Privacy Policy

The data controller for personal data processed through the Service is GogpleAI LLC, a company registered in the State of New Mexico, operating Mediaorchid at mediaorchid.art. Privacy and support requests: support@mediaorchid.art.

This Policy applies to:

• Visitors to our marketing site and logged-in users of the studio, gallery, storytelling, canvas editor, and related features
• Account data created via email/password or Google sign-in
• Content you submit (prompts, uploads, edits) and outputs the Service generates
• Payment and credit-pack transactions processed by our payment provider

It does not apply to third-party websites or models you may link to outside Mediaorchid, which have their own policies.

Account & identity. Email address; password (hashed by our auth provider); display name; username; profile avatar; Google account identifiers and profile fields you authorize (e.g., name, email, profile photo) when you use Google sign-in.

Usage & studio data. Prompts and negative prompts; model selections and generation parameters; uploaded reference or edit images; generated images and videos; gallery visibility settings; remix relationships; credit balances and ledger transactions; support messages you send us.

Payment data. We do not store full card numbers. Stripe processes payments. We receive limited billing metadata (e.g., customer ID, checkout session ID, pack purchased, credit amount) needed to fulfill credit packs and prevent fraud.

Technical data. IP address, device/browser type, approximate location derived from IP, pages viewed, referrers, timestamps, and diagnostic logs. We use cookies and similar technologies for authentication, security, and basic product analytics.

Communications. Emails related to account security, receipts, and service notices. Marketing emails (if any) are optional and can be opted out of where required by law.

• Provide, operate, and improve the Service (generation, editing, storytelling, gallery, remix economy, credits)
• Authenticate users, secure accounts, and prevent abuse, fraud, and rate-limit violations
• Process credit purchases and maintain an accurate credit ledger
• Display public gallery content you choose to publish and enable remix flows
• Communicate service-related messages and respond to support requests
• Comply with law, enforce our Terms, and protect rights, safety, and property
• Analyze aggregated or de-identified usage to improve models, UX, and reliability

Where GDPR/UK GDPR applies, we process personal data on these bases:

• Contract — to provide the Service you request (account, generations, purchases)
• Legitimate interests — security, abuse prevention, product improvement, and communication about the Service, balanced against your rights
• Consent — where required (e.g., certain cookies or optional marketing)
• Legal obligation — where we must retain or disclose information to comply with law

We use trusted processors who process data on our instructions, including:

• Supabase — authentication, database, storage
• Stripe — payment processing
• Vercel — hosting and edge delivery
• Trigger.dev — background job execution for generations and edits
• AI model providers — to run generation and editing jobs; prompts and media you submit may be sent to these providers to fulfill your request
• Upstash — API rate limiting
• Email/infrastructure vendors as needed for transactional mail

Providers may process data in the United States or other countries. Where required, we use appropriate transfer safeguards (such as Standard Contractual Clauses) offered by those providers.

We do not sell your personal information. We may share:

• With processors listed above to operate the Service
• Public gallery content and associated metadata you mark public (prompts may be visible depending on product surfaces)
• With other users as part of remix attribution (e.g., creator identity on remixed works)
• If required by law, subpoena, or to protect rights, safety, or security
• In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality

If you publish generations to the gallery, that content (and related metadata we display) may be visible to other users and the public internet, and may be remixed under our Terms. Do not publish personal data you are not willing to make public. You can manage visibility settings where the product allows; past remixes or caches may persist.

We retain account and studio data while your account is active and for a reasonable period afterward for backups, dispute resolution, fraud prevention, and legal compliance. Credit ledger records and purchase metadata may be kept longer as required for financial and audit purposes. You may request deletion of your account; we will delete or anonymize personal data except where retention is required or permitted by law.

We implement administrative, technical, and organizational measures designed to protect personal data (encryption in transit, access controls, least-privilege service roles, rate limiting). No method of transmission or storage is 100% secure. You are responsible for keeping your credentials confidential.

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to certain processing, and to withdraw consent where processing is consent-based. California residents may have additional rights under the CCPA/CPRA (including the right to know, delete, and correct, and to opt out of “sale” or “sharing” as those terms are defined—Mediaorchid does not sell personal information as commonly understood). To exercise rights, email support@mediaorchid.art. We may verify your identity before fulfilling a request. You may also lodge a complaint with your local supervisory authority.

We use essential cookies for login sessions and security. We may use limited analytics cookies or similar technologies to understand product usage. You can control cookies through your browser settings; disabling essential cookies may break sign-in or core features.

The Service is not directed to children under 16 (or the minimum age required in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.

To fulfill generation and editing requests, prompts, images, and related parameters are processed by Mediaorchid and by third-party AI providers. Do not submit sensitive personal data, confidential business information, or unlawful content in prompts or uploads. Providers’ retention and training practices may differ; where we can configure zero-retention or similar options, we will prefer settings that protect user content, subject to provider capabilities.

We may update this Policy from time to time. We will post the revised version with an updated effective date and, where required, provide additional notice. Continued use after changes become effective constitutes acceptance of the updated Policy.

Privacy inquiries and data-subject requests: support@mediaorchid.art.