevent fraud, abuse and violations of our Terms of Service and Acceptable Use Policy, including screening prompts and images for prohibited content, and keep the Service secure.
• Understand how the Service is used so we can improve it.
• Meet our legal obligations.

We do not use your uploaded photos, prompts or generated images to train AI models. We do not sell your personal information.

AI Processing and Third Parties

To generate an image, we send your prompt and any photo you uploaded to Kie.ai, a third-party AI API provider. Kie.ai runs the request on Google's Nano Banana image model (Gemini 2.5 Flash Image). In practice:

• Uploaded photos go to Kie.ai's temporary storage so the model can read them. Kie.ai deletes uploaded input files within 24 hours.
• Generated images are copied from Kie.ai to our own cloud storage (Cloudflare R2) and shown in your My Images gallery.
• Kie.ai and Google process your data under their own terms and privacy policies.

Content moderation. To enforce our Acceptable Use Policy:

• Every text prompt is checked against our list of prohibited terms and, before generation, sent to Waffo Prompt Sift, a content-safety service provided by Waffo.
• When automated image moderation is enabled, uploaded photos and generated images are checked by an automated image moderation model.
• We keep a log of moderation decisions, and a person reviews reports and appeals.

We also rely on these service providers:

• Cloudflare R2: stores your generated images.
• Cloudflare Workers AI: screens uploaded and generated images for prohibited content.
• Waffo Pancake (our merchant of record), Stripe, Creem or PayPal: process payments. You enter your payment details directly with them. We never see or store your full card number. We only receive what we need to record your order, such as the amount and payment status.
• Resend: sends transactional emails.
• Google Analytics or Plausible (optional): measure how the site is used. Analytics cookies are stored only after you accept them in the cookie banner.
• Google and GitHub (optional): let you sign in with an existing account if you choose to.
• Hosting providers: run our website and database.

We may also disclose information when the law requires it, to respond to a valid legal request, or to protect the rights and safety of our users, the public or the Service. This includes reporting suspected child sexual abuse material to the National Center for Missing and Exploited Children (NCMEC) or other relevant authorities.

How Long We Keep Your Data

• Uploaded photos: deleted by Kie.ai within 24 hours. We do not keep our own copy of the uploaded file.
• Generated images and generation history: kept in My Images until you delete them or delete your account.
• Account data: kept while your account is active. When your account is deleted, we delete your personal data, except records we must keep by law.
• Order and payment records: kept as long as needed for accounting, tax, fraud prevention and other legal requirements, even after your account is deleted.
• Support tickets and technical logs: kept only as long as needed to help you, secure the Service and meet legal requirements.
• Moderation logs and reports: kept only as long as needed to enforce our Acceptable Use Policy, handle reports and appeals, and meet legal requirements.

To delete your account, open a support ticket.

Cookies

We use a small number of cookies and similar technologies:

• Essential cookies keep you signed in, remember your language and your cookie choice, and help protect the Service. The Service cannot work without them.
• Analytics (Google Analytics or Plausible) helps us understand how the site is used. Analytics cookies are stored on your device only if you accept them in the cookie banner. If you decline, we do not store analytics cookies.

You can change your choice at any time with the cookie settings link in the site footer. You can also block or delete cookies in your browser settings, but some parts of the Service may then stop working.

Your Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is wrong or out of date.
• Delete your information, including your images and your account.
• Export your data in a portable format.
• Object to or restrict some processing, and withdraw consent (for example to analytics) at any time.
• Complain to your local data protection authority.

EU and UK users (GDPR): we process your data to perform our contract with you (running the Service), for our legitimate interests (security, fraud prevention and improving the Service), with your consent (analytics), and to meet legal obligations (such as tax records).

California users (CCPA): you have the right to know what personal information we collect, use and disclose, to ask us to delete or correct it, and not to be treated differently for using these rights. We do not sell your personal information.

You can edit your profile and delete images yourself in Settings. For any other request, open a support ticket. We may need to confirm your identity first, and we will respond within the time the law requires.

Security

We protect your data with encryption in transit (HTTPS), hashed passwords and access controls. Payment details are handled by our payment providers, not by us. No system is perfectly secure, so please use a strong, unique password and tell us right away if you think someone has accessed your account.

Children

The Service is not intended for children under 13, or under 16 in the European Union. We do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

Do not upload photos of a minor unless you are their parent or legal guardian, or you have their parent's or guardian's consent.

International Data Transfers

We and our service providers may process and store your data in countries other than the one you live in, including the United States. Data protection laws there may differ from those in your country. Where the law requires it, we rely on appropriate safeguards, such as standard contractual clauses, for these transfers.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will change the date at the top of this page. If the changes are significant, we will also let you know through the Service or by email.

Contact Us

If you have a question or request about your privacy, email the support email listed in the footer of every page, or sign in and open a support ticket under Settings > Support Tickets (/settings/tickets).