Privacy Policy

This Policy applies to the wowoimage website, account, Workspace, Library, billing, support, and related administrative operations. The operator of wowoimage is responsible for the processing described here. The operator's final legal name, address, and applicable representative details must be added during pre-launch legal review.

This Policy does not govern third-party sites or services that you visit directly, including PayPal's hosted checkout. Those parties describe their own processing in their privacy notices.

We collect only the information needed to provide, secure, support, and account for the service:

• Account and preference data, such as username, email address, verification status, password hash, language, theme, role, account status, and administrator MFA records where applicable.
• Creation data, such as your prompt, selected settings, the optimized prompt specification, generation status, generated image, preview, and technical asset metadata.
• Credit and transaction data, such as ledger entries, pack selection, purchase status, timestamps, and limited PayPal references. We do not store a PayPal credential, full card number, or card security code.
• Security and operations data, such as opaque session and request identifiers, user agent, a one-way network hash, timestamps, rate-limit state, audit events, and safe error and performance categories. We do not build a raw-IP history or device fingerprint profile.
• Communications you send to support and transactional email delivery state for verification, password recovery, security, purchase, and retention notices.

We use personal information to:

• create and authenticate accounts, verify email, maintain sessions, and apply your language and theme preferences;
• refine prompts, generate images, create previews, deliver entitled originals, and manage 30-day asset retention;
• reserve, settle, and release Credits and reconcile PayPal purchases, refunds, reversals, and disputes;
• prevent abuse, enforce permissions and rate limits, investigate failures, keep append-only audit evidence, and protect the service; and
• send requested transactional messages, answer support requests, comply with law, and improve reliability using minimized operational data.

Depending on where you live, we process information because it is necessary to perform our agreement with you, pursue legitimate interests in operating and securing the service, comply with legal obligations, or establish and defend legal claims.

Where consent is required, including for any future non-essential browser storage or optional communication, we will ask before processing and allow you to withdraw consent. Withdrawal does not affect earlier lawful processing.

We do not sell your personal information or share it for cross-context behavioral advertising. We disclose only what is reasonably necessary to:

• prompt and image model providers that process your creation request;
• hosting, private object storage, database, queue, monitoring, and infrastructure providers;
• transactional email providers that deliver account and retention messages;
• PayPal for hosted checkout, payment confirmation, refund, reversal, dispute, fraud, and compliance handling; and
• professional advisers, authorities, or a successor organization when required by law, needed to protect rights and safety, or part of a legitimate business transaction subject to appropriate safeguards.

A generation request sends the content needed to refine your prompt to the configured prompt provider and the resulting final prompt and settings to the configured image provider. Provider credentials and raw provider responses are not exposed to the browser. Do not place sensitive personal or confidential information in a prompt unless you have authority and a genuine need to process it.

AI providers may process request data in countries where they operate and under the contractual settings configured for the service. We use separate prompt and image provider boundaries and require providers to return only bounded, validated results, but their independent privacy and retention obligations may also apply.

PayPal collects payment credentials on its own hosted experience. We receive limited order, event, purchase, and status information needed to confirm and account for the transaction. The browser payment-success page cannot grant Credits.

Generated assets, including the private original and watermarked preview, are scheduled for deletion 30 days after creation. We send reminders about seven days and one day before deletion. An owner may request earlier deletion.

Account, generation, Credit, payment, security, support, and audit records are kept only as long as needed for the service, fraud prevention, disputes, accounting, security, and legal obligations. Retention can differ by record type because Credit history and security-relevant audit evidence are append-only business records.

When account deletion is finalized, we remove eligible authentication and personal data, retire pending user-bound deliveries, and anonymize records that must remain. Backups and legally required records may persist for a limited period before secure deletion or isolation.

We use access controls, secure HTTP-only sessions, CSRF protection, rate limits, encryption for provider credentials and sensitive email delivery data, private object storage, short-lived authorized downloads, redacted logs, and audited administrative actions. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

Our service providers may process information outside your country. Where required, we use an approved transfer mechanism and supplementary safeguards appropriate to the information and destination.

You can review account and Library information, change language and theme preferences, revoke sessions, delete individual assets, and request account deletion through the product. You may also ask to access, correct, delete, restrict, or receive a portable copy of personal information, object to certain processing, or withdraw consent where those rights apply.

Contact us from your account email so we can verify the request without exposing data. We may retain or decline part of a request where permitted by law, including to protect another person, complete a transaction, prevent fraud, preserve legal claims, or meet a recordkeeping duty. You may complain to your local data-protection authority.

wowoimage is not intended for children under 18 or under the age of legal majority where they live. We do not knowingly collect a child's personal information. Contact us if you believe a child has provided information so we can investigate and delete it where appropriate.

We may update this Policy when the product, providers, law, or our data practices change. We will update the date above and provide additional notice or request consent when required.

Material new uses of information will not be hidden in a policy update. We will describe them clearly and honor choices required by applicable law.