01
Controller and contact
The independent operator of Inspixa controls personal data processed through the service. Send privacy, access, deletion, or correction requests to privacy@inspixa.com. Contact support@inspixa.com for general service questions.
02
Information we collect
We collect account data such as email, display name, language preference, authentication account, and session details. We process submitted Prompts, reference images, outputs, favorites, works, and settings. Billing records include order IDs, subscription status, amount, currency, and Credits ledger entries.
Necessary device and usage data may include IP address, User-Agent, request time, error code, visited page, action event, and security audit record. Cloudflare may provide an approximate country or region for language selection, security, and service analysis.
Waffo Pancake processes card numbers, security codes, and full payment credentials directly. They do not pass through Inspixa servers. We receive only payment status and identifiers required for orders and subscriptions.
03
Purposes and legal bases
We process accounts, content, generations, subscriptions, and Credits to perform user requests and our contract. We process technical and audit data for security, fraud prevention, diagnostics, and legitimate operational interests. We retain required records for tax, accounting, regulatory, and legal obligations.
Necessary cookies support login, security, and language preferences. We currently use no advertising cookies and do not sell or rent personal data. Optional analytics or marketing tracking introduced later will be disclosed with applicable choices.
04
AI input and output
Prompts, reference images, and parameters are processed only as needed to fulfill requests, save works, diagnose failures, and maintain accounting. Private content is not made public by default.
When an AI model is enabled, required data may be sent to Cloudflare or a reviewed third-party AI provider. We review retention, training use, location, and subprocessors before release. Private Prompts and images are not used to train Inspixa models without explicit consent.
05
Cookies and analytics
Strictly necessary cookies support session authentication, CSRF protection, and language selection. Disabling them may stop login or preferences from working.
Cloudflare Workers logs and Analytics Engine record aggregate product events, runtime status, and errors. These records are designed to exclude full Prompts, card data, provider private keys, and user BYOK keys.
06
Sharing and processors
We share only what is required to provide the service, comply with law, or protect users and the platform. Primary processors are Cloudflare for Workers, D1, R2, Queues, Workflows, Images, logs, and analytics, and Waffo Pancake for checkout, subscriptions, and payments.
An enabled AI provider receives inputs required for the selected generation. Advisers, authorities, or transaction successors receive data only with an appropriate basis. We do not sell personal data.
07
Security
Measures include encryption in transit, Cloudflare edge protection, access controls, secret isolation, authorization checks, immutable object keys, audit records, and minimized logging. Payment and provider secrets are stored in protected Cloudflare configuration.
If an incident affects personal data, we assess risk and notify authorities and affected users as required by applicable law.
08
Retention and deletion
Account and work data is generally retained while the account remains active. Deleted ordinary content enters a cleanup process targeted for completion within 30 days. Backups and security records may remain for up to 90 additional days.
Request and application logs are generally retained for no more than 90 days. Orders, refunds, and payment records may be retained for up to seven years for tax, accounting, fraud prevention, and disputes. Credits ledgers and audits remain for the period required for performance, disputes, and compliance.
When data is no longer required, we delete, anonymize, or isolate it for limited legal use.
09
Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent and may complain to your local data protection authority.
Submit requests to privacy@inspixa.com. We verify the relationship to the account and generally respond within 30 calendar days. Complex requests may take longer where permitted. Some transaction, security, or audit records may remain when legally required.
10
International processing
Cloudflare, Waffo Pancake, or AI providers may process data outside your country or region. Where required, we rely on adequacy decisions, standard contractual clauses, or other recognized safeguards and contractually limit processing to agreed purposes.
11
Children
The service is intended for people aged 18 or older. We do not knowingly collect personal data from anyone under 18. A guardian who believes a child submitted data may contact privacy@inspixa.com for review and action.
12
Policy changes
We may update this policy as the product, processors, or law changes. We provide at least 14 days' notice of material changes through the site, account notice, or email. The version and effective date identify the current policy.