Your Privacy Matters: Oxi Studios (ABN 53 500 673 472) is committed to being transparent about how we collect, use, disclose and protect personal information.
1. Information We Collect
1.1 Account Information
When you create an account, we collect:
- Username and email address (required)
- First and last name (optional)
- Password (stored using a cryptographic hash rather than in readable form)
- Account creation date and last login information
1.2 Usage Information
We automatically collect information about how you use our Service:
- IP address and browser information
- Pages visited and features used
- Time and date of visits
- Device and operating system information
- Credit usage and transaction history
1.3 Content Information
We process content you provide to deliver our services:
- Images you upload for processing
- Text prompts and parameters you provide
- Generated content and results
- Contact form submissions and support communications
- Optional PET3D print-preparation assessments: the selected model, intended print height, printing method and notes are saved and shared with Oxi Studios staff together with your account contact details so we can respond to your request.
1.4 Payment Information
For payment processing, we collect:
- Payment method information (processed by Stripe)
- Billing address and transaction details
- Purchase history and credit usage
2. How We Use Your Information
2.1 Service Provision
We use your information to:
- Provide and maintain our AI-powered services
- Process your images and generate content
- Manage your account and credits
- Process payments and transactions
- Provide customer support
2.2 Service Improvement
We may use aggregated, anonymized data to:
- Improve our tools and service performance using aggregated or de-identified information
- Analyze usage patterns and optimize performance
- Develop new features and services
- Conduct research and analytics
2.3 Communication
We may contact you for:
- Service-related notifications and updates
- Payment confirmations and receipts
- Important security or policy changes
- Customer support responses
3. Content Processing and AI Services
3.1 Content Moderation
We use automated systems to moderate content for safety and compliance:
- All text inputs are checked using content moderation systems
- Images may be analyzed for policy compliance
- Flagged content is reviewed and may be rejected
- Violation records may be kept for safety purposes
3.2 Third-Party AI Services
Depending on the tool you choose, we may send prompts, uploaded files, generated content, technical parameters and related identifiers to third-party AI and compute providers so they can perform the requested operation. Our current providers include OpenAI, Google, Replicate, BRIA, Tripo AI, Hi3D and RunPod. We may also use other specialist model or compute providers identified in the Service. These providers process information on our behalf or under their applicable business terms, and their systems may be located outside Australia.
Please do not upload sensitive information, confidential material or images of identifiable people unless it is necessary and you have authority to do so. We do not use customer Inputs to train a public Oxi Studios AI model. A third-party provider's use of content is governed by our arrangement with that provider and its applicable business-service terms.
4. Information Sharing and Disclosure
4.1 Third-Party Service Providers
We share information with trusted service providers who help us operate our Service:
- Stripe: For payment processing
- Cloudflare: For security and performance
- Railway: For hosting and infrastructure
- Amazon Web Services and Railway Object Storage: For file storage and delivery
- Resend and Google: For service emails and communications
- OpenAI, Google, Replicate, BRIA, Tripo AI and Hi3D: For AI generation, editing, analysis and 3D processing
- RunPod: For GPU processing of selected self-hosted AI generation and 3D workflows
4.2 Legal Requirements
We may disclose information when required by law or to:
- Comply with legal processes or government requests
- Protect our rights, property, or safety
- Prevent fraud or abuse of our Service
- Enforce our Terms and Conditions
4.3 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the business transaction.
5. Data Security
5.1 Security Measures
We take reasonable technical and organisational security measures appropriate to the information and Service, including:
- Encrypted data transmission (HTTPS/TLS)
- Secure password hashing and storage
- Regular security updates and monitoring
- Access controls and authentication systems
- Secure cloud infrastructure
5.2 Data Retention
We retain your information for as long as necessary to provide our services:
- Account information: Until account deletion
- Uploaded and generated content: for the period needed to complete the task and provide project, history or download features, until you delete it or close your account, or for a shorter period where the Service states one
- Transaction records: for the period required by applicable tax, accounting and consumer laws
- Support communications: for as long as reasonably needed to resolve the request, maintain business records and address disputes
6. Your Rights and Choices
6.1 Account Management
You can:
- Update your account information at any time
- Change your password and security settings
- View your credit balance and transaction history
- Delete your account using the account deletion feature or by contacting support
6.2 Data Rights
Depending on your location, you may have the right to:
- Access your personal information
- Correct inaccurate information
- Delete your personal information
- Port your data to another service
- Object to certain processing activities
6.3 Communication Preferences
You can opt out of non-essential communications by contacting us or updating your account settings.
7. Cookies and Tracking
7.1 Cookies We Use
We use cookies and similar technologies for:
- Authentication and session management
- Security and fraud prevention
- Performance monitoring and optimization
- User preference storage
7.2 Third-Party Cookies
Our service may include cookies from:
- Cloudflare (security and performance)
- Stripe (payment processing)
- Other service providers as needed
8. International Data Transfers
Our service providers operate global infrastructure. Personal information is likely to be disclosed to or accessed by recipients in the United States and may also be processed in Australia, the European Union, Israel, Singapore and other countries in which our providers or their subprocessors operate. Provider locations can change as their networks change.
Where the Australian Privacy Principles apply, we take reasonable steps before an overseas disclosure to ensure the recipient handles personal information consistently with those principles, or we rely on another exception permitted by law. Overseas recipients may be subject to different privacy laws and lawful government-access requirements.
9. Children's Privacy
Accounts and purchases are intended for people aged 18 or over. We do not knowingly permit a child to hold an account. If you believe a child has provided personal information to us, contact us and we will investigate and take appropriate steps, including deletion where required.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by:
- Posting the updated policy on our website
- Sending you an email notification
- Displaying a notice in our Service
For a material change, we will provide reasonable advance notice where practicable. This policy is a notice about our information-handling practices, not a mechanism for obtaining consent where the law requires consent to be specific and voluntary.
11. Regional Privacy Rights
11.1 European Union (GDPR)
If you are in the EU, you have additional rights under the General Data Protection Regulation, including the right to lodge a complaint with a supervisory authority.
11.2 California (CCPA)
California residents have specific rights under the California Consumer Privacy Act, including the right to know what personal information is collected and how it is used.
12. Contact Us
If you have questions or wish to make a privacy complaint, contact us with enough detail for us to investigate. We will acknowledge the complaint and aim to respond within 30 days. If you are not satisfied and the Privacy Act 1988 (Cth) applies, you may complain to the Office of the Australian Information Commissioner.