Privacy Notice
Last updated: November 6, 2026
This notice describes the information AIShopFlow processes, why it is used and how to contact us. Private creative assets are not automatically published to a public gallery.
01Information we process
Account email, password hashes and login identifiers; identifiers, email and verification status supplied by Google sign-in; product/person images, scripts, prompts and outputs you submit; job status, budget reservations, order/subscription records; and contact requests. Hosting providers may log IP addresses, request times and technical errors. Do not upload card numbers, passwords or unnecessary sensitive information.
02Purposes and legal bases
We use this information to deliver accounts/jobs, enforce asset ownership, reconcile payments, handle requests and prevent abuse. Where applicable, bases include performing the service contract, legal obligations, necessary and balanced security/operational legitimate interests, and consent where required. You choose which optional material to submit.
03Browser storage
Your browser stores language, theme and motion preferences and local drafts in IndexedDB. Password-login tokens are stored locally; Google sign-in uses short-lived cookies with security attributes. Clearing browser data removes local drafts/sign-in state, but does not delete server-side jobs or billing records. This site currently does not integrate advertising trackers.
04Providers and international processing
Cloudflare Pages hosts the frontend and admin; Render in US East hosts the API; Neon PostgreSQL in US East stores accounts/jobs; Cloudflare R2 in Eastern North America stores private assets. Google handles sign-in and Creem handles checkout/billing when enabled. When model jobs are enabled, necessary prompts/references are sent to the configured provider (currently Alibaba Cloud DashScope). No generation job is created on your behalf unless you submit one. This may involve international processing, subject to provider terms and applicable law. Generation prompts and a pseudonymous task identifier are sent to the Creem Moderation API for safety screening. Rejected requests or unavailable screening are not forwarded to the generation model. Do not include unnecessary personal information in prompts. Uploaded images and videos are submitted to Alibaba Cloud DashScope vision models through temporary signed private links for visual screening. Up to 10 frames are sampled across the video; audio is not screened. Sampling can miss brief content and does not guarantee detection of every violation. Assets cannot be used for generation until approved; rejected assets and screening outages are blocked. We retain review status, content hashes and provider receipt identifiers, without recording signed links, frames or transcripts in review logs.
05Asset and payment security
The server verifies account ownership before returning private assets; archived results use object keys rather than public bucket access. Passwords are hashed; we do not store full card details. We do not train our own foundation models on uploads. Provider handling is governed by its applicable policies; this is not a blanket zero-retention promise for all providers.
06Retention and deletion
Accounts/assets are retained to provide history until no longer needed or a verified deletion request is processed. Financial, fraud-prevention, legal obligations and necessary backups may require longer retention. Complete self-service deletion is not yet available; request account/asset deletion or export through the contact page. Clearing a local draft does not undo completed model calls or records providers must retain.
07Your choices and rights
You can avoid Google sign-in, choose not to upload assets or clear local preferences. Depending on your location, you may have rights to access, correct, export, delete, restrict, object or withdraw consent, and complain to a regulator. We verify identity to protect others’ data. Withdrawal does not invalidate prior lawful processing.
08Contact and updates
Submit privacy and data-rights requests through Contact or email zhouyushi@gravityarc.top. This service is not directed to children; contact us about improperly submitted children’s data. Changes will be dated here and new consent requested where required.