# Privacy Policy > This Privacy Policy explains how AiBrush AB, the controller of your personal data, collects, uses, shares, and protects information when you use AiBrush Studio at aibrush.co, including the creation tools, the asset library, Ad Studio, and the public website. It also explains how long we keep your data, where it is processed, and the rights you have under the EU General Data Protection Regulation (GDPR) and other applicable laws. Canonical: https://aibrush.co/en/privacy ## 1. Who we are and how to reach us The controller responsible for your personal data is AiBrush AB, a Swedish limited company with registration number 559508-8757 and VAT number SE559508875701, registered office at Norra Fjädermolnsgatan 27, 418 42 Gothenburg, Sweden. For any privacy question or request, email support@aibrush.co or write to the address above. We have not appointed a data protection officer because the law does not require us to; privacy requests are handled by our founders directly. ## 2. What this policy covers This policy applies to personal data processed through AiBrush Studio and its related domains, our public website, and our communications with you. It does not cover third-party websites or services that we link to, which have their own privacy policies. If you upload Inputs containing personal data about other people, you are responsible for having a lawful basis to do so, and this policy does not replace any privacy notice you owe them. ## 3. The personal data we collect Account data. When you sign in with Google, Firebase Authentication provides us with your name, email address, profile picture, and a Google account identifier. We create an AiBrush account with its own internal identifier and record your plan, Credit balance, language, and sign-in timestamps against it. Content you provide (Inputs). Prompts, reference images, video, audio, documents, voice samples, and other material you upload, together with the settings you choose for each generation. Inputs may contain personal data, including biometric-like data such as faces and voices, when you choose to include them. Generated content (Outputs). The images, video, audio, music, sound effects, and text the Service produces for you, with metadata such as the model used, dimensions, duration, timestamps, and Credit cost. Workspace and Ad Studio data. Your asset library, project and product records, Ad Studio conversations, briefs, plans, drafts, review notes, exports, and version history. Billing data. Your subscription, invoices, Credit ledger entries (grants, reservations, charges, refunds), the country used for tax purposes, and a Stripe customer reference. Your full payment card number is collected and stored by Stripe only; we never receive it. Usage and technical data. Server logs (IP address, request path, timestamps, response codes, and errors), rate-limit counters, product-analytics events (pages viewed, features and tools used, generations started and completed, plan changes), session recordings with all typed input masked, and device information such as browser type, operating system, screen size, language, and approximate location derived from your IP address. Communications. Emails you send to us, the details they contain, and our replies. Data from third parties. Sign-in profile data from Google; payment status, invoice, and dispute information from Stripe; and conversion signals from Google Ads on the production site. We do not buy personal data from data brokers. ## 4. Why we use your data and our legal bases To provide the Service (contract, GDPR Article 6(1)(b)): creating and managing your account, running generations through our own and third-party AI models, storing your library and Ad Studio workspace, keeping them available across your devices, and providing support. To manage payments and Credits (contract and legal obligation, Article 6(1)(b) and (c)): processing subscriptions and invoices through Stripe, maintaining the Credit ledger, and keeping accounting records that Swedish law requires us to retain. To keep the Service secure and prevent abuse (legitimate interests, Article 6(1)(f)): verifying identity tokens, applying rate limits, detecting fraud, duplicate accounts, and misuse, running automated safety checks such as the check that blocks face-swap requests involving minors, investigating incidents, and enforcing our Terms. Our legitimate interest is operating a safe and lawful service for all users. To improve the Service (legitimate interests, Article 6(1)(f)): analysing how features are used, diagnosing errors, and measuring performance so that we can prioritise improvements. We do not use your Inputs or Outputs to train artificial-intelligence models. To communicate with you (contract and legitimate interests): sending transactional emails such as your welcome message, receipts, and account or security notices, and replying to your messages. We do not send marketing emails unless you have opted in, and you can opt out of any marketing at any time. To measure advertising (legitimate interests, Article 6(1)(f)): on the production site, the Google Ads tag lets us understand whether our advertising leads to sign-ups. You can prevent this by blocking the tag in your browser, as described in section 8. To comply with law and protect rights (legal obligation and legitimate interests): responding to lawful requests from authorities, establishing or defending legal claims, and protecting the rights, property, and safety of AiBrush, our users, and others. Where we ask for your consent (Article 6(1)(a)), for example before showcasing your content or sending marketing email, you can withdraw it at any time without affecting processing that took place before withdrawal. ## 5. How AI providers process your content When you run a generation, we send your prompt and the Inputs required for that request to the provider that operates the selected model, and receive the Output back. Providers currently include Google, OpenAI, Microsoft (Azure OpenAI), ElevenLabs, and specialised image, video, and audio model providers; the provider used depends on the model you select and may change as we add or replace models. Ad Studio conversations are processed by OpenAI’s Codex service through AiBrush’s own company account rather than any account of yours. Providers process your content in order to fulfil your request and to enforce their own safety and abuse policies. We do not permit them to use your content for any other purpose on our behalf, and we do not train models on your content ourselves. Each provider’s own privacy terms govern its processing, including any short-term retention it performs for abuse monitoring. ## 6. Who we share your data with Processors acting on our instructions: Google LLC and Google Cloud (Firebase Authentication, cloud hosting, databases, and transactional email sent through Gmail); Cloudflare, Inc. (edge network, media storage and delivery, and the isolated per-user Ad Studio workspaces); Stripe, Inc. (payment processing, invoicing, and tax calculation); PostHog, Inc. (product analytics and session recording, served through our own domain and hosted in the European Union); and the AI providers listed in section 5. Independent recipients: Google Ads receives conversion signals from the production site under its own privacy policy. Authorities, courts, and regulators receive data when the law requires it. Professional advisers such as accountants, auditors, and lawyers receive data under confidentiality obligations. A successor receives data if AiBrush is acquired, merges, or transfers its assets; we will tell you before your data becomes subject to a different privacy policy. We do not sell your personal data and do not share it with third parties for their own marketing. ## 7. International transfers Our providers process data in the European Union, the United States, and other countries, so your personal data may be transferred outside the country where you live. Where data is transferred from the European Economic Area to a country without an adequacy decision, we rely on safeguards recognised by the GDPR: the EU-U.S. Data Privacy Framework for providers certified under it, and otherwise the European Commission’s Standard Contractual Clauses together with any supplementary measures required. You can ask us for information about the safeguards that apply to a specific provider. ## 8. Cookies and similar technologies Strictly necessary storage: your browser keeps your sign-in session (Firebase Authentication), a cache of your workspace data so the studio loads quickly, a note that a page was reloaded after a deployment, and pending-generation state. Without these the Service does not work, so they do not require consent. Preferences: your theme (light or dark), language, sidebar and layout settings, and studio performance settings are stored locally in your browser so that they persist between visits. They contain no identifiers. Analytics: PostHog sets a first-party cookie scoped to aibrush.co that identifies your browser and session, records page views and feature use, and captures session recordings in which every text field you type into is masked. Recordings help us find bugs and confusing screens. Advertising measurement: on the production site, the Google Ads tag may set Google cookies to attribute sign-ups to advertising. We currently do not show a cookie banner, and analytics run when you visit. You can block or delete cookies and site data in your browser settings, and you can block the analytics and advertising scripts with a content-blocking extension; the Service continues to work if you do, apart from the analytics features. We are reviewing consent mechanisms for visitors from the European Union and will update this section when they change. ## 9. How long we keep your data Account, library, workspace, and Ad Studio data: for as long as your account exists. When you delete an individual item, it is removed from your library immediately; stored copies are purged within 30 days and backups within 90 days. When your account is deleted (see section 10): all account, content, workspace, and Ad Studio data is deleted within 30 days of our confirmation, and remaining backup copies expire within 90 days, except for data we must keep under the exceptions below. Billing records: invoices, Credit ledger entries, and related identity data are kept for seven years after the end of the financial year in which they were created, as required by the Swedish Bookkeeping Act (Bokföringslagen). Server logs and security data: kept for as long as needed for security monitoring and diagnostics, normally no longer than 12 months. Analytics data is retained by PostHog for the period configured in our account and is deleted or de-identified afterwards. Support communications: kept for up to 24 months after the matter is closed so that we can follow up on related issues. Data needed to establish, exercise, or defend legal claims, to comply with a legal obligation, or to enforce a suspension may be kept for as long as that purpose requires. ## 10. Deleting your account Self-service account deletion is not yet available. To delete your account, email support@aibrush.co from the email address linked to your account, or from another address together with information that lets us verify your identity. We will confirm receipt, verify the request, and complete deletion within 30 days. Deletion is permanent: your library, Outputs, workspace, Ad Studio data, and remaining Credits cannot be recovered afterwards. Active subscriptions are cancelled as part of deletion. ## 11. Your rights Under the GDPR and, depending on where you live, other laws, you have the right to: access the personal data we hold about you and receive a copy; have inaccurate data corrected; have your data erased; restrict processing in certain circumstances; receive the data you provided to us in a portable, machine-readable format; object to processing based on our legitimate interests, including profiling; and withdraw consent where processing is based on consent. To exercise any right, email support@aibrush.co. We will respond within one month, extendable by two further months for complex requests, and we may ask you to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive. If you believe we have processed your data unlawfully, you have the right to lodge a complaint with a supervisory authority. Our lead authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, Box 8114, 104 20 Stockholm, www.imy.se). You may also complain to the authority in the country where you live or work. We would appreciate the chance to address your concern first. ## 12. Automated decisions We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing. Automated safety checks may block a specific generation, for example a face-swap request that appears to involve a minor, or refuse content that violates a provider’s policy. If you believe a check has blocked a legitimate request, email support@aibrush.co and a person will review it. ## 13. How we protect your data We use encrypted connections, sign-in through Google with short-lived tokens verified on every request, database rules that let only the signed-in owner read their records, private media storage, provider credentials that never leave our servers, per-user isolation of Ad Studio workspaces, rate limiting, and monitoring for abuse. Access to production systems is limited to the AiBrush team. Our Security page describes these measures further and explains how to report a vulnerability. No system is perfectly secure; if a personal-data breach is likely to result in a risk to you, we will notify you and the supervisory authority as the law requires. ## 14. Children The Service is intended for adults and requires users to be at least 18 years old. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it and close the account. ## 15. Changes to this policy We may update this policy as the Service, our providers, or the law change. The effective date at the top of this page shows when it was last revised. For material changes we will notify you by email or by a prominent notice in the Service before they take effect. Earlier versions are available on request. ## 16. Contact AiBrush AB, Norra Fjädermolnsgatan 27, 418 42 Gothenburg, Sweden. Registration number 559508-8757. VAT number SE559508875701. Email: support@aibrush.co (privacy requests and support) or info@aibrush.co (general enquiries). Phone: +46 76 852 95 58.