Scope and who is responsible
This Privacy Policy explains how CamArt AI (camart.ai) (“CamArt AI,” “CamArt,” “we,” “us,” or “our”) handles personal data when you visit our websites, create an account, use our AI image or video features, publish content, purchase credits or subscriptions, contact us, or otherwise interact with our services (collectively, the “Services”).
CamArt AI is the controller or business responsible for the personal data described in this Policy, except where a third party acts as an independent controller under its own privacy notice. You can contact us at contact@camart.ai.
This Policy does not govern third-party websites or services that you access independently, including Google, Stripe, model providers, or links from the Services. Their own terms and privacy notices apply to their processing.
Our core privacy commitments
- We collect and use data for defined product, security, payment, support, legal, and safety purposes.
- Your uploads, prompts, and generations are private by default. They become public only when you take an affirmative publishing action.
- We do not sell personal data. We do not share personal data for cross-context behavioral advertising or use it for targeted advertising.
- We use essential cookies and product analytics, including session playback through Microsoft Clarity. We do not use advertising pixels.
- AI generation and safety features require third-party processing. Those providers may have their own data practices, as explained below.
Personal data we collect
| Category | Examples | How we receive it |
|---|---|---|
| Account and identity | Account identifier, email address, Google profile details made available through OAuth when you use Google sign-in, display name, avatar, plan, role, and account creation date. | From you when you sign in with an email link, and from Google when you choose Google sign-in. |
| Prompts and creative inputs | Text prompts, negative prompts, uploaded images, future audio or video inputs, reference files, dimensions, seeds, strength values, and other generation settings. | From you when you create, upload, edit, or recreate content. |
| Generated content and task data | Images, videos, previews, provider task identifiers, model selected, task status, timestamps, safety outcomes, error details, and estimated or actual credit cost. | Created through your use of the Services and returned by generation providers. |
| Assets and community data | Boards, board names, likes, saved items, publish requests, public prompts and parameters, author display information, reports, and appeals. | From your actions in the Services. |
| Payment and subscription data | Stripe customer and subscription identifiers, product and price, billing status, invoices, payment events, credit grants, credit use, refunds, and transaction history. | From you, Stripe, and our payment workflows. CamArt AI does not receive full payment-card numbers. |
| Device, network, and usage data | IP address, browser and device type, operating system, language, referring page, pages or features used, timestamps, session signals, request identifiers, and security events. | Automatically from your browser, Cloudflare, server logs, and any first-party analytics we enable. |
| Communications | Your email address, message content, attachments, support history, privacy requests, feedback, and complaint records. | From you when you contact us. |
| Safety and integrity data | Automated safety scores, moderation categories, policy flags, review decisions, reports, enforcement history, fraud indicators, and evidence reasonably needed to investigate misuse. | From your use, reporters, moderators, security systems, and third-party safety providers. |
Data stored on your device
We may use browser session storage to preserve an unfinished prompt and settings while you complete sign-in or recover from a temporary interruption. Some shareable Studio settings may appear in a page URL or browser history. Do not place confidential, highly sensitive, or third-party personal information in a prompt or shareable URL.
Sensitive data
We do not ask for government identifiers, financial account credentials, health records, or biometric templates. User-provided creative content may nevertheless reveal faces, voices, health, beliefs, ethnicity, sexual orientation, or other sensitive characteristics. Submit such data only when you have a lawful basis and it is necessary for your requested creation. CamArt AI does not perform face recognition or create biometric identity templates.
Where personal data comes from
- Directly from you, including prompts, uploads, purchases, publishing choices, reports, and communications.
- From connected services, such as Google for sign-in and Stripe for billing.
- From generation and safety providers, including outputs, task states, technical metadata, and moderation results.
- Automatically through the Services, including network, device, log, security, and usage events.
- From other users or lawful third parties, for example when someone reports content or submits a rights complaint.
How and why we use personal data
| Purpose | What we do | EEA/UK legal basis |
|---|---|---|
| Provide the Services | Authenticate accounts; receive prompts and uploads; create, store, display, and deliver generations; maintain libraries; calculate and restore credits. | Performance of our contract with you. |
| Process purchases | Create checkout sessions; administer subscriptions; record transactions; prevent duplicate fulfillment; handle refunds and billing questions. | Contract; legal obligations; legitimate interests in accurate accounting. |
| Safety and moderation | Screen prompts and, where configured, uploaded inputs, outputs, and public submissions; investigate reports; enforce our policies; provide appeals; protect people and the Services. | Legitimate interests; contract enforcement; legal obligations; substantial public interest where applicable. |
| Security and abuse prevention | Detect automated abuse, fraud, account compromise, evasion, malicious files, network attacks, and misuse of free or paid credits. | Legitimate interests in protecting users, our Services, and our business; legal obligations. |
| Operate and improve the product | Debug failures; measure feature performance; understand aggregate product usage; improve reliability, accessibility, and user experience. | Legitimate interests. We do not use your content to train CamArt AI models. |
| Communicate | Send service, security, billing, policy, and support communications; respond to requests and complaints. | Contract; legitimate interests; legal obligations; consent for optional marketing, if introduced. |
| Public publishing | Display content you choose to publish; show the display name you choose; let others view or recreate disclosed prompts and parameters. | Your affirmative request and our contract with you; consent where required. |
| Comply with law | Respond to valid legal process; preserve required records; protect rights; report or address illegal content; resolve disputes. | Legal obligations and legitimate interests. |
Where we rely on legitimate interests, we consider the purpose, necessity, and impact on individuals. Where consent is required, you may withdraw it for future processing, although withdrawal does not affect processing already carried out lawfully.
AI providers, moderation, and model training
To perform a request, CamArt AI may transmit your prompt, selected settings, uploaded input, output reference, IP or request metadata, and other technically necessary information to one or more generation or safety providers. These providers may include WaveSpeed, fal.ai, Replicate, underlying model hosts, delivery networks used by those providers, and third-party content moderation services.
When you choose a feature that requires a third-party model, you direct us to send the data needed to provide that feature. Do not submit confidential information, trade secrets, regulated data, or personal data that you are not authorized to share. Where local law requires separate notice or consent for a transfer or an independent provider’s processing, we will present it before the relevant processing.
Automated moderation may make mistakes. A blocked prompt or upload does not necessarily mean that you acted unlawfully. You may request review at contact@camart.ai.
Private and public content
Creative inputs and outputs are private by default. CamArt AI does not intentionally place them in Inspiration or other public areas unless you choose to publish them or otherwise direct us to share them.
If you publish content, the content and associated information you select (such as prompt, model, settings, display name, and creation metadata) may be visible worldwide, copied by others, recreated, indexed by search engines, cached, screenshotted, or shared outside CamArt. Removing a public post will stop future display by us, but it may not remove copies already made by others or retained by search engines and legal archives.
We use public content to operate and display the public feature. Using a published work in paid advertising or external promotional campaigns requires an additional permission unless another agreement with you clearly permits that use.
When we disclose personal data
| Recipient | Purpose and data involved |
|---|---|
| Cloudflare | Website delivery, Workers compute, network security, object storage, queues, logs, media delivery, related infrastructure, and Web Analytics if enabled. May process network data, identifiers, content, stored media, and operational logs. |
| Supabase | Authentication with Google and with one-time email links, delivery of those sign-in emails, session management, database hosting, backups, and application records. May process identity, account, content metadata, task, assets, and billing-reference data. |
| OAuth sign-in, associated identity services, and Google Analytics if enabled. For sign-in, Google receives the information necessary to complete authentication and provides identity data according to your Google settings. Analytics, when enabled, receives usage events such as pages and product actions. | |
| Microsoft | Microsoft Clarity product analytics on camart.ai: pages viewed, clicks, scrolling, device and browser details, approximate location, and session recordings. Text typed into form fields is masked. Not used for advertising. |
| Stripe | Checkout, payment processing, billing, subscriptions, invoices, fraud prevention, refunds, and customer self-service. Stripe independently handles payment-card and billing details under its own terms. |
| WaveSpeed, fal.ai, Replicate, and model hosts | AI generation, task processing, output delivery, troubleshooting, safety, and provider operations. May receive prompts, inputs, settings, outputs, and request metadata. |
| Independent content moderation providers, when configured | Automated or assisted review of prompts, uploads, outputs, public submissions, and reports. If enabled, they may receive the content and contextual identifiers needed for a safety decision. |
| Professional advisers and vendors | Legal, accounting, security, insurance, customer support, and technical services, subject to appropriate confidentiality or data-protection obligations. |
| Authorities and affected parties | When reasonably necessary to comply with law or valid process; address illegal content; protect safety, rights, and property; investigate fraud; or establish, exercise, or defend legal claims. |
| Business transaction participants | In connection with a financing, reorganization, acquisition, sale, or transfer of some or all of our business, subject to confidentiality and applicable law. |
We may disclose aggregated or de-identified information that does not reasonably identify an individual. We do not attempt to re-identify information that we maintain as de-identified except to test whether our de-identification measures work.
International and cross-border transfers
CamArt AI serves users globally. We and our providers may process personal data in the United States and other countries where they operate. Those countries may have privacy laws that differ from the laws where you live.
Before making a restricted transfer that requires a transfer mechanism, we will put an applicable mechanism in place. Depending on the transfer, that mechanism may include an adequacy decision, European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, vendor data-protection terms, security measures, or a supplementary transfer assessment.
For Japan and South Korea, relevant data may be transferred electronically when you sign in, purchase, generate, upload, request moderation, or contact us. Before a transfer for which APPI or PIPA requires a specific notice or consent, we will provide the required details at or before transfer. Depending on the law, those details may include the recipient, destination country, data items, purpose, timing and method, retention criteria, safeguards, and the effect of refusing consent. The high-level vendor list above does not replace a more specific transfer notice where one is legally required.
How long we keep personal data
We do not apply one fixed retention period to every category of personal data. We retain data only for as long as reasonably necessary for the purpose for which it was collected, including to provide your account and creative Assets, fulfill purchases, keep transaction and credit records accurate, maintain security, resolve disputes, enforce agreements, meet legal obligations, and protect people from misuse.
The criteria we use include whether your account remains active; whether you have chosen to keep or publish content; whether a task, payment, report, or dispute remains open; the sensitivity and volume of the data; security and abuse risks; applicable limitation periods; tax, accounting, consumer-protection, and recordkeeping rules; and provider, backup, cache, and disaster-recovery cycles.
| Data category | Retention criteria |
|---|---|
| Account and profile | While the account is active and for the period reasonably needed to complete closure, prevent unauthorized reactivation, resolve requests, and meet legal obligations. |
| Private prompts, inputs, outputs, and task history | While needed to provide the task history or Assets collection you request, until you delete the item, close the account, or the account is inactive and we remove stored Assets as described in the Terms of Service, or longer when an open safety, payment, dispute, or legal issue requires preservation. |
| Public content | Until you unpublish or request deletion, subject to moderation evidence, legal holds, search-engine caches, archives, and copies made independently by others. |
| Payments, subscriptions, and credit ledger | For the applicable accounting, tax, fraud, chargeback, consumer-protection, audit, and limitation periods, and while a balance or dispute remains open. |
| Safety, moderation, and security records | While reasonably needed for review or appeal, repeat-abuse prevention, system security, rights protection, legal reporting, disputes, or claims. |
| Support and legal communications | While the request remains open and afterward as reasonably needed to document the response, manage follow-up, or establish and defend legal rights. |
When data is no longer needed, we delete it, de-identify it, or place it beyond ordinary use until deletion is completed. Deletion from active systems may not immediately remove data from backups, provider systems, immutable transaction ledgers, security evidence, public copies made by others, or records we must preserve by law.
Third-party providers determine retention under their own terms and configurations. Their retention may continue after CamArt AI no longer needs the data, and we cannot guarantee a provider’s deletion schedule.
Security and incident response
We use technical and organizational measures designed to protect personal data, including encrypted network transport, access controls, private media storage, authenticated media access, database row-level restrictions, request validation, file type and size controls, trusted output-source restrictions, rate and abuse controls, secrets management, error redaction, and audit or operational logging.
No service can guarantee absolute security. You are responsible for maintaining control of your Google account, your mailbox, and your devices, reviewing links before sharing them, and contacting us promptly if you suspect unauthorized use.
If a personal-data incident creates a notification obligation, we will notify affected individuals and relevant authorities as required by applicable law.
Your privacy choices and rights
Depending on where you live, you may have the right to request access to or a copy of your personal data; correction; deletion; restriction or cessation of processing; portability; objection; withdrawal of consent; information about disclosures or international transfers; and review of certain automated decisions. You may also have the right to complain to a privacy or consumer-protection authority.
- Use available account or content controls where the relevant feature is provided.
- For other requests, email contact@camart.ai and identify the right you wish to exercise.
- We may ask for information reasonably necessary to verify your identity and authority. We will not request more verification data than the circumstances require.
- An authorized agent may submit a request where local law permits. We may verify the agent’s authority and your identity.
- We will respond within the period required by applicable law and explain any lawful reason for denying or limiting a request.
- We will not discriminate against you for exercising a privacy right.
Some rights are subject to exceptions, including where information is needed to complete a transaction, protect security, preserve freedom of expression, comply with law, or establish and defend legal claims.
Regional privacy notices
United States, including California and other state laws
Where an applicable state privacy law covers CamArt AI, residents may request to know, access, correct, delete, or obtain a portable copy of covered personal data and may appeal certain decisions. State law may also provide rights to opt out of sale, sharing, targeted advertising, or certain profiling, and to limit some uses of sensitive personal data. CamArt AI does not sell personal data, share it for cross-context behavioral advertising, or process it for targeted advertising. We use sensitive data only to provide requested features, maintain safety, and meet legal obligations.
EEA, United Kingdom, and Switzerland
Individuals in these regions may have rights of access, correction, erasure, restriction, portability, objection, and withdrawal of consent. You may object to processing based on legitimate interests, and you may lodge a complaint with the supervisory authority where you live or work or where an alleged violation occurred. Our legal bases are described in Section 5, and our transfer safeguards are described in Section 10.
Japan
Where Japan’s Act on the Protection of Personal Information applies, you may request notification of purpose, disclosure of retained personal data or third-party provision records, correction, addition, deletion, suspension of use, erasure, or suspension of third-party provision, subject to statutory conditions. Contact us to request information reasonably available about safeguards for a relevant foreign transfer.
South Korea
Where South Korea’s Personal Information Protection Act applies, you may request access, correction, deletion, suspension of processing, or withdrawal of consent, and may withdraw membership through available account controls or by contacting us. CamArt AI’s privacy contact for requests and complaints is the CamArt AI Privacy Team at contact@camart.ai. Cross-border service providers and transfer purposes are described in Sections 6, 9, and 10. Where a separate consent or domestic representative is legally required, we will provide the required notice or representative details.
Automated moderation and meaningful decisions
We use automated systems to screen content, detect abuse, assess technical risk, route tasks, and enforce credit or security rules. These systems may block a generation, flag content, limit an action, or recommend account review.
We do not intend to use automated processing to make decisions that produce legal or similarly significant effects about employment, credit, housing, education, insurance, or other high-impact eligibility. Where you believe an automated safety or account decision was incorrect, request human review at contact@camart.ai.
Age requirement and children’s data
The Services are for people who are at least 18 years old and have reached the age of legal majority where they live. We do not knowingly allow children to create accounts or purchase the Services.
An adult may submit an ordinary family image containing a child only when the adult is the parent, legal guardian, or otherwise has lawful authority and the use is safe, respectful, and permitted by our Content Policy. Sexualized, exploitative, abusive, or deceptive content involving minors or young-looking persons is strictly prohibited.
If you believe a child has created an account or provided personal data without lawful authorization, contact us so we can investigate and take appropriate action.
Changes to this Policy
We may update this Policy as the Services, providers, laws, or our practices change. We will post the updated version with a revised “Last updated” date. If a change materially affects your rights or how we use personal data, we will provide additional notice where required, such as through the Services or by email.
Earlier versions may be retained for legal, transparency, and recordkeeping purposes.
Contact and complaints
For privacy questions, rights requests, complaints, appeals, or concerns about a third-party provider, contact:
You may also contact the privacy or consumer-protection authority with jurisdiction where you live. We encourage you to contact us first so we have an opportunity to address your concern.