Privacy Policy

This Privacy Policy explains how the Imgraft team ("we", "us") processes personal data when you use Imgraft (the "Service"). Questions and requests can be sent to support@imgraft.com.

Information we collect

• Account data: name, email address, password hash or sign-in provider identifier, and account settings.
• Payment data: plan, order, subscription and invoice records. Card details are handled by our payment processors; we never receive or store full card numbers.
• Content you submit: task inputs, generated results, uploaded files and support tickets.
• Technical data: IP address, browser and device information, security logs and usage events needed to operate and protect the Service.

How we use information

We use personal data to create and secure your account, deliver the features you request, process payments and credits, provide support, prevent fraud and abuse, comply with legal obligations, and improve the Service. Where consent is required, optional analytics and advertising run only after you allow them.

Service providers

We share the minimum data necessary with providers that process it on our behalf:

• Cloudflare — DNS, CDN, security, email routing and private image storage (R2)
• Tencent Cloud — Application servers and database hosting (United States)
• APIMart — Image generation and image-to-prompt descriptions through third-party AI models
• Waffo Pancake — Payment processing, fraud prevention and tax handling as Merchant of Record
• pvuv.ai — Website usage statistics, loaded only after you allow analytics in the privacy banner
• Google Analytics — Website usage statistics, loaded only after you allow analytics in the privacy banner

Providers may process data outside your country under appropriate safeguards. We do not sell personal data.

Image processing

Your source picture and prompt are sent to OpenAI for safety review and to APIMart, which forwards generation to third-party model providers. Generated images are also sent to OpenAI for safety review. We use private object storage and short-lived signed links to deliver images. Imgraft does not use your pictures to train AI models. Upstream providers process requests under their own terms; see the AI Usage Policy.

An anonymous session requires no email address from you. Its session cookie records your allowance. Recent image history is kept in this browser, limited to the latest 20 entries. Clearing browser storage removes that local list but does not delete accounting or security records.

Security controls use IP-based limits and a session or device limit key to prevent repeated free requests. The device limit key is a hash of browser, language, display and time-zone signals; the raw signals are not stored by Imgraft for this check. We do not use those keys for advertising profiles. Cloudflare Turnstile processes security signals for bot prevention.

Retention

Anonymous original uploads and generated results are deleted after 24 hours. Signed-in originals and results are deleted after seven days. Download anything you want to keep before it expires. Browser history can contain an expired image reference after the file is deleted.

We keep account data while your account is active. After you delete your account, we remove or anonymize personal data within 7 days, except records we must keep for tax, accounting, fraud-prevention or legal reasons.

Your rights

Depending on where you live, you may request access to, correction, deletion, restriction or portability of your personal data, object to processing, or withdraw consent at any time. Email support@imgraft.com and we will respond within the period required by law. You may also lodge a complaint with your local data protection authority.

Security

We use access controls, encryption in transit, encrypted secrets at rest, signed payment webhooks and audit logging. No online service can be guaranteed completely secure.

Account agreement records

When you create an account, we record your age confirmation, the Terms of Service and Privacy Policy versions you accepted, the server-recorded acceptance time and the registration method in your account metadata. We use this record to document your agreement. We do not collect your date of birth for this confirmation.

Children

The Service is only for people aged 18 or older and is not directed to anyone younger, including children under 13. We do not knowingly collect personal data from anyone under 18. If we learn that someone under 18 has an account or has provided personal data, we will delete the account and their personal data. To report this, email support@imgraft.com. These safeguards address children’s privacy under the Children’s Online Privacy Protection Act (COPPA).

Changes

We will post updates on this page and change the date above. Material changes will be communicated by email or in the product.