Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account registration data (email address, display name, password hash).
• Age-assurance information, such as your age declaration, verification result, date, method, and a verification token or status received from an age-assurance provider. We seek to avoid collecting identity documents ourselves unless necessary.
• Content you upload (images, prompts) for AI generation.
• Communications you send us via support channels.

1.2 Information Collected Automatically

• Log data: IP address, approximate location derived from IP, request path, timestamps, response status, referring URLs, login events, error logs, and rate-limit events.
• Device and session data: browser and operating system, screen resolution, language, cookies, session identifiers, and security-related device or network signals.
• Cookies and similar technologies (see Section 4).
• Usage and safety telemetry: feature interactions, request frequency, generation and upload events, deletion or preview events, session duration, concurrency, and signals indicating possible automation, abuse, fraud, or attempts to evade controls.

1.3 Information From Third Parties

• Authentication providers (Google, Telegram): name, email, profile picture as permitted by your provider settings.
• Payment processors: transaction identifiers and subscription status (not full card data).
• Age-assurance and safety providers: verification status or token and risk signals needed to confirm eligibility, prevent fraud, or protect the Service.

2. How We Use Your Information

• To provide, maintain, and improve the Service and AI generation features.
• To process payments, manage subscriptions, and prevent fraud.
• To authenticate your identity and keep your account secure.
• To confirm age eligibility and comply with applicable age-assurance requirements.
• To detect unauthorized API or automated access, enforce rate and concurrency limits, and investigate attempts to bypass safety or security controls.
• To respond to support requests and send service-related notifications.
• To enforce our Terms of Service, Content Policy, and applicable law, including detecting and removing prohibited content (CSAM, NCII).
• To conduct analytics and research to improve recommendation quality and platform safety.
• To comply with legal obligations and respond to lawful requests from authorities.

We do not sell your personal information to third parties for their independent marketing purposes.

3. How We Share Your Information

• Service Providers: Cloud infrastructure, CDN, payment processors, email delivery, analytics, age-assurance, fraud-prevention, and safety providers acting on our instructions and subject to contractual and security obligations.
• AI Model Providers: Prompts and input images are transmitted to third-party AI inference APIs to produce generations. Refer to those providers' privacy policies.
• Legal Compliance: We may disclose data when required by law, court order, or to protect rights, safety, or property — including mandatory CSAM reports to NCMEC.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred to the successor entity.

4. Cookies & Tracking

We use essential cookies necessary to operate the Service (session tokens, CSRF protection, age-gate confirmation). We may also use analytics cookies to understand aggregate usage patterns.

You can disable non-essential cookies via your browser settings. Disabling essential cookies will impair Service functionality. We do not currently respond to Do Not Track signals.

5. Data Retention

We retain account data for as long as your account is active or as needed to provide the Service. A generation removed from your visible history may remain inaccessible in a secure deletion buffer for as long as reasonably necessary for abuse prevention, fraud investigation, dispute resolution, enforcement of our Terms of Service and Content Policy, and service security. Generated content associated with your account is retained on the same basis after account deletion. Log data is retained for up to 12 months. Age-assurance data is retained only as long as reasonably necessary to determine age and eligibility and meet applicable legal requirements, then deleted. Separate risk and security records are retained only as long as reasonably necessary to prevent repeated abuse, resolve disputes, or comply with law. Financial records are retained as required by applicable tax law. We may retain specific safety, security, or legal records for longer when reasonably necessary or legally required.

6. International Transfers

Our infrastructure is hosted primarily in the United States. If you access the Service from the European Economic Area, United Kingdom, or other regions with data transfer restrictions, your data will be transferred internationally. We rely on Standard Contractual Clauses where required.

7. Your Rights

Depending on your jurisdiction you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and associated data (subject to legal retention obligations).
• Portability: Receive your data in a machine-readable format where technically feasible.
• Objection / Restriction: Object to or request restriction of certain processing activities.
• Withdrawal of Consent: Where processing is based on consent, withdraw at any time without affecting prior lawfulness.

To exercise these rights, contact us at hello@makeartly.com. We will respond within 30 days (or as required by applicable law).

8. Children's Privacy

The Service is strictly intended for adults aged 18 and over. We do not knowingly collect personal information from individuals under 18. If you believe a minor has provided us with personal information, contact us at hello@makeartly.com. We will investigate, restrict access where appropriate, and delete the information unless retention is permitted or required for safety, legal compliance, fraud prevention, payment records, or dispute resolution.

We use age-assurance information only to determine age and eligibility and comply with related legal requirements. We do not use identity documents or age-assurance results for advertising, unrelated profiling, fraud scoring, or training generative AI models. Where a specialist provider performs verification, we require it to limit use, protect the data, and delete it when no longer needed, subject to applicable law.

Automated safety and risk signals may trigger a CAPTCHA, re-verification, reduced usage limits, or a temporary restriction. Except where immediate action is reasonably necessary for safety, security, fraud prevention, or legal compliance, you may request human review of a material longer-term account decision by contacting us.

9. Security

We implement reasonable technical and organizational measures designed to protect your data, including encryption in transit and access controls. No security measure is perfect; please notify us immediately at hello@makeartly.com if you believe your account has been compromised.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notification at least 14 days before they take effect, unless an earlier change is reasonably necessary for legal, safety, or security reasons. We will also post the new policy on this page and update the dates above. Continued use after the effective date constitutes acceptance of the revised policy.

11. Contact Us

For privacy-related inquiries, data subject requests, or to report a concern: