Privacy Policy

Version 2026-08-10 - effective August 10, 2026

This document is a translation of the legally binding Polish version. In case of discrepancies, the Polish version shall prevail.

1. Data Controller

The controller of your personal data is ConsultIT Michał Giernatowski, a sole proprietor registered in CEIDG, address: ul. Alpaki 20, 05-506 Lesznowola, Polska, NIP: 5361887961, REGON: 384671455 ("Controller", "we", "us").

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR), the Polish Act on Personal Data Protection of 10 May 2018, and other applicable data protection legislation.

Where a business customer uploads third-party personal data and determines its purposes and means, the customer is the controller and the Provider generally acts as processor or service provider under U.S. state law. The customer is responsible for legal basis, notices and consents; processing terms should be covered by a separate DPA.

If a business customer uploads materials containing personal data of its customers, employees, contractors, models, influencers, or other third parties, the customer is responsible for informing those persons, obtaining required consents or ensuring another lawful basis, and ensuring that the intended use of outputs is compliant. In that context we may act as processor where a DPA has been entered into, or as an independent controller for security, billing, compliance, and legal-claims activities.

2. Data Protection Contact Point

For all matters relating to the processing of your personal data and the exercise of your rights, please contact us at:

Email: legal@anset.ai

Postal address: ConsultIT Michał Giernatowski, ul. Alpaki 20, 05-506 Lesznowola, Polska

We will respond without undue delay and no later than one month. Where permitted by law, a complex request may require up to two additional months; we will notify you of an extension within the first month.

3. Categories of Personal Data

We collect and process the following categories of personal data:

Account Data: Email address, display name, first name, company name (optional), account type (individual/business), role/profession, language preference, onboarding status.
Authentication Data: Password hash (we never store plaintext passwords), OAuth provider information (if you sign in via Google), session tokens.
Payment and Billing Data: Stripe customer ID, Subscription tier and status, billing period dates, purchased Credit Pack records, transaction amount, currency and date and, where required for settlement or invoicing, name or business name, billing address, country, email address, customer status and tax identification number. We may also process invoice, correction and KSeF document numbers and statuses. Full payment-card credentials are collected and processed by Stripe and are not stored on our servers.
User Content: Materials uploaded in the Service, including product photos and reference materials, scenes, brand assets, logos, descriptions, prompts, generation parameters, brand kits, campaign data, and generated images. Materials may contain the likeness or other personal data of third parties, for example where a person is visible in a product photo, scene, packaging, or background. We do not request special-category or sensitive data and you should not upload it unless we expressly provide a feature intended for such processing and enter into separate terms.
Usage Data: Generation history, credit transactions (amount, type, timestamp), feature usage patterns, API request logs.
Technical Data: IP address, browser type and version, device type, operating system, referring URL. Collected via server logs and, with your consent, via analytics cookies.
Analytics Data (with consent): Pseudonymous online identifiers, page views and feature events. Google Analytics 4 loads only after consent; we do not describe these data as anonymous.
Security and Moderation Data: Results of automated or manual classification of prompts, images, and assets, information about blocks, appeals, Terms violations, abuse signals, audit logs, and technical event identifiers.

Standard image moderation may include detecting faces, the presence of a person, approximate risk categories, nudity, documents, or other safety signals. We do not use this function to identify specific persons or create biometric templates unless we separately inform you of such a feature and provide the required lawful basis.

4. Purposes and Legal Basis for Processing

We process your personal data for the following purposes:

Providing the Service (account creation, AI image generation, asset management) — Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Processing payments, managing Subscriptions and Credits — Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Communicating with you about your Account, transactions, and Service changes — Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Ensuring security, preventing fraud, and abuse detection — Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Our legitimate interest is the protection of the Service and our Users.
Improving the Service, fixing bugs, optimizing performance — Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Our legitimate interest is continuous improvement of the Service.
Enforcing our Terms of Service and Acceptable Use policy, content moderation — Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Reviewing User Content, prompts, assets, and outputs for safety, abuse, third-party rights, personality rights, prohibited content, and AI requirements — Legal basis: legitimate interest (Art. 6(1)(f) GDPR), consisting of protecting the Service, Users, third parties, and the Provider from abuse and claims.
Handling reports, appeals against blocks, complaints, and establishing, exercising, or defending legal claims — Legal basis: legitimate interest (Art. 6(1)(f) GDPR) or legal obligation (Art. 6(1)(c) GDPR), depending on the situation.
Analytics and usage statistics (Google Analytics 4) — Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time via the cookie consent banner.
Issuing and correcting billing documents, maintaining tax and accounting records, and fulfilling tax and reporting obligations — Legal basis: legal obligation (Art. 6(1)(c) GDPR), in accordance with applicable tax and accounting laws.
Responding to lawful requests from public authorities — Legal basis: legal obligation (Art. 6(1)(c) GDPR).

5. Payment Data and Stripe

Payment processing is handled by the Stripe group entity applicable to the transaction, as identified in Stripe Checkout and Stripe's terms. Depending on the processing activity, Stripe may act as our processor or as an independent controller.

When you make a payment, your credit card details are transmitted directly to Stripe via their secure SDK. We never receive, process, or store your full credit card number.

We store, among other things, the Stripe customer ID, Subscription status and period, and Credit Pack purchase records (quantity, price and date). Purchased Credits do not expire under the current Service functionality.

Stripe's privacy policy: https://stripe.com/privacy

6. AI Processing of Your Content

When you use AI features, Input Data and outputs may be processed by AI model and infrastructure providers, in particular Google Vertex AI or the paid Google AI API (Gemini), depending on configuration, availability, region, cost, and feature:

Text prompts, descriptions, instructions, generation parameters, and quality settings
Uploaded reference images, product photos, scenes, brand assets, and other files used in generation or analysis
Brand kit data, campaign descriptions, briefs, target audiences, and marketing context where used by a feature
Generated images, variants, layouts, text, quality assessments, and technical job metadata
Safety and moderation signals needed to perform the task, prevent abuse, and enforce the Terms

If an image contains a person, product, trademark, or other third-party data, it may be processed to the extent necessary to perform the task and ensure safety.

We use paid AI services subject to restrictions on using customer data to train models. However, we do not promise zero retention by every provider: providers may retain limited data for safety, abuse prevention, technical logs, cache, temporary files, or enabled service features.

We do not use private images or prompts to train our own models without separate, voluntary consent. We may use irreversibly aggregated technical statistics, such as job counts, costs, errors, and model performance.

Provider terms may differ depending on product, region, and feature. Reference links: https://cloud.google.com/terms/service-terms and https://ai.google.dev/gemini-api/terms.

7. Data Recipients and Service Providers

We disclose personal data to the following recipients in connection with providing the Service, handling settlements and meeting legal obligations. Their role may be processor/service provider or, for specified activities, independent controller; applicable processor relationships are covered by data processing terms:

Google Cloud Platform: Google Cloud / Google AI (Google LLC and the applicable Google entity) — AI models, generation infrastructure, image analysis, Google OAuth, Google Fonts, or other Google functions enabled in the Service. Data: prompts, images, outputs, generation parameters, technical metadata, Google account identifier for OAuth, and IP address and headers when Google resources are loaded, if the function is used.
Stripe: Applicable Stripe group entity — payment processing, fraud prevention and subscription management. Data: email, payment method, billing address and transaction history. Stripe may act as an independent controller for some legal, compliance and fraud-prevention activities.
Supabase: Supabase, Inc. (USA, database in the configured EU region) — database and authentication. Data: Account, session and application records. User files are stored in Cloudflare R2, not Supabase Storage.
Vercel: Vercel, Inc. (USA) — frontend hosting and CDN. Data: IP address, headers, requested URL and technical logs retained under service configuration and terms.
Sentry: Sentry (Functional Software, Inc., USA) — Error monitoring and performance tracking (production only). Data processed: error stack traces, request metadata. Sensitive data (auth tokens, API keys) is filtered before transmission.
Cloudflare R2: Cloudflare, Inc. (USA) — Cloud storage for user assets and generated images (if R2 storage backend is enabled). Data processed: uploaded files, generated images.
Google Analytics: Google LLC (USA) — Google Analytics 4 only with consent. Data: online identifiers, device data, approximate location, pages and events. We do not use advertising features.
Security, moderation, observability, and infrastructure providers — to the extent necessary to detect errors, abuse, attacks, Terms violations, and security incidents.
Providers of accounting, tax, audit and legal services acting for us — only to the extent necessary to handle settlements, meet legal obligations, conduct audits, or establish, pursue or defend claims.
Public authorities and other authorized recipients — where disclosure is required by applicable law or a legally binding request.

We do not sell data for money. If U.S. state law treats analytics disclosure to Google as a sale, sharing or targeted advertising, you can opt out through cookie settings or Global Privacy Control.

8. International Data Transfers

Some recipients may process personal data outside the European Economic Area (EEA). Where required, we use an applicable transfer mechanism, including:

An adequacy decision, including the EU-U.S. Data Privacy Framework where the relevant U.S. recipient is actively certified and the transfer is covered.
European Commission Standard Contractual Clauses (SCCs), with a transfer assessment and supplementary measures where appropriate, when no adequacy decision covers the transfer.

Hosting regions and safeguards differ by service and feature. We maintain provider-specific records of the applicable region, recipient role and transfer mechanism; Google AI processing and Cloudflare R2 storage may involve processing outside the EEA.

You may request information about the specific safeguards applied to transfers of your data by contacting legal@anset.ai.

We do not guarantee that all processing operations will be performed exclusively in the EEA. The scope of transfer depends on the feature, provider, region, support mechanism, and security requirements. Where required by law, we use an appropriate transfer mechanism and document it internally.

9. Data Retention Periods

We retain your personal data for the following periods:

Account data — for the agreement term; after a deletion request the Account is blocked and active-system data is erased without undue delay, subject to legal exceptions and backup cycles.
User content — for the Account term or until earlier deletion. Download needed files before deleting the Account; deletion is not a data-recovery feature.
Generation job records (prompts, parameters, results) — for the duration of your Account. Part of your generation history feature.
Tax, accounting and payment records — for the period required by applicable law. Data needed to establish, pursue or defend claims is retained until the relevant limitation periods expire, taking account of any suspension or interruption.
Audit logs (API requests, security events) — 90 days for standard logs, 365 days for security incidents and financial operations.
Google Analytics data — up to 14 months in the property setting; cookies may last for periods in the Cookie Policy unless you withdraw consent earlier.
Stripe webhook event IDs — 365 days (for idempotency and dispute resolution). Webhook payloads are not stored.
Blocked content or content marked for review — for the time needed to verify it, handle an appeal, prevent abuse, enforce the Terms, and establish, exercise, or defend legal claims; after that period it is deleted or anonymised unless law requires longer retention.

After the applicable period, data is deleted or irreversibly anonymized under active-system schedules and backup cycles. You may request earlier deletion, subject to legal exceptions.

The automated export feature, where available, may include basic Account data, selected application records, and part of User Content. If you want to obtain a full copy of personal data we process about you under GDPR, contact legal@anset.ai; we will fulfil the request to the extent required by law.

After Account deletion, data is deleted from active systems or anonymised without undue delay, subject to data we must retain for tax, accounting, anti-abuse, security, dispute handling, claims, audit logs, backups, and data processed by independent controllers such as Stripe.

10. Profiling and Automated Decision-Making

The Service employs the following automated processing activities:

Rate limiting — automated restriction of API requests per user and IP address to prevent abuse. This is based on your subscription tier and does not constitute profiling under Art. 22 GDPR.
Content moderation — automated or manual scanning of prompts, images, assets, and outputs for prohibited content, abuse, presence of persons, faces, nudity, documents, risk signals, and Terms violations. Flagged content may be blocked, sent for review, or excluded from generation. You may contest a block by contacting legal@anset.ai.
Credit consumption — automated deduction of Credits based on generation parameters. Fully transparent, with cost displayed before each generation.

We do not use automated decision-making based on profiling that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22(1) GDPR. Automated content blocks support Service safety and compliance; you may request review.

11. Your Rights Under GDPR

Under GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15) — You may request a copy of personal data we process about you. The automated export feature in Account settings, where available, may include only part of the data; we will fulfil a complete access request after contact at legal@anset.ai to the extent required by law.
Right to rectification (Art. 16) — You may request correction of inaccurate personal data or completion of incomplete data.
Right to erasure (Art. 17) — You may request deletion of your personal data. This right may be limited where retention is required by law (e.g., financial records).
Right to restriction of processing (Art. 18) — You may request that we limit processing of your data in certain circumstances (e.g., while we verify accuracy).
Right to data portability (Art. 20) — You may request to receive data you provided to us and that we process based on contract or consent in a structured, commonly used, machine-readable format, to the extent required by law. Use the export feature or contact legal@anset.ai.
Right to object (Art. 21) — You may object to processing based on our legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
Right to withdraw consent (Art. 7(3)) — Where processing is based on consent (analytics cookies), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact legal@anset.ai or use the relevant features in your Account settings. We will respond without undue delay and no later than one month; where permitted by law, this may be extended by two further months, and we will notify you within the first month. We may request proportionate identity verification before processing your request.

Exercising your rights is free of charge. In cases of manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse to act.

12. United States State Privacy Rights

Where your state law applies, including the CCPA/CPRA, you may have rights to know and access data, correct it, delete it, obtain a copy, and learn categories of recipients.

You may opt out of sale, cross-context behavioral advertising sharing, targeted advertising and certain profiling to the extent defined by applicable law.
We do not sell data for money or knowingly process data of anyone under 18. Optional Google analytics operates only with consent and can be disabled.
We honor Global Privacy Control as an opt-out from optional analytics in that browser. You need not create an Account to email a request.
You may use an authorized agent, appeal a denial where state law provides, and will not be discriminated against for exercising rights.

Send a request or appeal to legal@anset.ai. We may proportionately verify identity and authority. We respond within applicable limits, usually 45 days. Statutory rights apply where the law covers the Provider, but we aim to honor requests more broadly.

13. Rights of UK Residents (UK GDPR)

If you are a UK resident, you have equivalent rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Your rights include access, rectification, erasure, restriction, portability, and objection, as described in Section 11.

For complaints regarding the processing of your data, you may contact the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/

14. Children

The Service is not directed to anyone under 18. We do not knowingly collect children's data. A parent or guardian may report such data at legal@anset.ai; after verification we will act to delete it.

You must not upload materials depicting children or use the Service to create, modify, or publish children's likenesses unless we expressly provide a feature intended for that case and provide separate terms. If we receive credible information that material contains a child's data processed without the required lawful basis, we may block or delete it.

15. Data Security

We implement technical and organizational measures to protect your personal data, including:

Encryption in transit using TLS 1.2+ for all communications
Encryption at rest for database storage
Row-level security (RLS) policies ensuring data isolation between users at the database level
Password hashing using industry-standard algorithms (handled by Supabase Auth)
JWT-based authentication and session cookies with security attributes appropriate to the deployment
Logging of security events and operations requiring an audit trail, as configured in the production environment
Rate limiting and abuse detection to prevent unauthorized access
Regular security reviews and dependency updates

Despite these measures, no method of electronic transmission or storage is 100% secure. Where required by Articles 33 and 34 GDPR, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a breach; affected individuals will be informed without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

16. Right to Lodge a Complaint

If you believe that our processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with a supervisory authority:

Poland: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl/
United Kingdom: Information Commissioner's Office (ICO), https://ico.org.uk/

You may lodge a complaint with the supervisory authority in the EU/EEA Member State of your habitual residence, place of work, or place of the alleged infringement.

17. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or an in-Service notification at least 14 days before the effective date.

The current Privacy Policy is always available at the localized /pl/legal/privacy or /en/legal/privacy route.

18. Contact

For all privacy-related inquiries:

Email: legal@anset.ai

Legal matters: legal@anset.ai

Postal address: ConsultIT Michał Giernatowski, ul. Alpaki 20, 05-506 Lesznowola, Polska

Privacy Policy

Version 2026-08-10 - effective August 10, 2026

This document is a translation of the legally binding Polish version. In case of discrepancies, the Polish version shall prevail.

1. Data Controller

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR), the Polish Act on Personal Data Protection of 10 May 2018, and other applicable data protection legislation.

2. Data Protection Contact Point

For all matters relating to the processing of your personal data and the exercise of your rights, please contact us at:

Email: legal@anset.ai

Postal address: ConsultIT Michał Giernatowski, ul. Alpaki 20, 05-506 Lesznowola, Polska

3. Categories of Personal Data

We collect and process the following categories of personal data:

Account Data: Email address, display name, first name, company name (optional), account type (individual/business), role/profession, language preference, onboarding status.
Authentication Data: Password hash (we never store plaintext passwords), OAuth provider information (if you sign in via Google), session tokens.
Payment and Billing Data: Stripe customer ID, Subscription tier and status, billing period dates, purchased Credit Pack records, transaction amount, currency and date and, where required for settlement or invoicing, name or business name, billing address, country, email address, customer status and tax identification number. We may also process invoice, correction and KSeF document numbers and statuses. Full payment-card credentials are collected and processed by Stripe and are not stored on our servers.
User Content: Materials uploaded in the Service, including product photos and reference materials, scenes, brand assets, logos, descriptions, prompts, generation parameters, brand kits, campaign data, and generated images. Materials may contain the likeness or other personal data of third parties, for example where a person is visible in a product photo, scene, packaging, or background. We do not request special-category or sensitive data and you should not upload it unless we expressly provide a feature intended for such processing and enter into separate terms.
Usage Data: Generation history, credit transactions (amount, type, timestamp), feature usage patterns, API request logs.
Technical Data: IP address, browser type and version, device type, operating system, referring URL. Collected via server logs and, with your consent, via analytics cookies.
Analytics Data (with consent): Pseudonymous online identifiers, page views and feature events. Google Analytics 4 loads only after consent; we do not describe these data as anonymous.
Security and Moderation Data: Results of automated or manual classification of prompts, images, and assets, information about blocks, appeals, Terms violations, abuse signals, audit logs, and technical event identifiers.

4. Purposes and Legal Basis for Processing

We process your personal data for the following purposes:

Providing the Service (account creation, AI image generation, asset management) — Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Processing payments, managing Subscriptions and Credits — Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Communicating with you about your Account, transactions, and Service changes — Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Ensuring security, preventing fraud, and abuse detection — Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Our legitimate interest is the protection of the Service and our Users.
Improving the Service, fixing bugs, optimizing performance — Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Our legitimate interest is continuous improvement of the Service.
Enforcing our Terms of Service and Acceptable Use policy, content moderation — Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Reviewing User Content, prompts, assets, and outputs for safety, abuse, third-party rights, personality rights, prohibited content, and AI requirements — Legal basis: legitimate interest (Art. 6(1)(f) GDPR), consisting of protecting the Service, Users, third parties, and the Provider from abuse and claims.
Handling reports, appeals against blocks, complaints, and establishing, exercising, or defending legal claims — Legal basis: legitimate interest (Art. 6(1)(f) GDPR) or legal obligation (Art. 6(1)(c) GDPR), depending on the situation.
Analytics and usage statistics (Google Analytics 4) — Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time via the cookie consent banner.
Issuing and correcting billing documents, maintaining tax and accounting records, and fulfilling tax and reporting obligations — Legal basis: legal obligation (Art. 6(1)(c) GDPR), in accordance with applicable tax and accounting laws.
Responding to lawful requests from public authorities — Legal basis: legal obligation (Art. 6(1)(c) GDPR).

5. Payment Data and Stripe

When you make a payment, your credit card details are transmitted directly to Stripe via their secure SDK. We never receive, process, or store your full credit card number.

Stripe's privacy policy: https://stripe.com/privacy

6. AI Processing of Your Content

Text prompts, descriptions, instructions, generation parameters, and quality settings
Uploaded reference images, product photos, scenes, brand assets, and other files used in generation or analysis
Brand kit data, campaign descriptions, briefs, target audiences, and marketing context where used by a feature
Generated images, variants, layouts, text, quality assessments, and technical job metadata
Safety and moderation signals needed to perform the task, prevent abuse, and enforce the Terms

If an image contains a person, product, trademark, or other third-party data, it may be processed to the extent necessary to perform the task and ensure safety.

Provider terms may differ depending on product, region, and feature. Reference links: https://cloud.google.com/terms/service-terms and https://ai.google.dev/gemini-api/terms.

7. Data Recipients and Service Providers

Google Cloud Platform: Google Cloud / Google AI (Google LLC and the applicable Google entity) — AI models, generation infrastructure, image analysis, Google OAuth, Google Fonts, or other Google functions enabled in the Service. Data: prompts, images, outputs, generation parameters, technical metadata, Google account identifier for OAuth, and IP address and headers when Google resources are loaded, if the function is used.
Stripe: Applicable Stripe group entity — payment processing, fraud prevention and subscription management. Data: email, payment method, billing address and transaction history. Stripe may act as an independent controller for some legal, compliance and fraud-prevention activities.
Supabase: Supabase, Inc. (USA, database in the configured EU region) — database and authentication. Data: Account, session and application records. User files are stored in Cloudflare R2, not Supabase Storage.
Vercel: Vercel, Inc. (USA) — frontend hosting and CDN. Data: IP address, headers, requested URL and technical logs retained under service configuration and terms.
Sentry: Sentry (Functional Software, Inc., USA) — Error monitoring and performance tracking (production only). Data processed: error stack traces, request metadata. Sensitive data (auth tokens, API keys) is filtered before transmission.
Cloudflare R2: Cloudflare, Inc. (USA) — Cloud storage for user assets and generated images (if R2 storage backend is enabled). Data processed: uploaded files, generated images.
Google Analytics: Google LLC (USA) — Google Analytics 4 only with consent. Data: online identifiers, device data, approximate location, pages and events. We do not use advertising features.
Security, moderation, observability, and infrastructure providers — to the extent necessary to detect errors, abuse, attacks, Terms violations, and security incidents.
Providers of accounting, tax, audit and legal services acting for us — only to the extent necessary to handle settlements, meet legal obligations, conduct audits, or establish, pursue or defend claims.
Public authorities and other authorized recipients — where disclosure is required by applicable law or a legally binding request.

We do not sell data for money. If U.S. state law treats analytics disclosure to Google as a sale, sharing or targeted advertising, you can opt out through cookie settings or Global Privacy Control.

8. International Data Transfers

Some recipients may process personal data outside the European Economic Area (EEA). Where required, we use an applicable transfer mechanism, including:

An adequacy decision, including the EU-U.S. Data Privacy Framework where the relevant U.S. recipient is actively certified and the transfer is covered.
European Commission Standard Contractual Clauses (SCCs), with a transfer assessment and supplementary measures where appropriate, when no adequacy decision covers the transfer.

You may request information about the specific safeguards applied to transfers of your data by contacting legal@anset.ai.

9. Data Retention Periods

We retain your personal data for the following periods:

Account data — for the agreement term; after a deletion request the Account is blocked and active-system data is erased without undue delay, subject to legal exceptions and backup cycles.
User content — for the Account term or until earlier deletion. Download needed files before deleting the Account; deletion is not a data-recovery feature.
Generation job records (prompts, parameters, results) — for the duration of your Account. Part of your generation history feature.
Tax, accounting and payment records — for the period required by applicable law. Data needed to establish, pursue or defend claims is retained until the relevant limitation periods expire, taking account of any suspension or interruption.
Audit logs (API requests, security events) — 90 days for standard logs, 365 days for security incidents and financial operations.
Google Analytics data — up to 14 months in the property setting; cookies may last for periods in the Cookie Policy unless you withdraw consent earlier.
Stripe webhook event IDs — 365 days (for idempotency and dispute resolution). Webhook payloads are not stored.
Blocked content or content marked for review — for the time needed to verify it, handle an appeal, prevent abuse, enforce the Terms, and establish, exercise, or defend legal claims; after that period it is deleted or anonymised unless law requires longer retention.

After the applicable period, data is deleted or irreversibly anonymized under active-system schedules and backup cycles. You may request earlier deletion, subject to legal exceptions.

10. Profiling and Automated Decision-Making

The Service employs the following automated processing activities:

Rate limiting — automated restriction of API requests per user and IP address to prevent abuse. This is based on your subscription tier and does not constitute profiling under Art. 22 GDPR.
Content moderation — automated or manual scanning of prompts, images, assets, and outputs for prohibited content, abuse, presence of persons, faces, nudity, documents, risk signals, and Terms violations. Flagged content may be blocked, sent for review, or excluded from generation. You may contest a block by contacting legal@anset.ai.
Credit consumption — automated deduction of Credits based on generation parameters. Fully transparent, with cost displayed before each generation.

11. Your Rights Under GDPR

Under GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15) — You may request a copy of personal data we process about you. The automated export feature in Account settings, where available, may include only part of the data; we will fulfil a complete access request after contact at legal@anset.ai to the extent required by law.
Right to rectification (Art. 16) — You may request correction of inaccurate personal data or completion of incomplete data.
Right to erasure (Art. 17) — You may request deletion of your personal data. This right may be limited where retention is required by law (e.g., financial records).
Right to restriction of processing (Art. 18) — You may request that we limit processing of your data in certain circumstances (e.g., while we verify accuracy).
Right to data portability (Art. 20) — You may request to receive data you provided to us and that we process based on contract or consent in a structured, commonly used, machine-readable format, to the extent required by law. Use the export feature or contact legal@anset.ai.
Right to object (Art. 21) — You may object to processing based on our legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
Right to withdraw consent (Art. 7(3)) — Where processing is based on consent (analytics cookies), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

Exercising your rights is free of charge. In cases of manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse to act.

12. United States State Privacy Rights

Where your state law applies, including the CCPA/CPRA, you may have rights to know and access data, correct it, delete it, obtain a copy, and learn categories of recipients.

You may opt out of sale, cross-context behavioral advertising sharing, targeted advertising and certain profiling to the extent defined by applicable law.
We do not sell data for money or knowingly process data of anyone under 18. Optional Google analytics operates only with consent and can be disabled.
We honor Global Privacy Control as an opt-out from optional analytics in that browser. You need not create an Account to email a request.
You may use an authorized agent, appeal a denial where state law provides, and will not be discriminated against for exercising rights.

13. Rights of UK Residents (UK GDPR)

For complaints regarding the processing of your data, you may contact the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/

14. Children

The Service is not directed to anyone under 18. We do not knowingly collect children's data. A parent or guardian may report such data at legal@anset.ai; after verification we will act to delete it.

15. Data Security

We implement technical and organizational measures to protect your personal data, including:

Encryption in transit using TLS 1.2+ for all communications
Encryption at rest for database storage
Row-level security (RLS) policies ensuring data isolation between users at the database level
Password hashing using industry-standard algorithms (handled by Supabase Auth)
JWT-based authentication and session cookies with security attributes appropriate to the deployment
Logging of security events and operations requiring an audit trail, as configured in the production environment
Rate limiting and abuse detection to prevent unauthorized access
Regular security reviews and dependency updates

16. Right to Lodge a Complaint

If you believe that our processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with a supervisory authority:

Poland: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl/
United Kingdom: Information Commissioner's Office (ICO), https://ico.org.uk/

You may lodge a complaint with the supervisory authority in the EU/EEA Member State of your habitual residence, place of work, or place of the alleged infringement.

17. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or an in-Service notification at least 14 days before the effective date.

The current Privacy Policy is always available at the localized /pl/legal/privacy or /en/legal/privacy route.

18. Contact

For all privacy-related inquiries:

Email: legal@anset.ai

Legal matters: legal@anset.ai

Postal address: ConsultIT Michał Giernatowski, ul. Alpaki 20, 05-506 Lesznowola, Polska