Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Username and email address (required)
• First and last name (optional)
• Password (stored using a cryptographic hash rather than in readable form)
• Account creation date and last login information

1.2 Usage Information

We automatically collect information about how you use our Service:

• IP address and browser information
• Pages visited and features used
• Time and date of visits
• Device and operating system information
• Credit usage and transaction history

1.3 Content Information

We process content you provide to deliver our services:

• Images you upload for processing
• Text prompts and parameters you provide
• Generated content and results
• Contact form submissions and support communications

1.4 Payment Information

For payment processing, we collect:

• Payment method information (processed by Stripe)
• Billing address and transaction details
• Purchase history and credit usage

2. How We Use Your Information

2.1 Service Provision

We use your information to:

• Provide and maintain our AI-powered services
• Process your images and generate content
• Manage your account and credits
• Process payments and transactions
• Provide customer support

2.2 Service Improvement

We may use aggregated, anonymized data to:

• Improve our tools and service performance using aggregated or de-identified information
• Analyze usage patterns and optimize performance
• Develop new features and services
• Conduct research and analytics

2.3 Communication

We may contact you for:

• Service-related notifications and updates
• Payment confirmations and receipts
• Important security or policy changes
• Customer support responses

3. Content Processing and AI Services

3.1 Content Moderation

We use automated systems to moderate content for safety and compliance:

• All text inputs are checked using content moderation systems
• Images may be analyzed for policy compliance
• Flagged content is reviewed and may be rejected
• Violation records may be kept for safety purposes

3.2 Third-Party AI Services

Depending on the tool you choose, we may send prompts, uploaded files, generated content, technical parameters and related identifiers to third-party AI providers so they can perform the requested operation. Our current providers include OpenAI, Google, Replicate, BRIA and Tripo AI. We may also use other specialist model providers identified in the Service. These providers process information on our behalf or under their applicable business terms, and their systems may be located outside Australia.

Please do not upload sensitive information, confidential material or images of identifiable people unless it is necessary and you have authority to do so. We do not use customer Inputs to train a public Oxi Studios AI model. A third-party provider's use of content is governed by our arrangement with that provider and its applicable business-service terms.

4. Information Sharing and Disclosure

4.1 Third-Party Service Providers

We share information with trusted service providers who help us operate our Service:

• Stripe: For payment processing
• Cloudflare: For security and performance
• Railway: For hosting and infrastructure
• Amazon Web Services and Railway Object Storage: For file storage and delivery
• Resend and Google: For service emails and communications
• OpenAI, Google, Replicate, BRIA and Tripo AI: For AI generation, editing, analysis and 3D processing

4.2 Legal Requirements

We may disclose information when required by law or to:

• Comply with legal processes or government requests
• Protect our rights, property, or safety
• Prevent fraud or abuse of our Service
• Enforce our Terms and Conditions

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the business transaction.

5. Data Security

5.1 Security Measures

We take reasonable technical and organisational security measures appropriate to the information and Service, including:

• Encrypted data transmission (HTTPS/TLS)
• Secure password hashing and storage
• Regular security updates and monitoring
• Access controls and authentication systems
• Secure cloud infrastructure

5.2 Data Retention

We retain your information for as long as necessary to provide our services:

• Account information: Until account deletion
• Uploaded and generated content: for the period needed to complete the task and provide project, history or download features, until you delete it or close your account, or for a shorter period where the Service states one
• Transaction records: for the period required by applicable tax, accounting and consumer laws
• Support communications: for as long as reasonably needed to resolve the request, maintain business records and address disputes

6. Your Rights and Choices

6.1 Account Management

You can:

• Update your account information at any time
• Change your password and security settings
• View your credit balance and transaction history
• Delete your account using the account deletion feature or by contacting support

6.2 Data Rights

Depending on your location, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Delete your personal information
• Port your data to another service
• Object to certain processing activities

6.3 Communication Preferences

You can opt out of non-essential communications by contacting us or updating your account settings.

7. Cookies and Tracking

7.1 Cookies We Use

We use cookies and similar technologies for:

• Authentication and session management
• Security and fraud prevention
• Performance monitoring and optimization
• User preference storage

7.2 Third-Party Cookies

Our service may include cookies from:

• Cloudflare (security and performance)
• Stripe (payment processing)
• Other service providers as needed

8. International Data Transfers

Our service providers operate global infrastructure. Personal information is likely to be disclosed to or accessed by recipients in the United States and may also be processed in Australia, the European Union, Israel, Singapore and other countries in which our providers or their subprocessors operate. Provider locations can change as their networks change.

Where the Australian Privacy Principles apply, we take reasonable steps before an overseas disclosure to ensure the recipient handles personal information consistently with those principles, or we rely on another exception permitted by law. Overseas recipients may be subject to different privacy laws and lawful government-access requirements.

9. Children's Privacy

Accounts and purchases are intended for people aged 18 or over. We do not knowingly permit a child to hold an account. If you believe a child has provided personal information to us, contact us and we will investigate and take appropriate steps, including deletion where required.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Sending you an email notification
• Displaying a notice in our Service

For a material change, we will provide reasonable advance notice where practicable. This policy is a notice about our information-handling practices, not a mechanism for obtaining consent where the law requires consent to be specific and voluntary.

11. Regional Privacy Rights

11.1 European Union (GDPR)

If you are in the EU, you have additional rights under the General Data Protection Regulation, including the right to lodge a complaint with a supervisory authority.

11.2 California (CCPA)

California residents have specific rights under the California Consumer Privacy Act, including the right to know what personal information is collected and how it is used.

12. Contact Us

If you have questions or wish to make a privacy complaint, contact us with enough detail for us to investigate. We will acknowledge the complaint and aim to respond within 30 days. If you are not satisfied and the Privacy Act 1988 (Cth) applies, you may complain to the Office of the Australian Information Commissioner.