Privacy Policy

• Account details: your email address and any name you add, and records of your sign-ins.
• Agreements: which version of our Terms you accepted and when, with the IP address and browser used, so we can show what you agreed to.
• Plan and billing: your plan, payment status, invoices and billing country. Card details are collected by our payment processor; we don’t receive full card numbers.
• Your compute provider key: the API key you give us, stored encrypted and used only to act on your provider account as described in the Terms.
• Your Hugging Face token: if you add one, stored encrypted and used only to download the models you install.
• Provider account information: the balance your compute provider reports for your account, which we read to show it to you and warn you before it runs out.
• Settings: your defaults, spending and time limits, idle shut-off and similar choices.
• Job records: the type and number of items in each job, the GPU used, how long it ran, its cost and when. Job records don’t contain your prompts or results.
• Safety records: how many requests on your account our automated checks blocked, and which rule they matched, without the request itself.
• Technical data: IP address, browser and device details, and logs of requests and errors, collected by us and our hosting and security providers.
• Messages: anything you send us, such as support emails, including any content you choose to include.

Your prompts, scripts, character details, references and results (“Inputs” and “Outputs”) are sent from your browser to your GPU (rented or your own hardware, as defined in the Terms) and kept on your device and in your own provider storage. They don’t pass through or get stored on our servers. Our automated safety checks run on that GPU and report only counts, as described above. We don’t sell your personal information, and we don’t use it for targeted advertising.

• to create and run your account, sign you in and provide the Service;
• to start, stop and manage the GPU and storage on your provider account, on your instructions;
• to process payments, prevent fraud, enforce plan limits and stop trial abuse;
• to keep the Service secure, investigate misuse and enforce our Terms and Acceptable Use Policy;
• to send messages about your account, purchases, security and changes to the Service;
• to understand and improve the Service using records that don’t include your Inputs or Outputs;
• to comply with the law, respond to lawful requests, and establish, exercise or defend legal claims.

Where the law requires a legal basis, we rely on performing our contract with you, our legitimate interests (running, securing and improving the Service and protecting our rights), compliance with legal obligations, and your consent where we ask for it.

• Service providers that work for us under contract, including hosting and security (Cloudflare), payment processing and email delivery.
• Your compute provider (currently Runpod), which receives our instructions on your behalf. The provider’s own privacy policy governs what it does with your data.
• Authorities and others when we believe the law requires it, or to protect the rights, property or safety of us, our users or others, including reporting child sexual abuse material.
• A buyer or successor if we’re involved in a merger, acquisition, financing or sale of assets.

We use cookies and similar technologies that are needed to sign you in, keep the Service secure and remember your settings. We don’t use advertising cookies. The studio also keeps your work and settings in your browser’s storage on your device; clearing it removes them from that device.

We keep personal information for as long as your account is open and afterwards for as long as needed for the purposes above, including legal, tax and accounting requirements, fraud prevention, and resolving disputes and enforcing our agreements. Billing records may be kept for up to seven years. Then we delete it or make it anonymous.

We protect personal information with reasonable technical and organisational measures, including encrypting provider keys. No system is completely secure, and we can’t guarantee the security of information sent to us or stored by third parties. You’re responsible for the security of your devices, email account and provider account.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict some uses, and to withdraw consent. Residents of some US states, including California, have rights to know, delete and correct, and not to be discriminated against for using them; we don’t sell or share personal information as those laws define it.

To make a request, email privacy@castingcard.ai from your account address. We’ll verify your identity before acting and respond within the time the law requires. We may keep information where the law allows or requires it, for example for billing records or to resolve disputes. You can appeal a decision by replying to our response, and you may complain to your local data protection authority.

We and our providers may process personal information in the United States and other countries whose laws may differ from yours. Where required, we use appropriate safeguards, such as standard contractual clauses, for these transfers.

The Service is only for people aged 18 and over. We don’t knowingly collect personal information from anyone under 18, and we close accounts and delete information we learn belongs to a minor.

We may update this policy. We’ll show the date of the latest version above and, for material changes, tell you by email or in the Service.

[Legal entity name], [Registered address]. Privacy requests: privacy@castingcard.ai. Everything else: support@castingcard.ai.