Privacy Policy

1. Introduction

Welcome to PicBanao ("we", "our", or "us"). We operate picbanao.com (the "Site") and provide an AI image generation platform and studio tools. Your privacy is of paramount importance to us. This Privacy Policy describes how we collect, process, and protect your information when you interact with our platform.

To maintain domestic compliance under Indian law, this privacy notice is available upon request in all 22 scheduled Indian languages.

2. Data We Collect

We believe in data minimization. We only collect information that is strictly necessary to run the Site and provide our services:

• Account Information: When you sign up, we collect your email address, name, and authentication tokens (e.g., Google OAuth) to securely provision and manage your account.
• Billing Information: We use secure third-party processors to handle subscriptions and Wallet credit purchases. **Razorpay** handles domestic INR transactions, while **Stripe** processes international USD payments. We store your billing history and subscription status, but we **never** store raw credit card numbers on our servers.
• Technical Logs: Our network providers record basic server logs including IP addresses to protect against malicious scrapers and DDoS threats.

3. AI Generation & Data Handling

Our core service involves AI image generation, which requires specific privacy safeguards:

• Zero-Data Training: We guarantee that your text prompts, uploaded reference images, and generated images are **never** used by us to train or fine-tune foundational AI models.
• Third-Party Processing: To generate images, your prompts are securely transmitted to enterprise-grade cloud GPU providers. These partners process the request in isolated environments and are contractually prohibited from logging your data or using it for model training.
• Data Storage & Lifecycle: User assets and generated outputs are securely staged in **Cloudflare R2**. Any reference images you upload for generation are permanently purged from the bucket immediately after the active generation session concludes. All generated outputs are subjected to an automated 30-day hard-deletion lifecycle policy via Cloudflare R2, regardless of account tier. No data is retained beyond this window.

4. Biometric Data Notice

Because our engine utilizes native latent identity (e.g., PuLID) and FaceDetailer models to map and lock facial likenesses, extracting mathematical vectors from user selfies is legally classified as collecting biometric data.

• Purpose: Facial data is processed strictly for the purpose of generating highly accurate, identity-consistent visual outputs during your active session.
• Immediate Deletion: We confirm the immediate and irreversible deletion of all identity vectors and biometric data post-generation. We do not store facial models.
• Consent: By uploading a selfie or reference image for face-locking, you provide explicit consent at the point of upload for this temporary vector extraction.

5. Cookie Policy

We use cookies and local storage exclusively for essential site functionality. This includes maintaining your active login session (via **Better Auth**) and processing secure billing transactions. We explicitly use cross-subdomain cookies (.picbanao.com) to maintain secure sessions across our frontend and the studio application. We do not use third-party tracking or advertising cookies.

6. Telemetry Policy (Umami Analytics)

Our telemetry is powered by **Umami Analytics**, a privacy-first analytics utility.

• We do not write or store tracking cookies on your device.
• We do not track you across other websites.
• All data is anonymized; no personally identifiable information (PII) is captured during interaction tracking.

7. International Data Transfers

As a global service, your data (including generated images and account details) may be transferred to and processed in countries other than your own, such as the United States, where our primary GPU clusters and cloud servers are located. By using our service, you consent to these international data transfers under strict security protocols.

8. Information Sharing

We do **not** sell, rent, trade, or share your data with advertising networks or marketing third parties. We may disclose information only if required under legal compliance or to protect against fraud, security exploits, or violations of our Acceptable Use Policy.

9. Your Rights

Depending on your location (including the **India DPDP Act (2026)**, GDPR in Europe, and CCPA in California), you have rights regarding your personal data. You have the **Right to be Forgotten**. You can initiate data erasure workflows to request the export or complete deletion of your account, wallet data, and generated images by emailing us at bkagravat.apps@gmail.com.

10. Changes to this Policy

We may revise this Privacy Policy periodically to reflect changes in our database structures, hosting providers, or compliance laws. All modifications will be published here with an updated "Last Updated" timestamp.