Template — pending legal review. This document is a working template and must be reviewed and completed by qualified counsel before it is relied on. Bracketed text such as [Company legal name] marks details still to be confirmed.
1.Who we are
This Privacy Policy explains how [Company legal name] ("Cheaper Gen.", "we", "us") handles personal data when you visit our website or use our API, Studio and dashboard (the "Service"). For account, billing and website data we act as the controller. For content you submit for generation on behalf of your own users, we act as a processor on your instructions; a data processing agreement (DPA) is available on request.
2.Information we collect
- Account data — your name, email address and profile image from the sign-in method you choose (for example Google or an email link).
- Billing data — top-up and payment history, billing address and tax details. Card details are collected and stored by our payment processor; we never see or store full card numbers.
- Customer content — prompts, images and other inputs you submit, and the outputs we generate for you.
- Usage data — API keys used (by prefix), models and parameters, request status, cost, timestamps, IP address, user agent and similar technical logs.
- Communications — messages you send us, including through the contact form or waitlist, and support conversations.
- Cookies — strictly necessary cookies that keep you signed in and protect against fraud. [List any analytics cookies, if used, and the consent mechanism.]
3.How we use information
- To provide the Service: authenticate you, run your generations, deliver outputs and webhooks, and show your usage and balance.
- To bill you: process payments and automatic top-ups, issue receipts and keep accounting records.
- To keep the Service secure and reliable: detect abuse, enforce our Acceptable Use Policy, monitor performance and route requests to healthy capacity.
- To support you and respond to enquiries, including sales requests you send us.
- To improve the Service using aggregated, de-identified usage statistics (for example which models and resolutions are popular) — not the content of your generations.
- To send service and billing notices, and, where permitted, product updates you can opt out of at any time.
- To comply with legal obligations and enforce our agreements.
Our legal bases under the GDPR/UK GDPR are performance of our contract with you, our legitimate interests in operating and securing the Service, compliance with legal obligations, and your consent where we ask for it.
4.No training on your data
We do not use your prompts, inputs or outputs to train or fine-tune AI models, and we do not sell them. [Confirm that each model provider's terms prohibit training on API data before publishing.] Our staff access customer content only when needed to provide support you request, investigate abuse or comply with law.
6.Data retention
We keep personal data only as long as needed for the purposes above:
| Data | Retention |
|---|---|
| API generations: prompts, input media and outputs | 1 day after the generation completes by default, then deleted automatically. Enterprise accounts can choose immediate deletion (as soon as the result is delivered, and at most 1 hour after completion), 1 hour, 1 day, 7 days or 30 days, and any request can ask for a shorter period. You can also delete a generation at any time. |
| Studio and playground generations: prompts, input media and outputs | Until you delete them, or delete your account. |
| Uploaded input files | As long as a kept generation uses them; files not used by any generation are deleted after 1 day. |
| Generation metadata (model, price-relevant parameters, status, cost, timestamps) | For the life of your account, so your usage history and invoices stay accurate — also after the content above is deleted. |
| Account information | For the life of your account and up to [90] days after closure. Deleting your account deletes your generations, uploaded files and generated media. |
| Payments, credit ledger and balance | For the life of your account. Deleting your account deletes them from our systems; our payment processor keeps its own payment records as required by tax and accounting law (typically [7] years). |
| Security and request logs (IP address, user agent) | Up to [90] days, longer if needed to investigate abuse. |
| Sales enquiries and waitlist sign-ups | Until you ask us to delete them or [24] months after our last contact. |
Our model and inference providers process your inputs only to run your request. Where a provider lets us choose, we ask for the shortest retention it offers; some providers keep generated files for a limited time on their side (for example up to 14 days) before deleting them. [Confirm each provider's retention terms before publishing.]
Backups are overwritten on a rolling basis within [35] days.
7.International transfers
We and our sub-processors may process data in the United States and other countries. Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
8.Security
We use administrative, technical and physical safeguards appropriate to the data we process, including encryption in transit (TLS), encryption at rest for stored data, hashing of API keys, signed webhooks, access controls and logging. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and authorities as required by law.
9.Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. California residents have the right to know, delete and correct personal information and not to be discriminated against for exercising these rights.
To exercise your rights, email support@cheapergen.com from the address on your account. We will respond within the time required by law (usually 30 days). You may also complain to your local data protection authority.
10.Children
The Service is not directed to children and may not be used by anyone under 18. We do not knowingly collect personal data from children.
11.Changes to this policy
We may update this policy from time to time. We will post the new version here and update the "Last updated" date; for material changes we will notify you by email or in the dashboard.
12.Contact
Privacy questions and requests: support@cheapergen.com. [Data protection officer / EU and UK representative, if required.] Postal address: [Company legal name], [address].