Privacy Policy

Last updated: September 10, 2026

GPT Images ("we", "us", "our") respects your privacy. This Privacy Policy explains what personal data we collect when you use our website, studio, and related services (the "Service"), why we collect it, who we share it with, and the choices and rights you have. By using the Service, you acknowledge the practices described here.

1. Information We Collect

1. Account information — name, email address, password (stored only as a secure hash), and profile picture if you sign in with a third-party identity provider (Google, GitHub).
2. Payment information — billing name, email, country, and transaction identifiers. Card numbers and payment credentials are processed directly by our payment processors (Stripe, Creem, PayPal); we never see or store full card numbers.
3. Content you create or upload — prompts, hand-drawn sketches, reference images you upload, annotated markups, and the images you generate (collectively, "User Content").
4. Usage data — pages and features used, generation settings (model, size, quality), credit transactions, task status, and approximate timestamps.
5. Device and log data — IP address, browser type, device type, language, and diagnostic logs used for security and troubleshooting.
6. Cookies and similar technologies — session cookies (required for sign-in), preference cookies (language, theme), and — only where enabled by the site operator — analytics cookies.

2. How We Use Your Information

We use the information above to:

• Provide, operate, and maintain the Service — including transmitting your prompts, sketches, and reference images to the AI generation provider to produce your images;
• Process purchases, grant and deduct credits, handle refunds, and prevent fraud;
• Save your generation history and versions so you can revisit and iterate on them;
• Enforce our Terms of Service, including content-compliance moderation;
• Communicate with you about your account, orders, security alerts, and support requests;
• Analyze and improve performance, reliability, and user experience.

We do not sell your personal data, and we do not use your User Content to advertise to you.

3. Who We Share It With

1. AI generation provider. To create or edit an image, your prompt, sketches, and reference images are transmitted to our AI provider (currently APIMart, which routes requests to OpenAI's models). Generated results are returned to us and stored on your behalf. The provider processes this data under its own privacy commitments; images uploaded for generation are stored by the provider only temporarily (up to 72 hours).
2. Payment processors. Stripe, Creem, or PayPal receive the billing details necessary to process your purchase, under their own privacy policies.
3. Infrastructure providers. Cloud storage and hosting providers that store the Service's data on our behalf.
4. Legal and safety. We may disclose information where required by law, court order, or to protect the rights, safety, and security of users or the public — including reporting suspected child sexual abuse material to the relevant authorities.

We do not otherwise share your personal data with third parties for their own marketing purposes.

4. AI-Generated Content and Provenance

Every image generated through the Service embeds C2PA content credentials and an imperceptible watermark identifying it as AI-generated. These markers persist with the file and may be readable by platforms and tools that check for AI provenance. Do not remove or obscure them; applicable laws may require you to disclose the AI-generated nature of the content when you publish it.

5. Data Retention

• Account and billing records are kept while your account is active and as long as required for tax and accounting obligations.
• Generated images and history are kept until you delete them or your account.
• Uploaded reference images and sketches are kept while the associated project or history exists; copies transmitted to the AI provider expire on their side within 72 hours.
• Logs are retained for a limited period appropriate to security and abuse-prevention purposes.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access, correct, or download your personal data;
• Delete your account and associated User Content;
• Object to or restrict certain processing;
• Withdraw consent where processing is based on consent;
• Lodge a complaint with your data protection authority.

To exercise any of these rights, open a ticket in the Support area of your account. Deleting your account removes your profile, credits balance, and generated content from active systems; residual copies in backups expire on a fixed schedule.

7. Data Security

We protect data with encryption in transit (HTTPS), hashed password storage, access controls, and — where configured — encryption of sensitive settings at rest. No method of transmission or storage is perfectly secure; if we learn of a breach affecting your personal data, we will notify you and the authorities as required by law.

8. International Transfers

Your data may be processed in countries other than your own, including where our AI provider and infrastructure providers operate. Where required, we rely on appropriate safeguards for cross-border transfers.

9. Children's Privacy

The Service is not directed at anyone under 18 (or the age of majority in their jurisdiction), and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

10. Cookies

We use strictly necessary cookies for authentication and security, and preference cookies for language and theme. You can block cookies in your browser settings, but sign-in will not work without session cookies. If analytics are enabled on this site, they are configured to respect applicable consent requirements.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced through the Service or by email before they take effect, and the "Last updated" date above always shows the current version.

12. Contact Us

For privacy questions, requests, or complaints, please open a ticket in the Support area of your account. We aim to respond within two (2) business days.