Privacy Notice
Last updated: November 4, 2026
This notice describes the information AIShopFlow processes, why it is used and how to contact us. Private creative assets are not automatically published to a public gallery.
01Information we process
Account email, password hashes and login identifiers; identifiers, email and verification status supplied by Google sign-in; product/person images, scripts, prompts and outputs you submit; job status, budget reservations, order/subscription records; and contact requests. Hosting providers may log IP addresses, request times and technical errors. Do not upload card numbers, passwords or unnecessary sensitive information.
02Purposes and legal bases
We use this information to deliver accounts/jobs, enforce asset ownership, reconcile payments, handle requests and prevent abuse. Where applicable, bases include performing the service contract, legal obligations, necessary and balanced security/operational legitimate interests, and consent where required. You choose which optional material to submit.
03Browser storage
Your browser stores language, theme and motion preferences and local drafts in IndexedDB. Password-login tokens are stored locally; Google sign-in uses short-lived cookies with security attributes. Clearing browser data removes local drafts/sign-in state, but does not delete server-side jobs or billing records. This site currently does not integrate advertising trackers.
04Providers and international processing
Vercel hosts the frontend; Render in Singapore hosts the API; Supabase in Singapore stores accounts/jobs; Backblaze B2 in the US East region stores private assets. Google handles sign-in and Paddle handles checkout/billing when enabled. When model jobs are enabled, necessary prompts/references are sent to the configured provider (currently Alibaba Cloud DashScope). No generation job is created on your behalf unless you submit one. This may involve international processing, subject to provider terms and applicable law.
05Asset and payment security
The server verifies account ownership before returning private assets; archived results use object keys rather than public bucket access. Passwords are hashed; we do not store full card details. We do not train our own foundation models on uploads. Provider handling is governed by its applicable policies; this is not a blanket zero-retention promise for all providers.
06Retention and deletion
Accounts/assets are retained to provide history until no longer needed or a verified deletion request is processed. Financial, fraud-prevention, legal obligations and necessary backups may require longer retention. Complete self-service deletion is not yet available; request account/asset deletion or export through the contact page. Clearing a local draft does not undo completed model calls or records providers must retain.
07Your choices and rights
You can avoid Google sign-in, choose not to upload assets or clear local preferences. Depending on your location, you may have rights to access, correct, export, delete, restrict, object or withdraw consent, and complain to a regulator. We verify identity to protect others’ data. Withdrawal does not invalidate prior lawful processing.
08Contact and updates
Use the privacy category on our contact page. This service is not directed to children; contact us about improperly submitted children’s data. Changes will be dated here and new consent requested where required.