In short: We collect what we need to run Product Aura: your account details, the photos you upload, the images we make for you, payment records and basic security logs. Your photos are sent to the AI providers listed below only to make your images, and we do not use them to train AI models. We do not sell your data, we use no advertising cookies, and you can ask us to see or delete your data at any time.
1. Who is responsible for your data
[COMPANY NAME], registered in [COUNTRY OF REGISTRATION] under company number [COMPANY NUMBER], at [REGISTERED ADDRESS], runs Product Aura and is the “controller” of your personal data under the EU and UK General Data Protection Regulation (GDPR). For any privacy question or request, email [email protected].
[LAWYER: if the company is outside the EU, confirm whether we need an EU representative under GDPR Article 27 (and a UK representative if the company is outside the UK), and add their details here.]
This policy covers productaura.co, the Product Aura app, our API, our MCP server and our command-line tool. It should be read together with our Terms of Service.
2. What data we collect
Data you give us
- Account details: your email address and, if you add it, your name. If you sign in with Google, we receive your name, email address and Google account ID from Google.
- Your content: the product photos you upload, the product profile we build from them (which you can edit), the instructions and settings you choose, and the images we generate for you. Photos may show people or personal details if you include them, so please only upload what is needed.
- Feedback: thumbs up or down on an image, the reasons you pick, and any written feedback. We store it with the AI model, pack version and prompt that made the image, so we can see what works and fix what does not.
- Messages: emails you send to [email protected] and our replies.
Data created when you use Product Aura
- Credits and billing: your credit balance and history, your plan, and records of payments and refunds. Payments are handled by Stripe. We receive your Stripe customer ID, what you bought and the payment status, but never your full card number.
- API keys and connected assistants: we store only a secure hash of each API key and its first few characters, so you can recognise it, plus when it was last used. For AI assistants you connect through our MCP server, we store the approval you gave and its tokens until you disconnect the assistant in Settings.
- Technical and security data: your IP address, browser and device type, and the pages and actions you request. We use IP addresses to limit how many requests can be made (rate limiting) and to prevent fraud. For the free sign-up credits, we store only a salted hash of your IP address, not the address itself, to limit free credits to a few accounts per network per day.
- Logs: error logs, so we can fix problems, and security logs, so we can spot and stop abuse.
- Bot check: Cloudflare Turnstile checks whether a visitor is a person when you sign up or take certain actions. It looks at technical signals from your browser.
- Website statistics: Cloudflare Web Analytics counts page visits without cookies and without building a profile of you.
3. Why we use your data, and our legal basis
| What we do | Data used | Legal basis |
|---|---|---|
| Create and run your account, sign you in, send sign-in and account emails | Account details, technical data | Contract (to provide the service you asked for) |
| Analyse your photo, generate, edit and store your images, and prepare downloads | Your content | Contract |
| Take payments, keep the credit ledger, issue refunds and keep tax records | Billing data, account details | Contract and legal obligation |
| Prevent fraud and abuse, limit free credits, rate limiting, bot checks, security logs | Technical and security data, hashed IP address | Legitimate interests (keeping the service safe and fair) |
| Fix errors and improve Product Aura, including using ratings and feedback to improve prompts and model choices | Feedback, the prompt and model behind each image, error logs | Legitimate interests (making the product better) |
| Answer your messages and requests | Messages, account details | Contract or legitimate interests |
| Count website visits without cookies | Aggregated, cookieless page statistics | Legitimate interests |
| Respond to legal requests and enforce our terms | Any relevant data | Legal obligation or legitimate interests |
We do not send marketing emails today. If we start, we will only do so with your consent or where the law allows it, and every email will have an unsubscribe link. [OWNER/LAWYER: update this if product or marketing emails are added.]
4. How AI is used with your data
- When you upload a photo, Anthropic’s Claude model reads it to write a product profile (such as the product type, colours and key features). Claude is also used to translate text that appears on your images.
- To make images, your photo, a cut-out of your product and the instructions we write are sent to the image model you or we choose, from Google (Gemini image models), OpenAI (GPT Image models) or fal.ai. fal.ai is also used for background removal.
- We do not train AI models on your photos or images. Where a provider offers a setting that stops it from training on or keeping your data, we turn it on. The providers process your content under their own API terms. [LAWYER: confirm each provider’s current API data-use and retention terms, and list any retention period they keep for abuse monitoring.]
- We do not make decisions about you that have legal or similarly significant effects using only automated means.
- Every image we create carries machine-readable metadata saying it was made with AI (the IPTC “digital source type” field). This metadata does not contain your personal data. [OWNER: confirm that no account or personal data is written into image metadata.]
5. Who we share data with
We do not sell your personal data, and we do not share it for advertising. We share it only with:
- the service providers (subprocessors) listed below, only as much as each one needs to do its job;
- authorities, courts or others when the law requires it, or to protect our rights, users or the public;
- a buyer or successor if Product Aura or our company is sold or merged. We will tell you before your data becomes subject to a different privacy policy.
6. Subprocessors
These companies process personal data for us. We will update this list before we add a new subprocessor. [OWNER: decide whether business customers with a DPA get email notice of changes, and how many days ahead.]
| Company | What they do for us | Data involved | Location and transfer basis |
|---|---|---|---|
| OVHcloud | Hosting: a virtual server rented from OVHcloud runs the app and our database | All account data, the credit ledger, feedback, logs | [REGION]. [confirm: if the server is in the US, EU SCCs / Data Privacy Framework] |
| Cloudflare | Network and security (CDN, protection against attacks), R2 storage for photos and images, Turnstile bot check, cookieless web analytics, and forwarding of email sent to [email protected] | All traffic to the site, including IP addresses; uploaded photos and generated images; emails to us | Global network, US company. EU SCCs / Data Privacy Framework [confirm] |
| Gemini image models, called through the Gemini API, to generate and edit images | Product photos, cut-outs, prompts, generated images | US. EU SCCs / Data Privacy Framework [confirm] | |
| OpenAI | GPT Image models, to generate and edit images | Product photos, cut-outs, prompts, generated images | US. EU SCCs / Data Privacy Framework [confirm] |
| Anthropic | Claude reads product photos to write the product profile and translates on-image text | Product photos, product profile, text to translate | US. EU SCCs / Data Privacy Framework [confirm] |
| fal.ai | Optional: background removal and some image models | Product photos, prompts, generated images | US. EU SCCs [confirm] |
| Stripe | Payments, subscriptions, invoices and the billing portal | Name, email, payment details, billing address, purchase history | US and EU. EU SCCs / Data Privacy Framework [confirm] |
| Resend | Sends sign-in and account emails | Email address, email content | US. EU SCCs / Data Privacy Framework [confirm] |
| Sign-in with Google, only if you choose it | Name, email address, Google account ID | US. EU SCCs / Data Privacy Framework [confirm] | |
| [OWNER: mailbox provider] | Receives and stores email forwarded from [email protected] | Emails you send us and our replies | [confirm] |
7. International transfers
Some of the companies above are based in, or process data in, the United States or other countries outside the EU and UK. When we transfer personal data outside the EU or UK, we rely on an adequacy decision (such as the EU-US Data Privacy Framework and its UK extension, where the company is certified) or on the European Commission’s Standard Contractual Clauses (with the UK addendum). You can ask us for more detail at [email protected]. [LAWYER: confirm the transfer mechanism for each subprocessor.]
8. How long we keep data
| Data | How long |
|---|---|
| Uploaded product photos | [OWNER: uploads are deleted [X] days after upload, unless you keep them in a project.] |
| Generated images and product profiles | [OWNER: kept while your account is open, or deleted after [X] days.] |
| Account details and settings | While your account is open, then deleted within [OWNER: X] days after you ask us to delete it. |
| Feedback and ratings | [OWNER: kept while your account is open, then deleted or made anonymous (separated from your account) when the account is deleted.] |
| Payment, invoice and credit ledger records | [ACCOUNTANT: as long as tax and accounting law requires, for example 6 or 7 years.] |
| Error and security logs | [OWNER: X] days |
| Hashed IP addresses for the free-credit limit | [OWNER: X] days |
| Backups | Deleted data can stay in backups until the backup is overwritten, after [OWNER: X] days. Backups are not used for anything except restoring the service. |
| Emails with us | [OWNER: X] years after the last message |
AI providers may keep data for a short time under their own terms, as noted in section 4. We may keep data longer if the law requires it or to settle a dispute.
9. How we protect your data
All traffic is encrypted in transit (HTTPS). Files are stored in private storage and shared only through short-lived links. API keys are stored only as hashes. Access to our servers and admin tools is limited to the people who run Product Aura. We take regular backups. No system is perfectly secure, but if a data breach puts your rights at risk, we will tell you and the authorities as the law requires.
10. Your rights
If you are in the EU, the UK or another country with similar laws, you have the right to:
- get a copy of your personal data;
- have wrong data corrected;
- have your data deleted;
- limit or object to how we use your data, including where we rely on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, or to delete your account, email [email protected] from the email address on your account. There is no delete button in the app yet. We will reply within one month. We may need to confirm your identity first.
You can also complain to a data protection authority, for example the authority in the country where you live or work. In the UK this is the Information Commissioner’s Office (ico.org.uk). [LAWYER: name our lead supervisory authority, if any, and confirm whether any US state privacy law applies.]
11. Cookies
We use only essential cookies that keep you signed in and keep your session secure. They are needed for Product Aura to work, so we do not ask for consent for them. We do not use advertising or tracking cookies. Cloudflare Web Analytics counts visits without cookies. Cloudflare may set its own security cookies to protect the site from bots and attacks. [LAWYER: confirm the Cloudflare and Turnstile cookies count as strictly necessary.]
If we ever add analytics or other tools that need consent, we will ask you first and update this policy.
12. Children
Product Aura is not meant for anyone under 18, and we do not knowingly collect data from children. If you think a child has given us personal data, email [email protected] and we will delete it.
13. Business customers
If you use Product Aura for a business and upload personal data about other people, such as models or customers in your photos, you are responsible for having a lawful basis to do so, and we process that data on your behalf. A data processing agreement (DPA) is available on request at [email protected]. [LAWYER: confirm the controller and processor roles for customer content, and prepare the DPA.]
14. Changes to this policy
We will update this policy when our practices or the law change, and show the new date at the top. For important changes we will email you before they take effect.
15. Contact
Email [email protected], or write to [COMPANY NAME], [REGISTERED ADDRESS]. See also our Terms of Service, Acceptable Use Policy and Refund and Credits Policy.