Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how Nitid AI ("we", "us", or "our") collects, uses, shares, and protects information when you use our website (www.nitidai.com), web application (tools.nitidai.com), and related services (collectively, the "Service"). It applies to all users worldwide. By using the Service, you acknowledge the practices described here. If you have questions, contact us at support@nitidai.com.

2. Summary (TL;DR)

If you read nothing else, here are the essentials:

• We store the images you upload only as long as needed to process them, and automatically delete them from our storage shortly afterward.
• We do NOT use your images to train AI models.
• Payments are handled by Dodo Payments; we never see or store your full card number.
• We do not use third-party advertising or analytics trackers, and we do not sell your data.
• You can request access to, correction of, or deletion of your personal data at any time.

3. Information We Collect

We collect the following categories of information:

• Account information: your email address and display name, provided when you register or update your profile.
• Images you upload: the product photos you submit for processing, and the generated output images.
• Payment metadata: package purchased, amount, currency, and transaction status, processed by Dodo Payments (we do not collect or store full card numbers).
• Device and connection data: IP address, browser and device type, and language, collected through standard server and CDN logs to operate, secure, and improve the Service.

4. How We Use Your Information

We use the information described above to:

• Provide the Service: authenticate you, process your images, manage your credits and orders, and deliver results.
• Communicate with you about your account, transactions, and service notices.
• Secure the Service: prevent abuse, fraud, and unauthorized access, and enforce our Terms.
• Improve the Service: understand usage patterns and diagnose issues to develop new features.
• Comply with legal obligations and respond to lawful requests.

5. Image Processing and Storage

Your uploaded and generated images are stored in a private Cloudflare R2 bucket. Images are accessed only through short-lived, expiring signed URLs, and are automatically deleted by our cleanup process after processing. We do not use your images to train, fine-tune, or develop AI models, and we do not make them publicly accessible.

• Input and output images are referenced internally by storage keys, never exposed to other users.
• If processing fails, any uploaded image is deleted and any consumed credits are refunded.
• You should retain your own copies of any image you wish to keep; we are not a long-term storage provider.

6. Payment Processing

All payments are processed by Dodo Payments, our payment partner. When you purchase credits, your payment details are collected and processed by Dodo Payments directly. We receive only limited transaction metadata (such as amount, currency, package, and status) and do not store your full card or banking details. Dodo Payments' own privacy policy governs the handling of your payment data.

7. Analytics and Tracking

We do not use third-party advertising networks, analytics trackers, or cross-site tracking cookies, and we do not sell your personal data. We do not collect or store usage analytics or behavioral data through third-party services. Any logging we perform is limited to standard server and CDN access logs used solely to operate, secure, and maintain the Service.

8. Cookies and Similar Technologies

We use a limited set of cookies and local storage values:

• Essential cookies: an authentication token required to keep you signed in, and a language-preference value. These are necessary for the Service to function and are not used for advertising.
• We do not set non-essential advertising or tracking cookies.
• We honor Do Not Track (DNT) browser signals and do not engage in tracking that would be affected by such signals.

9. How We Share Information (Subprocessors)

We do not sell your personal data. We share limited information only with vetted service providers ("subprocessors") that help us operate the Service, each bound by contractual obligations to protect your data:

• Cloudflare — hosting, content delivery, private object storage (R2), task queues, and security.
• Turso — database hosting for accounts, credits, and task records.
• Dodo Payments — payment processing.
• AI inference partners — AI image-generation inference (receives the image you submit for processing).
• We may also disclose information when required by law, to protect our rights and users, or in connection with a corporate transaction, and we will seek appropriate confidentiality protections where possible.

10. International Data Transfers

Because we use globally distributed infrastructure (including Cloudflare's edge network), your information may be processed and stored in multiple countries, which may have different data-protection laws than your own. When we transfer personal data across borders, we rely on appropriate safeguards, to the extent required by applicable law, such as Standard Contractual Clauses or equivalent mechanisms, and on the protections offered by our subprocessors' own compliance programs.

11. Data Retention

We keep personal data only as long as necessary for the purposes described in this policy:

• Uploaded and generated images: automatically deleted after processing.
• Account information: retained until you delete your account, after which it is deleted or anonymized.
• Usage and access logs: retained for up to 90 days.
• Payment metadata: retained as long as needed for accounting, tax, and dispute-resolution purposes.
• Audit logs (administrative actions): retained for security and compliance purposes.
• Backups are rotated on a regular schedule so deleted data is purged from our systems within a reasonable period.

12. Your Rights

Depending on your location, you may have rights under applicable data-protection laws such as the Personal Information Protection Law of the People's Republic of China (PIPL), the EU/UK GDPR, and the California Consumer Privacy Act (CCPA). These may include the right to access, correct, delete, or port your personal data, to restrict or object to certain processing, and (under the CCPA) to know, delete, correct, and opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising.

• To exercise your rights, email support@nitidai.com. We may verify your identity before acting on a request.
• If you are located in mainland China, you have rights under the PIPL, including to access, copy, correct, and delete your personal information and to withdraw your consent at any time. You may exercise these rights by contacting us.
• We will respond within the timeframes required by law (generally within 30 days).
• You also have the right to lodge a complaint with a supervisory authority in your jurisdiction.

13. Children's Privacy

The Service is not directed to children under 16 (or the minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

14. Data Security

We use technical and organizational measures to protect your information, including:

• Encryption in transit (HTTPS/TLS) for all connections.
• Passwords hashed with PBKDF2 and never stored in plaintext.
• Private object storage with expiring, signed URLs instead of public links.
• Access controls and least-privilege principles limiting access to production systems.
• No method of transmission or storage is 100% secure; we continually work to maintain industry-standard safeguards.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or an in-app notice and update the "Last updated" date above. Your continued use of the Service after the changes take effect constitutes your acceptance of the revised policy.

16. Contact

For any privacy-related questions, to exercise your rights, or to reach our data-protection contact, email support@nitidai.com.