1. Scope and Controller
This Privacy Policy applies to the gptimage2-5.art website and the image generation, image editing, account, credit, and paid features GPTImage 2.5 makes available through it. The website operator controls the personal information described in this Policy. In this Policy, "GPTImage 2.5," "we," "us," and "our" refer to that operator. Our Terms of Service also govern your use of the Service.
GPTImage 2.5 is an independent product. It is not an OpenAI product and is not affiliated with, endorsed by, sponsored by, or officially partnered with OpenAI. Some features use third-party AI and infrastructure services, as described below.
2. Information We Collect
Depending on the features you use, we may process the following information.
- Account and authentication information: name, email address, profile image, account identifiers, email verification status, login method, and session or OAuth information needed to maintain login and account security.
- AI content: prompts, reference images, other materials you choose to submit, and images generated or edited by the Service.
- Generation records: selected model, generation mode, resolution, aspect ratio, background setting, task status, generation time, error information, provider task identifiers, and related file URLs.
- Transaction and credit information: subscription plan, order number, payment and renewal status, credit balance, credit issuance and usage, refunds, and billing errors. The payment provider identified at checkout generally collects full card details directly. We do not store full card numbers in our own database.
- Device and log information: IP address, browser and device type, operating system, language, user agent, access time, request records, pages visited, referring page, errors, and security events. We may also derive an approximate region from your IP address.
- Communications: support requests, privacy requests, feedback, email content, and related handling records.
Prompts and images may contain personal information about you or others. Do not submit identity documents, financial information, medical records, intimate images, or other sensitive information that is not necessary for a generation request. Before submitting content depicting an identifiable person, make sure you have the necessary rights and consent.
3. How We Collect Information
We obtain information:
- Directly from you when you create an account, upload a file, enter a prompt, make a payment, or contact us.
- Automatically from your browser, server requests, cookies, local storage, and security logs when you use the website.
- From Google when you choose Google sign-in, according to the permissions you grant.
- From payment, email, AI, hosting, analytics, and other providers when they return information needed to complete a transaction, request, or security check.
4. How We Use Information
We use information to:
- Create accounts, authenticate users, maintain sessions, and provide support.
- Receive prompts and reference images, call AI services, deliver results, and maintain generation history.
- Manage subscriptions, orders, refunds, credits, and the customer portal.
- Send login, security, transaction, service-change, and other necessary notices.
- Monitor performance, fix errors, and analyze aggregated usage trends.
- Improve the product experience.
- Prevent fraud, abuse, unauthorized access, and violations of our Terms.
- Meet legal, tax, accounting, regulatory, and dispute-resolution obligations.
- Process information with your consent or as otherwise permitted by law.
5. AI Inputs and Outputs
When you submit an image generation or editing request, we send information to third-party AI generation and model-infrastructure providers acting on our behalf. This information includes your prompts, reference images, selected settings, callback information, and limited technical identifiers. These providers process the information to generate and return the requested results. We record task status and results in our database. We may also copy results to object storage used by the Service. Providers may retain necessary technical logs or content under their agreements with us and applicable law.
We do not currently use your prompts, reference images, or generated results to train models operated by GPTImage 2.5. We do not intentionally opt in to third-party model training that is unrelated to completing your request. If this practice changes, we will update this Policy before the change and obtain consent where required by applicable law.
Public policies for third-party AI APIs may not fully describe the retention or training treatment of API content. Do not submit highly confidential or strictly regulated content unless we separately provide you with written data-processing commitments.
6. Storage and Content Visibility
Reference images and generated results may be stored in object storage used by the Service. Some files are currently delivered through hard-to-guess but directly accessible URLs. We do not list those files in a public gallery by default, but anyone who obtains the exact URL may be able to access the file. Do not treat the current Service as end-to-end encrypted storage or as suitable for highly confidential material.
If a plan is described as providing "private generations," this means that we do not intentionally publish its generations to a public showcase. Unless the purchase page expressly states otherwise, it does not mean end-to-end encryption and does not prevent disclosure to providers needed to complete a request.
7. Cookies and Analytics
We use cookies that are necessary for login, security, and language preferences. We may also use browser local storage for limited interface state, such as the displayed credit balance. Disabling necessary cookies may prevent login or language settings from working correctly.
We enable PostHog, Google Analytics 4, and Vercel Speed Insights only after you select “Allow analytics.” PostHog measures product journeys, funnels, and feature use; Google Analytics 4 measures acquisition and campaign attribution; and Speed Insights measures page performance. We do not send prompt text, image content, filenames, email addresses, names, or payment details to these analytics providers. Events use standardized routes and limited, low-sensitivity properties.
You can choose “Necessary only” on the first-visit panel and may later withdraw or grant consent through “Privacy settings” in the footer. Refusing or withdrawing does not affect generation, account, or payment features. Necessary registration, generation, credit, order, and refund records remain in our business database for contract performance, accounting, security, and troubleshooting, but are not thereby sent to the optional analytics providers above.
8. How We Disclose Information
We do not sell your personal information or use it for cross-site targeted advertising. We may disclose necessary information to the following recipients.
- AI processing providers: providers of AI models and related infrastructure needed for image generation, image editing, content-safety processing, task callbacks, and result delivery.
- Authentication providers: Google when you choose Google sign-in.
- Payment providers: Waffo or another payment, tax, refund, and fraud-prevention provider identified at checkout.
- Email provider: Brevo for account, transaction, lifecycle-offer, and service messages.
- Infrastructure providers: Vercel and providers of database, object-storage, hosting, logging, and security services.
- Optional analytics providers: PostHog, Google Analytics 4, and Vercel Speed Insights after you consent.
- Professional advisers and parties subject to confidentiality in a merger, financing, reorganization, or asset transfer.
- Law-enforcement, regulatory, or other authorities when necessary to comply with legal process or protect users, the public, our rights, safety, or Service integrity.
- Other recipients at your direction or with your separate consent.
Third-party services have their own privacy practices. Policies for services you directly choose or interact with are provided at the relevant point of interaction. You may also contact us for information about providers involved in a specific processing activity. You can review the Google Privacy Policy, and Vercel Privacy Notice. The payment party and policy shown at checkout apply to a specific transaction.
9. Legal Bases
Where the GDPR, UK GDPR, or similar laws apply, we rely on the following legal bases as appropriate.
- Performance of a contract, such as creating an account, generating images, providing a subscription, and processing payment.
- Our legitimate interests, such as protecting the Service, preventing fraud, diagnosing errors, and improving aggregated performance that does not identify an individual.
- Compliance with legal obligations, such as retaining transaction records and responding to valid legal requests.
- Your consent, such as for legally consented cookies, marketing communications, or future optional data uses.
Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal.
New accounts may receive welcome-credit and limited-time offer reminders. Each such email includes an unsubscribe option. We retain the minimum opt-out record needed to stop future lifecycle marketing messages; essential password-reset, payment, and account-service messages may still be sent.
10. Retention and Deletion
We keep information only for as long as needed to provide the Service, fulfill the purposes in this Policy, resolve disputes, and meet legal obligations. The exact period depends on the type of information, account status, content sensitivity, security needs, and applicable tax, accounting, or other legal requirements.
- Login sessions are retained until they expire, you sign out, or they are revoked for security.
- Account information and generation history are generally retained while the account remains active or until you request deletion.
- Failed-task, server, and security logs are generally retained for less time than account records. We may keep them longer during abuse or security investigations.
- Order, credit, refund, and transaction records may remain after account deletion for financial, tax, anti-fraud, and dispute obligations.
- After a deletion request is completed, information may remain temporarily in restricted backups until overwritten through the normal backup cycle.
The Service does not currently provide a complete in-account deletion control. You may use the email below to request deletion of your account, prompts, images, or other personal information. We will verify the request against the account and delete or de-identify the information where legally permitted. Some information cannot be deleted immediately for legal, security, payment, or dispute reasons.
11. International Transfers
We and our providers may process information outside your country or region, including in the United States and other countries where providers operate. Local data-protection laws may differ. Where required, we use appropriate contractual terms, adequacy decisions, or other valid safeguards and limit provider access to what is necessary.
12. Security
We use administrative, technical, and access controls appropriate to the Service, including encryption in transit, authentication, access restrictions, and security monitoring. No internet transmission, third-party API, or electronic storage can be guaranteed completely secure. If a personal-data incident requires notice under applicable law, we will notify affected individuals or authorities as required.
13. Your Rights and Choices
Your privacy rights depend on where you live. You may have the right to know about, access, correct, delete, or receive a copy of your personal information. You may also have the right to restrict or object to certain processing, withdraw consent, and complain about our processing. Applicable law may provide data-portability rights, a right to appeal a denied privacy request, and protection from discrimination for exercising privacy rights.
Email support@gptimage2-5.art with the associated account and your specific request. To prevent unauthorized access or deletion, we may ask you to verify identity through the account email. You may also complain to a data-protection authority with jurisdiction where you live.
14. Children
The Service is intended only for users who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted personal information, contact us and we will take reasonable steps to delete it after verification.
15. Changes and Contact
We may update this Policy when our product, providers, legal obligations, or data practices change. We will give reasonable notice of material changes through the website, your account, or email. We will also state the new effective date at the top of this page. Processing that occurred before a change remains subject to the policy then in effect.
For questions about this Policy, our data practices, or a privacy request, email support@gptimage2-5.art.