Privacy Policy

This Privacy Policy explains what personal data Aitemos (aitemos.com) collects, why we collect it, how long we keep it, and what you can ask us to do with it. The controller of that data is [legal entity name, registration number, registered address].

If you have a question or want to exercise any of the rights below, write to nekatikat@gmail.com. We answer within 30 days.

We do not sell or share your personal information for cross-context behavioural advertising, as those terms are used in the CCPA.

Account data: your email address, display name, and profile picture, passed to us by the identity provider you sign in with (Google, Telegram, or Yandex). We do not receive your password.

Content you upload: the product photos you send to the Service, and the images and videos generated from them.

Usage and technical data: IP address, browser and device type, pages viewed, generation history, referral source and UTM parameters, and error logs.

Payment data: the fact, amount, currency, and status of a purchase, passed back to us by our payment provider. Card numbers, CVV codes, and bank credentials never reach our servers.

Support correspondence: the messages you send us and our replies.

To provide the Service - generating images, storing your projects, tracking your credit balance, delivering HD downloads. Legal basis: performance of our contract with you.

To take payment and prevent payment fraud. Legal basis: performance of the contract and our legitimate interest in not being defrauded.

To keep the Service secure and enforce usage limits, including detecting duplicate accounts created to farm free credits. Legal basis: legitimate interest.

To improve the Service using aggregated, de-identified statistics. Legal basis: legitimate interest.

To send you service messages (receipts, changes to these documents). Legal basis: contract and legal obligation. Marketing email, if we ever send any, goes out only with your consent and every message carries an unsubscribe link.

To meet accounting, tax, and other legal obligations. Legal basis: legal obligation.

We use a small number of processors, each with access only to what their job requires, and each bound by a data processing agreement:

Hosting and infrastructure providers - to run the Service and store your files.

AI image generation providers - your uploaded photo and your prompt text are sent to them to produce the result. They process it to fulfil that request.

Payment provider lava.top - to take payment and issue receipts. It acts as an independent controller for the payment data it collects directly from you.

Hosting and infrastructure providers - our servers are operated in Russia, so account and generation data is stored there.

We also disclose data where the law requires it, or where it is necessary to establish, exercise, or defend legal claims. If our business is ever sold or merged, your data may transfer to the buyer, who would remain bound by this Policy.

Our servers and some of our providers are located outside the European Economic Area, including in Russia, which is not covered by an EU adequacy decision. For those transfers we rely on Standard Contractual Clauses or, where they apply, on Article 49 GDPR derogations - in particular a transfer that is necessary to perform the contract you entered into with us when you created an account.

You can ask us for details of the transfer safeguards that apply to your account by writing to nekatikat@gmail.com.

We use strictly necessary cookies to keep you signed in, to enforce the free-generation allowance for visitors who have not registered yet, to run the referral programme, and to remember your language.

We do not run analytics cookies, session recording or advertising trackers on the English version of the site. You can block or delete cookies in your browser settings, but signing in and tracking your credit balance will not work without the necessary ones.

Account data: for as long as your account is open, then deleted or de-identified after closure.

Uploaded photos and generated images: while your account is open, so you can return to your projects. When you delete a project or your account, the associated files are removed from active storage and purged from backups within 30 days.

Payment records: for as long as tax and accounting law requires us to keep them, typically several years, even after you close your account.

Server logs: normally up to 12 months, longer only where a specific security incident is being investigated.

Depending on where you live, you have some or all of the following rights: to access the data we hold about you; to correct it; to delete it; to restrict or object to certain processing; to receive a copy in a portable format; and to withdraw consent where processing is based on consent.

Under the CCPA, California residents additionally have the right to know what categories of personal information we collect and disclose, the right to delete, the right to correct, and the right not to be discriminated against for exercising those rights.

You can delete your account and its data yourself from your profile page. For anything else, email nekatikat@gmail.com from the address on your account.

If you are in the EEA or the UK and you believe we have handled your data badly, you can complain to your local data protection authority. We would rather you told us first so we can fix it.

Data is transmitted over TLS, access to production systems is restricted to the people who need it, and payment credentials are handled entirely by our payment provider so they never touch our servers.

No system is perfectly secure. If a breach affects your personal data and creates a risk to you, we will notify you and the relevant authority within the timescales the law sets.

Image generation is automated, but it produces a picture, not a decision about you. We do not use automated processing to make decisions with legal or similarly significant effects on you. Abuse-prevention flags are reviewed by a person before an account is suspended.

The Service is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

We may update this Policy. The current version is always on this page with the date it took effect, and we will notify you of material changes by email.

Data protection questions, access and deletion requests, complaints: nekatikat@gmail.com.