Privacy Policy

1. Introduction

At SpicyGen AI ("we," "our," or "us"), operated by Wayfinity Ltd, a company incorporated in the Republic of Cyprus, we respect your privacy and are committed to protecting your personal data. This Privacy Policy applies to all online services provided by SpicyGen AI and governs the collection, use, disclosure, and safeguarding of your information when you access our website and use our services ("Service"). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) (Regulation 2016/679) as implemented in Cyprus by Law 125(I)/2018. By using our Service, you agree to the terms of this Privacy Policy. If you do not agree with these terms, please do not access or use our Service.

2. Information We Collect

2.1 Personal Information

Account Details: When you register (for example, via Google authentication), we collect your name, email address, and any other information provided by your authentication provider.

Profile Information: This includes any additional details you choose to provide, such as profile images or biographical information.

Other Data: In some instances, we might collect device identifiers, geolocation data, or other information necessary to enhance your Service experience.

2.2 Content

User Content: We process the photos and any other media you upload to our Service to generate videos based on your prompts. All such content remains your property. As described in our Terms of Service, you grant us a license to use your content to provide and improve the Service, and a separate license to use your content for our marketing and promotional purposes.

Usage Considerations: The content is used only for the purposes you specify (e.g., generating AI videos) and is handled with the utmost care in compliance with this Privacy Policy.

Content Screening: We may use automated technologies to screen uploaded content for:

• Potential copyright violations
• Images of known individuals
• Professional photography
• Other indicators that content may not be owned by the uploader

Biometric Data: Our content screening analyses faces in uploaded images to keep minors and real people shown without their consent off the Service. Each use, how long we keep the data and how we destroy it are set out in section 6.1, Biometric Data Retention and Destruction Policy.

Consent Records: We may maintain records of user attestations regarding content ownership and consent to help resolve disputes and ensure compliance with our Terms.

2.3 Usage Data

We automatically collect information about your interaction with our Service, including:

• Log Data: IP address, browser type, pages visited, and timestamps.
• Device Data: Device type, operating system, and other identifiers.
• Cookie Data: Session IDs, authentication tokens, and other data that help maintain your session.
• Additional Details: This data may be aggregated and anonymized for analysis to improve our Service.

2.4 Analytics

We use tools such as Google Analytics to gather aggregated, anonymized insights on how users interact with our Service. This information helps us identify trends, optimize performance, and improve the overall user experience.

2.5 Security & Content Safety Data

To maintain a safe environment and comply with legal obligations, we collect and process specific data related to content safety:

• Report Data: When you submit a DMCA or abuse report, we collect your contact information, details of the reported content, and the nature of the violation.
• Moderation Logs: We maintain records of content moderation actions, including automated flags and manual reviews.
• Safety Signals: We process technical signals (such as hash matching against known illegal content databases) to prevent the distribution of harmful material.

3. How We Use Your Information

We use your data for several key purposes, including:

• Service Provision: To register you as a user, process transactions, generate AI videos using AI-generated reference images (including reference images created by analyzing your uploads), and provide customer support.
• Service Improvement: To analyze usage patterns, detect and resolve technical issues, and develop new features.
• Communication: To send notifications (such as account alerts or transaction confirmations), respond to inquiries, and, if you have opted in, deliver marketing communications.
• Marketing and Promotion: To display images and videos you create on our website and in other marketing materials, as per the promotional license you grant us in our Terms of Service.
• Legal & Security: To safeguard our Service and its users by preventing fraud, enforcing our Terms of Service, and complying with legal obligations.

3.5 Content Moderation and Safety

We employ various methods to ensure platform safety and prevent misuse:

• Automated Screening: We use AI-powered tools to detect potentially unauthorized or prohibited content.
• User Reporting: We maintain systems for users to report potentially violating content.
• Moderation Team: We may employ human moderators to review flagged content.
• Legal Compliance: We maintain processes to respond to legal requests, including takedown notices.

These moderation activities are conducted to:

• Protect the rights of individuals
• Ensure compliance with our Terms
• Maintain the integrity and safety of our platform
• Fulfill our legal obligations

4. Legal Basis for Processing

Under applicable data protection laws (e.g., the GDPR), we process your personal data based on the following legal grounds:

• Consent: When you have given explicit permission for specific processing activities (e.g., marketing communications).
• Contractual Necessity: To perform our contract with you and provide the Service you have requested.
• Legitimate Interests: To maintain and improve our Service, ensure security, and carry out internal research.
• Legal Obligations: To comply with applicable laws and regulations.

5. Information Sharing and Disclosure

We share your information only in the following circumstances:

5.1 With Service Providers

We may share your data with trusted third-party service providers who perform functions on our behalf, including:

• Payment Processing: PCI-compliant payment processors
• Cloud Storage & Processing: (e.g., Google Cloud, RunPod)
• Analytics: (e.g., Google Analytics)

These providers are contractually obligated to use your data solely for services provided to us and must maintain adequate security standards.

5.2 Legal Requirements

We may disclose your information if required by law or in response to a valid legal request from public authorities.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change in ownership or usage of your personal data.

5.4 With Your Consent

Additional sharing of your data with third parties will only occur when you have provided explicit consent.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law. For example:

• Account & Transaction Data: Retained according to legal and business requirements.
• Content (Photos & Videos): Stored temporarily during processing and kept only for as long as necessary for you to access your generated videos, after which they are securely deleted unless otherwise required.

6.1 Biometric Data Retention and Destruction Policy

This is our public policy on face data, as required by the Illinois Biometric Information Privacy Act and similar laws in other states, including Texas, Colorado and Washington. "Face data" means a face template (a measurement of the geometry of a face that can be compared with other faces) and the results of analysing or comparing faces. We use face data only for the safety purposes below. We never sell, lease, trade or otherwise profit from face data.

• Upload age and safety checks. When a photo is uploaded as a reference, or an image goes through our moderation, automated tools find the faces in it and estimate their apparent age: Amazon Rekognition (face detection and age range), Sightengine (detection of minors) and AI vision models from Alibaba Cloud. Purpose: keeping anyone under 18, and real people shown without their consent, off the Service. No face template is created. The age estimates and the number of faces found are kept with the moderation record of the upload, together with the photo itself, for safety and legal compliance. Records made before October 2026 may also hold the positions of facial features (eyes, nose, mouth) that these tools reported. When our team rejects an upload by hand, that exact file is blocked by its fingerprint (a hash of the file), which is not face data.
• Reference photo recreation. Amazon Rekognition finds the faces in a reference photo so they can be masked before the picture is redrawn with new faces, and reads the age of the youngest face again. Purpose: the new picture does not show the real people in the photo, and minors are kept out. Nothing is kept: the face positions are used once and discarded.
• TAKE IT DOWN block list. When a person asks us under the TAKE IT DOWN Act to remove intimate images or deepfakes of them, and gives us their signed written consent, we can create a face template from a photo of them and compare every future upload with it (Amazon Rekognition face search). Purpose: stopping new uploads of that person. The uploader's face is compared, not stored. The template is kept until the person asks us to remove it, and no longer than three years after their request.
• Takedown searches. To find copies of a reported person, our team can compare their face with the uploads approved in the previous 31 days. The comparison runs only when the search is made. No face template of the person or of any uploader is created or kept; only the list of matching uploads and their similarity scores is kept with the takedown record.
• Celebrity recognition. Some uploads are compared with Amazon Rekognition's catalogue of public figures to block deepfakes of well-known people. No face template is created; if a public figure is recognised, only their name and the match confidence are kept with the moderation record.

Consent. Before we analyse a reference photo, we ask the uploader to confirm that they are the person shown or have that person's consent to the analysis described here. A face is added to the TAKE IT DOWN block list only with the signed written consent of the person or their legally authorized representative.

Destruction. We destroy face data when the purpose for which it was collected has been met, or within three years of the person's last interaction with us, whichever comes first, unless a valid warrant or subpoena requires us to keep it. Face templates are destroyed by deleting them from the Amazon Rekognition collections in our AWS account; deletion is permanent.

Disclosure and security. We disclose face data only to the service providers that process it for us under contract (Amazon Web Services, Sightengine and Alibaba Cloud), where the law requires it (for example reports to the National Center for Missing & Exploited Children), or with the person's consent. Face templates are stored with Amazon Web Services in the United States, are available only to the systems and staff that need them, and are protected at least as carefully as our other confidential information.

To ask what face data we hold about you, or to have it deleted, email contact@spicygen.com.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Maintain Sessions: Store session and authentication information.
• Enhance Experience: Remember your preferences and settings.
• Analytics: Understand usage patterns to improve our Service.

Your Choices:You can control cookie settings through your browser or use any provided cookie management tools. Please note that disabling cookies may affect the functionality of certain features on our Service.

8. Data Security

We implement robust technical and organizational measures to protect your data, including:

• Encryption: Data transmitted over the Internet is encrypted using protocols such as HTTPS.
• Secure Storage: Your information is stored on secure servers with restricted access.
• Ongoing Monitoring: Regular security assessments and updates to safeguard against unauthorized access.

Content Security: We implement specific security measures for user-uploaded content:

• Secure storage with access controls
• Encryption of sensitive content
• Audit trails for content access and processing
• Secure deletion practices when content is removed

Verification Data: Any verification information collected is:

• Stored separately from general user data
• Subject to enhanced security measures
• Accessible only to authorized personnel
• Retained only as long as necessary for legal compliance

Please note: No method of transmission or storage is 100% secure. In the unlikely event of a data breach, we will follow our breach response protocol.

9. Your Data Protection Rights

Depending on your jurisdiction, you may have rights regarding your personal data, including:

9.1 For EEA Users (GDPR / Cyprus Law 125(I)/2018)

• Right to Access: Request copies of your personal data.
• Right to Rectification: Request correction of inaccurate data.
• Right to Erasure: Request deletion of your data under certain conditions.
• Right to Restrict Processing: Limit the processing of your data.
• Right to Data Portability: Receive your data in a structured, commonly used format.
• Right to Object: Object to processing under certain circumstances.

9.2 For California Residents (CCPA)

• Disclosure Rights: Request a description of the personal information we collect and share.
• Deletion Rights: Request deletion of your personal information, subject to legal exceptions.

9.3 Exercising Your Rights

To exercise any of these rights or if you have any privacy-related concerns, please contact us at:
Email: contact@spicygen.com
We will verify your identity as necessary and respond within 30 days (or one month) as required under GDPR Article 12 and Cyprus Law 125(I)/2018. If you are unsatisfied with our response, you have the right to lodge a complaint with the Cyprus supervisory authority:

• Commissioner for Personal Data Protection (Cyprus)
  Website: www.dataprotection.gov.cy
  Email: commissioner@dataprotection.gov.cy
  Address: 1 Iasonos Street, 1082 Nicosia, Cyprus

10. International Data Transfers

SpicyGen AI is established in the Republic of Cyprus, which is an EU member state. Personal data processed within Cyprus and the European Economic Area (EEA) is protected by the GDPR and does not require additional transfer safeguards.

Where your data is transferred to third-party service providers located outside the EEA (for example, to cloud infrastructure or AI processing providers in the United States), we implement appropriate safeguards including EU Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure your data remains protected to a standard equivalent to that required under EU law. A list of categories of our third-party sub-processors is available on request by emailing contact@spicygen.com.

11. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected personal data from a child under 18, we will take steps to promptly delete the information. If you believe that we have collected data from a minor, please contact us immediately at contact@spicygen.com.

12. Marketing Communications

We only send promotional communications to users who have opted in. If you have provided consent to receive marketing emails, you may unsubscribe at any time by clicking the unsubscribe link provided in each email or by contacting us directly. Opting out of marketing communications will not affect essential transactional or service-related messages.

13. Automated Decision Making and AI Processing

Some aspects of our Service, including automated upload analysis and AI video generation from generated reference images, are performed by fully automated processes. Please note:

• No Solely Automated Decisions: These processes do not result in decisions that have legal or similarly significant effects on you.
• Human Oversight: If you have concerns about automated processing, you may request human intervention or clarification regarding how your data is processed.

14. Third-Party Links and Services

Our Service may include links to third-party websites or integrations with third-party services. We do not control these external sites and are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party sites you visit.

15. Data Breach Notification

In the unlikely event of a personal data breach:

• Regulatory Notification: We will notify the Commissioner for Personal Data Protection (Cyprus) within 72 hours of becoming aware of the breach, as required under GDPR Article 33 and Cyprus Law 125(I)/2018.
• User Notification: Where the breach is likely to result in a high risk to your rights and freedoms, we will notify affected users without undue delay as required under GDPR Article 34.
• Mitigation: We will implement additional measures to prevent future breaches and minimise any adverse impact.

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Any changes will be communicated by:

• Updating the "Last Updated" date at the top of this Policy.
• Providing notifications via email or prominent notices on our website, where appropriate.

Your continued use of our Service after any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this Policy periodically.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: contact@spicygen.com

18. Our Commitments

Find more links and information about us on our Linktree page: linktr.ee/spicygen.