Privacy Policy

1. Who we are and what this policy covers

Visora (“we”, “us”, or “our”) operates aiphotoeditingprompts.online, including the AI photo prompt library, account features, guides, and optional AI-assisted tools (the “Service”). We are the controller of the personal data described in this policy, except where a third-party service processes data for its own purposes. This policy applies to the website, our support emails, and any related services that link to it. It does not apply to third-party websites, apps, or AI models that you use separately.

2. Key points

• You can browse, search, and copy prompts without creating an account.
• Signing in is optional. If you sign in with Google, we receive your basic Google profile and create a Supabase account record.
• We use analytics and similar technologies to understand how the Service is used. You can opt out as described below.
• If you use an AI feature, the prompt and any reference image you submit are processed by us and by third-party AI model providers to produce the result, and the prompt text may also be screened for prohibited content before generation. Do not upload sensitive personal data.
• We do not sell your personal information, and we do not use your prompts or images to train our own AI models.
• You can request access to, correction of, or deletion of your personal data, or object to certain processing.

3. Information you provide to us

We collect the information you choose to give us, including:

• Account data. If you sign in with Google, we receive your Google account identifier, name, email address, and profile image. We do not receive your Google password. We create and manage your account on our own systems.
• User Content. Prompts you submit, reference images you upload, generated outputs, saved prompts, collections, likes, comments, feedback, support messages, and reports you send to us.
• Payment and transaction data. If you purchase credits or a paid plan, our payment processor collects your payment details. We receive transaction status, amount, currency, the credits or plan purchased, and limited billing details such as country or the last four digits of a card, if the processor provides them. We do not store full payment card numbers.
• Communications. The content of emails, reports, and other messages you send to us, together with your contact details.

4. Information collected automatically

When you visit or use the Service, we and our service providers may automatically collect standard technical information, including your IP address, approximate location derived from your IP address, device and browser type, operating system, language, referring and exit pages, pages viewed, timestamps, clicks and other interactions, error and performance logs, and an anonymous visitor identifier stored in your browser. We use this information to operate, secure, analyze, and improve the Service, and to understand which prompts and languages are useful.

5. Cookies, similar technologies, and advertising

We use cookies, local storage, and similar technologies. You can block or delete cookies in your browser, but blocking strictly necessary cookies may prevent sign-in. Where the law requires consent for non-essential cookies (for example in the EEA and the UK), we ask for it before those cookies are set and you can withdraw it at any time.

• Strictly necessary. These keep you signed in, protect the Service, balance traffic, remember your language, and store your cookie choices. The Service cannot work without them.
• Functional. These remember your anonymous visitor identifier, liked prompts, and saved items.
• Analytics. Google Analytics 4 and Microsoft Clarity may set cookies and collect usage data such as pages viewed, clicks, mouse movements, and session replays. You can opt out of Google Analytics with Google’s opt-out browser add-on, and you can opt out of Microsoft Clarity by using its opt-out page or blocking clarity.ms.
• Advertising. We display advertising served by Google AdSense and other third-party vendors. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. Google’s use of advertising cookies — including the DoubleClick DART cookie — enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet. You may opt out of personalised advertising by visiting Google Ads Settings (https://www.google.com/settings/ads) or opt out of third-party vendors’ use of cookies for personalised advertising at https://www.aboutads.info/choices/. If you are in the EEA, the UK, or Switzerland, you can also change your choice at any time through the consent message shown on the site.
• How Google uses data. Google’s practices are described at https://policies.google.com/technologies/partner-sites. We do not control third-party cookies and cannot read or write them; the vendor’s own policy governs them.
• Cookie and storage reference. This is what we and our vendors currently set, why, and for how long. First-party names are stable; third-party names are chosen by those vendors and may change without notice.
• lang — set by Visora — remembers the interface language you picked — 1 year.
• zy_token — an httpOnly cookie set by Visora — keeps you signed in after Google sign-in — until you sign out or the session expires.
• _ga, _ga_* — set by Google Analytics — distinguishes visitors and sessions so we can measure traffic — up to 2 years.
• _gid — set by Google Analytics — distinguishes visitors for day-level reporting — 24 hours.
• _clck — set by Microsoft Clarity — stores the Clarity user identifier and your preferences — up to 1 year.
• _clsk — set by Microsoft Clarity — links page views into a single session recording — 1 day.
• IDE, __gads, __gpi — set by Google AdSense — ad delivery, frequency capping, and invalid-traffic detection — up to 13 months.

6. How we use information and our legal bases

We use personal data to:

• Provide the Service, create and manage accounts, process prompts and images, deliver outputs, and administer credits and plans.
• Remember your preferences and personalize your experience.
• Respond to support requests, reports, and questions.
• Monitor, secure, debug, and improve the Service, including detecting fraud, abuse, and policy violations.
• Measure traffic and understand how the Service is used.
• Comply with legal obligations, enforce our Terms, and protect our rights and the rights of others.
• Evaluate or carry out a business transaction, such as a merger or acquisition, subject to appropriate safeguards.

7. Legal bases for EEA and UK users

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract (providing the Service you request), legitimate interests (operating, securing, and improving the Service, and understanding its use), consent (where we ask for it, such as for certain cookies or communications), and legal obligation (tax, accounting, and lawful requests). Where we rely on legitimate interests, you may object as described in the rights section below.

8. AI features and your content

If you use an AI generation feature, the prompt text and any reference image you submit are transmitted to our backend and to third-party AI model providers that generate the result. Those providers may process the data in the United States or other countries. We do not use your prompts or images to train our own models. Where an AI provider offers a setting that prevents training on submitted content, we use that setting; otherwise, the provider’s own terms and privacy policy govern its processing. Before we call a generation model, the prompt text is sent to a third-party content-safety screening service (Waffo Prompt Sift) that checks it against prohibited-content categories. That check is stateless: the provider evaluates the text and returns a verdict without retaining the prompt. If the check returns “block”, or if no verdict can be obtained, we do not generate anything for that request and you are not charged. Generated results are screened again before they are shown to you. We keep moderation records of these screening outcomes — request identifiers, verdicts, and timestamps only; they do not contain your prompt text, images, or outputs. Generated outputs may be stored in your account or generation history. If you choose to share an output publicly, it may be visible to others. Do not submit government identification, health information, financial account details, precise location, or other sensitive personal data, and do not upload images of other people without their permission. We may review prompts, images, and outputs for safety, security, and policy enforcement.

9. How we share information

We do not sell, rent, or trade your personal information. We share personal data only as described below:

• Service providers. We use vendors that help us host and operate the Service, including Vercel (hosting), Supabase (authentication, database, and storage), Cloudflare (DNS, content delivery, and asset storage), Google (sign-in and analytics), Microsoft (Clarity analytics), our AI model providers, our content-safety screening provider, our payment processor, and our email and support tools. These providers process data on our behalf under contractual obligations.
• Legal and safety. We may disclose information if we believe it is necessary to comply with law or a valid legal request, protect the rights or safety of any person, investigate fraud or abuse, or enforce our Terms.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards.
• With your consent. We may share information for other purposes when you ask us to or consent.
• Public content. If you submit a prompt or other content for public display, we may publish it together with your display name or profile image.

10. International data transfers

We and our service providers may process personal data in the United States, the European Economic Area, the United Kingdom, Singapore, and other countries where we or our providers operate. These countries may have data protection laws that differ from those in your country. Where required, we rely on appropriate safeguards, such as standard contractual clauses approved by the European Commission or the UK International Data Transfer Addendum, together with supplementary measures where appropriate. You can contact us for more information about the safeguards we use.

11. Data retention

We retain personal data for as long as necessary for the purposes described in this policy:

• Account data is retained while your account is active and for a reasonable period after you request deletion, to allow us to process the request and maintain backup and security records.
• User Content is retained until you delete it or delete your account, except where it has been shared publicly or is needed for legal, security, or abuse-prevention purposes.
• Server and security logs are typically retained for a limited period, usually no longer than 90 days, unless a longer period is needed to investigate an incident.
• Analytics data is retained according to the provider’s settings, typically for up to 14 months.
• Support and report records are typically retained for up to 24 months after the matter is closed.
• Payment and tax records are retained for the period required by applicable law, which is often seven years.
• Aggregated or de-identified data that cannot reasonably be linked to you may be retained indefinitely.

12. Security

We use reasonable technical and organizational measures designed to protect personal data, including HTTPS encryption, access controls, least-privilege permissions, database security controls, monitoring, and backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant authorities as required by law.

13. Your privacy rights

Depending on where you live, you may have some or all of the following rights:

• Access. Request a copy of the personal data we hold about you.
• Correction. Ask us to correct inaccurate or incomplete data.
• Deletion. Ask us to delete personal data, subject to legal exceptions.
• Restriction and objection. Ask us to restrict certain processing or object to processing based on legitimate interests.
• Portability. Request a portable copy of data you provided to us, where the law provides this right.
• Withdraw consent. Withdraw consent at any time where we rely on consent; withdrawal does not affect processing that already occurred.
• Non-discrimination. We will not discriminate against you for exercising your privacy rights.
• Complaint. Lodge a complaint with your local data protection authority.

14. How to exercise your rights

To make a request, email support@aiphotoeditingprompts.online with the subject line “Privacy Request”. Tell us what you want and include enough information for us to verify your identity and locate your data. We may ask for additional verification to protect your account. We will respond within the time required by applicable law, generally within 30 days, and we will explain any extension. You may use an authorized agent where the law allows it; we may require written permission and verification. If we deny your request, you may appeal by replying with the subject line “Privacy Appeal”.

15. California and other U.S. state privacy notices

If you are a California resident, the categories of personal information we collect are: identifiers (such as name, email address, IP address, and device identifiers); commercial information (such as purchases and credits); internet or network activity (such as pages viewed and interactions); geolocation data (approximate location derived from IP address); audio, visual, or similar information (such as images you upload); and inferences drawn from the above. We collect these categories from you, automatically, and from service providers. We use them for the purposes described in this policy. We do not sell personal information for money. Advertising cookies set by Google and other third-party vendors may constitute “sharing” for cross-context behavioral advertising under the CPRA; you can opt out of that at https://www.google.com/settings/ads and https://www.aboutads.info/choices/, and we honour Global Privacy Control signals as an opt-out of sharing. We do not knowingly sell or share the personal information of consumers under 16. We retain data as described in the retention section. California residents may request to know, access, correct, or delete personal information, and may designate an authorized agent, by contacting us as described above. You also have the right not to receive discriminatory treatment for exercising these rights. Residents of other U.S. states with comprehensive privacy laws may have similar rights, including the right to appeal a decision. California residents may also request information about our disclosure of personal information to third parties for their direct marketing purposes; we do not disclose personal information for that purpose.

16. Do Not Track and Global Privacy Control

Some browsers send “Do Not Track” signals. We do not sell personal information, but third-party advertising cookies can amount to sharing for cross-context behavioral advertising, so we honour Global Privacy Control signals as an opt-out of that sharing where required. You can also use the cookie and advertising controls described in this policy.

17. Marketing communications

We send transactional and service-related messages, such as sign-in, security, purchase, and support messages. We do not currently send marketing newsletters. If we introduce marketing communications, we will provide a way to opt out, and where required, we will ask for your consent first. You can opt out of marketing messages without affecting service messages.

18. Children’s privacy

The Service is not directed to children under 13, or under 16 where the law of your country requires a higher age for data protection consent. We do not knowingly collect personal data from children below the applicable age. If you are under 18, you should use the Service only with the involvement and permission of a parent or guardian. If we learn that we have collected personal data from a child without the required consent, we will delete it. If you believe a child has provided us with personal data, contact us at support@aiphotoeditingprompts.online.

19. Third-party services and links

The Service may link to third-party websites, tools, or AI models, and may embed third-party features. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing them with personal data. If you use a third-party AI model with a prompt from our library, that provider’s terms and privacy policy apply to your use of its service.

20. Automated decision-making

We do not make decisions that produce legal effects or similarly significant effects concerning you based solely on automated processing. We may use automated tools for content moderation, spam and fraud prevention, security, and analytics. Prompt screening before an AI generation is one of those automated checks; see section 8 for how it works. Where appropriate, humans review automated decisions, and you can contact us to request human review of a moderation decision that affects you.

21. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and change the effective date at the top. If a change is material, we will provide additional notice, such as an email or a prominent notice on the Service, where required by law. Continued use of the Service after the effective date means you accept the updated policy to the extent permitted by law. Where the law requires consent, we will ask for it.

22. Contact us

For privacy questions, requests, or complaints, contact Visora at support@aiphotoeditingprompts.online. We aim to respond within 30 days. If you are in the EEA or the UK, you also have the right to complain to your local data protection authority.