← Back to Kaleipix

Privacy Policy

Last updated: March 17, 2026 — Version 1.0

1. Who We Are

Kaleipix is operated by [Company Name — to be filled upon incorporation]. For privacy inquiries, contact us at privacy@kaleipix.cloud.

2. What Data We Collect

Account Data

Data	Purpose	Retention
Email address	Authentication (login codes), account recovery, billing notifications	Account lifetime + 30 days
Username	Workspace URL, display	Account lifetime + 30 days
Telegram ID	Bot account linking (optional)	Account lifetime + 30 days

Generated Content

Data	Purpose	Retention
Source images you upload	Input for AI generation	Until you delete them
Generated images	Your results	Until you delete them
Prompts	Generation instructions, history	Until you delete them

Generation Logs

Data	Purpose	Retention
User ID, prompt text, model used, timestamp	Legal compliance, dispute resolution, abuse prevention	12 months

Anti-Fraud Data

Data	Purpose	Retention
Browser fingerprint (hash only)	Multi-account abuse detection	90 days
IP address (hashed)	Rate limiting, abuse detection	90 days
User-Agent, Accept-Language headers	Automated bot detection	90 days

Payment Data

Payment processing is handled by Lemon Squeezy (for web subscriptions) and Telegram (for Stars purchases). We do not store credit card numbers, bank details, or payment credentials. We receive only: transaction confirmation, plan selected, and amount paid.

3. Legal Basis for Processing (GDPR)

• Contract performance (Art. 6(1)(b)): Account data and content storage are necessary to provide the service you signed up for.
• Legitimate interest (Art. 6(1)(f)): Anti-fraud data (fingerprint, IP hash) is collected to prevent abuse. This is minimized to hashes only — no raw identifying data is stored.
• Legal obligation (Art. 6(1)(c)): Generation logs are retained for 12 months for legal compliance.

4. Data Sharing

We share data with:

• AI model providers (RunPod, fal.ai): Your source images and prompts are sent to these services for generation. They process this data according to their own privacy policies. We do not control their data retention.
• Payment processors (Lemon Squeezy, Telegram): Transaction data for billing.
• Law enforcement: Only when legally required (court order, CSAM report).

We do not sell, rent, or trade your personal data. We do not use your data for advertising. We do not share your content with other users unless you explicitly create a share link.

5. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access your data — request a copy of all data we hold about you.
• Rectification — correct inaccurate data.
• Erasure ("right to be forgotten") — request deletion of your account and all associated data.
• Data portability — receive your data in a machine-readable format.
• Object to processing based on legitimate interest.
• Lodge a complaint with your local data protection authority.

To exercise these rights, email privacy@kaleipix.cloud. We respond within 30 days.

6. Cookies and Tracking

Kaleipix uses:

• Session cookie: Essential for authentication. Expires after 30 days of inactivity. Cannot be disabled (the service won't work without it).
• Language preference: Stored in localStorage. Not transmitted to the server.
• Browser fingerprint: Collected via FingerprintJS for anti-fraud purposes. Only the hash is stored — no raw device data. This is not used for advertising or cross-site tracking.

We do not use analytics trackers (Google Analytics, Facebook Pixel, etc.). We do not set third-party cookies.

7. Data Security

• All data is transmitted over HTTPS.
• Each user's data is stored in an isolated workspace (separate database and file storage).
• Passwords are not used — authentication is via time-limited email codes.
• Anti-fraud signals use one-way hashes (SHA-256) — the original IP address and fingerprint cannot be recovered.

8. Data Retention Summary

Data type	Retention
Account data	Until deletion + 30 days
Images and prompts	Until you delete them
Generation logs	12 months
Anti-fraud signals	90 days
Payment records	As required by tax law (typically 7 years)

9. International Transfers

AI generation is processed by RunPod and fal.ai, whose servers may be located in the United States. By using the service, you acknowledge that your source images and prompts are transmitted to these providers. We rely on the provider's data processing agreements for compliance with EU data protection requirements.

10. Children

Kaleipix is not intended for users under 18 years of age. We do not knowingly collect data from minors. If we learn that a minor has created an account, we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. Significant changes will be communicated via email or an in-app notice. The version date at the top of this page indicates when the policy was last revised.

12. Contact

For privacy questions: privacy@kaleipix.cloud