Privacy Policy

For the purposes of the EU General Data Protection Regulation ("GDPR") and the UK GDPR, the data controller is:

Pintame Ltd
Email: [email protected]

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, your personal data is processed in accordance with the GDPR and applicable local data protection legislation.

2.1 Data You Provide to Us

• Account Data — Name, email address, password (hashed), profile information.
• Payment Data — Billing address, payment method details. Payment processing is handled by our third-party payment processor; we do not store full credit card numbers.
• Content Data — Book text, titles, metadata, and any other content you upload or create on the Platform.
• Communication Data — Messages you send to our support team, feedback, and survey responses.

2.2 Data We Collect Automatically

• Usage Data — Pages visited, features used, credit consumption, timestamps, session duration.
• Device & Connection Data — IP address, browser type and version, operating system, device type, screen resolution.
• Log Data — Server logs, error reports, API request metadata.
• Cookies & Similar Technologies — See Section 8 below.

2.3 Data from Third Parties

• OAuth Providers (e.g., Google) — Name, email address, and profile picture when you sign in using a third-party account.
• Payment Processors — Transaction confirmation data (e.g., success/failure status, transaction ID).

We process your personal data for the following purposes and on the following legal bases under the GDPR:

• Provide and operate the Platform — account creation, authentication, processing your content, generating illustrations, exporting ebooks. Legal basis: Performance of a contract (Art. 6(1)(b))
• Process payments and manage credits — billing, invoicing, credit balance management. Legal basis: Performance of a contract (Art. 6(1)(b))
• Communicate with you — service notifications, support responses, important updates about your account. Legal basis: Performance of a contract (Art. 6(1)(b))
• Improve and develop the Platform — analytics, usage patterns, performance monitoring, bug fixing. Legal basis: Legitimate interest (Art. 6(1)(f))
• Ensure security and prevent fraud — detecting abuse, unauthorized access, and fraudulent activity. Legal basis: Legitimate interest (Art. 6(1)(f))
• Send marketing communications — product updates, newsletters, promotional offers (only with your consent). Legal basis: Consent (Art. 6(1)(a))
• Comply with legal obligations — tax records, regulatory requirements, law enforcement requests. Legal basis: Legal obligation (Art. 6(1)(c))

4.1 How We Process Your Content

When you use the Platform, your book text is processed by AI models (including third-party AI services) to extract entities, generate scene descriptions, and create illustrations. This processing is essential to providing the service and is performed under the contractual legal basis.

4.2 AI Training

We do not use your uploaded content to train our own AI models. Your book text and generated images remain yours and are processed solely to deliver the service you requested.

Third-party AI providers we use (such as OpenAI, Google, and Anthropic) have their own data processing terms. We use API-based access to these services, which typically excludes customer data from model training. Please refer to each provider's privacy policy for details.

4.3 Generated Content

AI-generated content (illustrations, scene descriptions, entity extractions) is associated with your account. You retain ownership of all content you create on the Platform, as described in our Terms of Service.

We do not sell your personal data. We share personal data only in the following circumstances:

• Third-party AI providers (OpenAI, Google Gemini, Anthropic, Flux/BFL) — Processing your content to generate illustrations and extract entities. Data shared is limited to what is necessary for the specific operation.
• Payment processors — Processing payments and managing subscriptions.
• Cloud hosting providers — Storing and serving Platform data.
• Analytics providers — Understanding Platform usage and improving our services (data is aggregated or pseudonymized where possible). We use:
  • Google Analytics — Aggregated visitor metrics and traffic analysis.
  • Contentsquare (which now operates the Hotjar product line) — Heatmaps, session replay, and product funnel analysis. Recordings mask all email addresses, names, and billing details before they leave your browser; we identify you to Contentsquare only by an internal user ID, never by your email or name. Cookie prefixes: _cs_*, _hj*, _hp[25]_*.
• Legal and regulatory authorities — When required by law, court order, or to protect our legal rights.
• Business transfers — In connection with a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. You will be notified of any such change.

Your personal data may be transferred to and processed in countries outside the EEA, UK, or Switzerland — including the United States — where our third-party service providers operate.

When we transfer personal data outside the EEA/UK, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions where the European Commission has recognized the recipient country as providing adequate protection.
• Other legally recognized transfer mechanisms as applicable.

You may request a copy of the safeguards in place by contacting us at [email protected].

We retain your personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required by law.

• Account Data — Until you delete your account, plus up to 30 days for full deletion from backups.
• Content Data (books, illustrations) — Until you delete the content or your account.
• Payment Records — As required by tax and accounting laws (typically 7 years).
• Usage and Log Data — Up to 24 months from collection, then aggregated or deleted.
• Communication Data — Up to 36 months after your last interaction with support.
• Marketing Consent Records — Until consent is withdrawn, plus a reasonable period to process the withdrawal.

Upon account deletion, we will delete or anonymize your personal data within 30 days, except where retention is required by law.

We use cookies and similar technologies for the following purposes:

• Strictly Necessary — Authentication, security, core functionality. These cannot be disabled. (Legitimate interest)
• Analytics — Understanding how users interact with the Platform. (Consent)
• Preferences — Remembering your settings and preferences. (Consent)

You can manage your cookie preferences at any time through our cookie consent banner or your browser settings. Note that disabling certain cookies may affect Platform functionality.

8.1 Specific Analytics Cookies

When you grant analytics consent, the following first-party cookies may be set on the pintame.ai domain:

• Google Analytics: _ga, _ga_*, _gid, _gat.
• Contentsquare web tag: _cs_id, _cs_s, _cs_c, _cs_i, _cs_cvars, _cs_ep, _cs_optout, and other _cs_* variants.
• Voice of Customer / surveys (formerly Hotjar): _hjSession*, _hjIncluded*, _hjUserAttributes*, and other _hj* variants.
• Product analytics: _hp2_*, _hp5_*.

Revoking analytics consent via the cookie banner deletes these first-party cookies on your next page load.

If you are located in the EEA, UK, or Switzerland, you have the following rights under applicable data protection law:

• Access — Request a copy of the personal data we hold about you.
• Rectification — Request correction of inaccurate or incomplete personal data.
• Erasure ("Right to be Forgotten") — Request deletion of your personal data, subject to legal exceptions.
• Restriction of Processing — Request that we limit how we use your data in certain circumstances.
• Data Portability — Receive your personal data in a structured, commonly used, machine-readable format, or request transfer to another controller.
• Objection — Object to processing based on legitimate interests or for direct marketing purposes.
• Withdraw Consent — Withdraw consent at any time where processing is based on consent. This does not affect the lawfulness of processing before withdrawal.
• Automated Decision-Making — You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently make such decisions.

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days as required by the GDPR. In certain cases, we may ask you to verify your identity before processing your request.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.

The Platform is not directed to children under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us at [email protected] and we will take steps to delete such data promptly.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS/HTTPS).
• Hashed and salted password storage.
• Access controls and authentication for internal systems.
• Regular security reviews.

While we strive to protect your personal data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party services you interact with.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before they take effect. The "Effective Date" at the top of this page indicates when this policy was last revised.

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Pintame Ltd
Email: [email protected]

For GDPR-related inquiries or to exercise your data protection rights, please include "Data Protection Request" in the subject line of your email.