Privacy Policy

You provide: name, email, and billing details; account/profile data (username, password, avatar, profile links, preferences); content you upload or generate — reference images (including photos of people for AI identities), prompts, and generated images/videos; community content (posts, comments, captions); support communications; and payment details (processed by Stripe, not stored by us).

Automatically: device and usage data (IP address, browser/OS, pages viewed, interactions, timestamps), and cookies/similar technologies (see our Cookie Notice).

From third parties: if you sign in with Google or another provider, the profile info that service shares with us per your settings.

Creating an AI identity requires reference photos of a person. We want to be precise about what we do:

• We send reference photos to third-party AI providers to generate a written physical description and the images you request.
• We do not create or store a facial-geometry template, faceprint, or other biometric identifier. What we store is your reference photo(s) and a text description.
• We do not sell this data and do not use it to train AI models.
• We retain reference photos and the identity while you keep the identity in your account, and delete them when you delete the identity or your account (subject to limited backups and legal holds).
• You must have the right and consent to upload any person's image. Where required by law (e.g., Illinois BIPA), we obtain your explicit consent at upload and maintain this policy as our biometric data retention/destruction schedule.

To provide, operate, secure, and improve the Service; create and manage your account and identities; process payments and subscriptions; run community features; communicate with you (service messages, security alerts such as new-login notifications, and — with your choices — marketing); detect and prevent fraud and abuse; and comply with law. We may create aggregated or de-identified data that no longer identifies you. We do not use your face/biometric data to train models.

• Service providers / sub-processors: hosting and storage (Supabase, Cloudflare R2), AI model providers that process your Inputs to return Outputs (e.g., xAI, Google, OpenAI, ByteDance), email delivery, and analytics — under confidentiality obligations and not to train on your face/biometric data.
• Payments: Stripe (see stripe.com/privacy).
• Analytics & advertising: we use analytics and advertising pixels (e.g., Google, Meta, TikTok) that may set cookies and receive device/usage data; under some laws (e.g., California) this may be a “sale” or “sharing” for targeted advertising, and you can opt out (see Sections 7-8).
• Other users & the public: your public profile, username, and content you publish to the community/share pages are visible to others and may be copied or cached; we are not responsible for others' use of information you make public.
• Legal & safety: authorities and third parties when we believe in good faith it is necessary to comply with law, enforce our terms, or protect rights and safety.
• Business transfers: in a merger, acquisition, financing, or sale of assets.

We keep personal information only as long as needed for the purposes above or as required by law. Generated assets follow our retention schedule (we notify you before deleting aging content). When you close your account, your content becomes inaccessible and is purged from active systems within 90 days, subject to backups and legal holds. Face reference photos and identities are deleted when you delete the identity or account.

We use technical and organizational safeguards (encryption in transit, access controls, PCI-DSS-certified payment processing). No method is 100% secure, and we cannot guarantee absolute security. We maintain breach-response procedures and will notify you where legally required.

You can access and update account info in-app; opt out of marketing emails via the unsubscribe link (service messages continue); manage cookies via your browser and our Cookie Notice; and delete content or request account closure by contacting [email protected]. Depending on where you live you may have additional rights (Sections 8-9).

If you are a California resident: we collect the categories described in Section 1 (including identifiers, commercial, internet activity, and — as facial images — sensitive information). We do not sell your personal information for money; our use of advertising pixels may be “sharing”/“sale” for cross-context behavioral advertising, which you can opt out of at keldwave.com/do-not-sell (“Do Not Sell or Share My Personal Information”). We also honor the Global Privacy Control (GPC) browser signal.

You may request to know, delete, correct, and limit use of sensitive information, and we will not discriminate against you for exercising these rights. Submit requests to [email protected].

If you are in the EEA, UK, or Switzerland: Keldwave LLC is the controller. Our legal bases are contractual necessity (to provide the Service), legitimate interests (to secure, improve, and promote the Service), consent (where required, e.g., certain cookies and marketing), and legal obligation. You have rights to access, correct, delete, port, restrict, and object to processing, and to withdraw consent; contact [email protected], and you may complain to your local supervisory authority. We transfer data to the U.S. and other countries using appropriate safeguards (e.g., EU Standard Contractual Clauses / the EU-U.S. Data Privacy Framework where applicable).

The Service is not for anyone under 18. We do not knowingly collect data from children; if you believe we have, contact [email protected] and we will delete it as required.

We may update this Policy and will change the “Last updated” date and, for material changes, notify you.

Questions or requests: Keldwave LLC, 2125 Biscayne Blvd, Ste 204 #27179, Miami, FL 33137 — [email protected]