Privacy Policy

Information you provide

• Account information. Your email address, email-verification status, and a password hash. If you use Google sign-in, we receive your verified email address and Google account identifier from Google; we do not receive your Google password.
• Images and creative choices. Photographs you upload, generated watercolor images, the style you select, and related file and transformation information such as image dimensions, file type, status, and timestamps.
• Purchase information. The credit pack, transaction amount, currency, payment status, and identifiers associated with your Stripe customer, checkout session, and payment. Stripe collects and processes your payment-card details; we do not receive or store full payment-card numbers.
• Communications. Information you include when you contact us for support or make a privacy request.

Information collected automatically

When you use the Service, we process technical information needed to operate and secure it. This can include your IP address, browser or device information, request timestamps, pages or API functions requested, security and error logs, and session activity. We store hashed versions of IP addresses and user-agent strings with authentication sessions.

We also use browser storage to keep your email address during an email-verification flow and strictly necessary cookies for authentication, request security, registration verification, and remembering a selected watercolor style. We do not currently use advertising cookies or third-party behavioral analytics.

We use information to:

• create and secure your account and keep you signed in;
• verify your email address and reset your password;
• process uploaded photographs and create watercolor images;
• display your gallery and maintain your credit balance;
• process purchases, refunds, disputes, and related records;
• provide support and respond to privacy requests;
• detect abuse, enforce limits, troubleshoot errors, and protect the Service; and
• comply with legal obligations and enforce our agreements.

Where applicable law requires a legal basis, we process data as necessary to perform our contract with you, comply with law, pursue legitimate interests such as security and service improvement, or with your consent.

We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising. We disclose information only as described below.

• OpenAI. We send your uploaded photograph and watercolor instructions to the OpenAI API to create your image. OpenAI may process this content for safety and abuse monitoring. OpenAI states that API inputs and outputs are not used to train its models by default and that standard abuse-monitoring data may be retained for up to 30 days. See OpenAI's enterprise privacy information and API data controls.
• Stripe. Stripe processes checkout, payment, fraud-prevention, refund, and dispute information. See the Stripe Privacy Policy.
• Google. If you choose Google sign-in, Google authenticates you and provides the account information described above. The site also loads font files from Google, which can expose request information such as your IP address and browser details to Google. See the Google Privacy Policy.
• Amazon Web Services. We use Amazon Simple Email Service to deliver account-verification and password-reset email, which requires processing your email address and message content. See the AWS Privacy Notice.
• Infrastructure providers. Hosting, network, security, and other vendors may process information on our behalf as needed to operate the Service.
• Legal and safety reasons. We may disclose information when reasonably necessary to comply with law or valid legal process; protect rights, safety, and security; investigate fraud or abuse; or enforce our agreements.
• Business transfers. Information may be disclosed as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to appropriate safeguards.

These providers may process information in the United States and other countries under their own terms and privacy practices.

• Original photographs. We keep a source image only while its watercolor transformation is being processed and delete our copy after the transformation succeeds or permanently fails. Orphaned temporary files are scheduled for cleanup after one day. Processing by OpenAI is subject to OpenAI's retention practices described above.
• Generated watercolors. Generated image files are scheduled for deletion 30 days after creation. You can delete a completed image sooner from your gallery. Associated technical records may remain for security, accounting, and service-integrity purposes.
• Browser data. Authentication and selected-style cookies generally last no longer than 30 days; registration verification cookies last about 10 minutes. The email address used during verification remains in session storage until it is cleared or the browser session ends.
• Other records. We retain account, transaction, credit-ledger, security, support, and legal records for as long as reasonably necessary to provide the Service, protect it, resolve disputes, and meet tax, accounting, and legal obligations.

Deletion from active systems may not immediately remove information from backups, logs, or records we must keep by law. We isolate or delete such information according to our retention processes.

We use technical and organizational safeguards designed to protect personal information, including encrypted HTTPS connections, hashed passwords, opaque session tokens, access controls, and request-forgery protections. No security measure is perfect, and we cannot guarantee absolute security.

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a portable copy of your personal information; to object to or restrict certain processing; or to withdraw consent. You may also have the right to appeal our response or complain to a data-protection authority.

You can delete completed watercolors from your gallery. To request help deleting your account or to exercise another privacy right, email support@greenstripestudio.com. We may need to verify your identity before completing a request. Some information may be retained when required by law or for legitimate purposes such as fraud prevention, security, accounting, and dispute resolution.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

We may update this Privacy Policy as the Service or legal requirements change. We will post the updated policy here and revise the effective date. If a change is material, we will provide additional notice when appropriate.

For privacy questions, rights requests, or help deleting your account, email support@greenstripestudio.com. Please include "Privacy Request" in the subject line and do not send passwords, payment-card numbers, or other sensitive information.

Return to Green Stripe Studio