Privacy Policy

We collect information in three ways: information you provide directly, information generated as you use the Service, and information from third parties (e.g. an OAuth provider).

• Account data: name, email, hashed password, and avatar URL. If you sign in with Google, we receive your name, email, and profile photo from Google.
• Billing data: handled by our payment processor (Stripe, when wired). Frameshot stores only the customer ID, subscription status, and last-four card digits — never full card numbers.
• Inputs and Outputs: prompts, reference images, audio uploads, and the generated media we produce on your behalf. Stored in our Supabase project (private buckets).
• Usage data: credit ledger entries, generation history, IP address, browser, OS, device identifiers, referrer, and timestamps.
• Diagnostic data: redacted error events sent to Sentry. Personal data and prompts are scrubbed before transmission via our logger redaction layer.

• To operate, secure, and improve the Service.
• To provide AI generation by sending your Inputs to model providers (see §4).
• To bill you and prevent fraud or abuse.
• To send transactional emails (verification, receipts, security alerts) and, with your consent, occasional product updates.
• To comply with legal obligations and enforce our Terms.

We do not use your Inputs or Outputs to train our own foundation models without explicit opt-in.

If you are in the European Economic Area or the United Kingdom, we rely on the following GDPR / UK GDPR legal bases:

• Contract: to provide the Service you signed up for.
• Legitimate interests: to secure the Service, prevent abuse, and improve our product, balanced against your rights.
• Consent: for marketing emails and any optional analytics (where required).
• Legal obligation: to comply with tax, accounting, and law-enforcement requirements.

To deliver the Service we share limited data with the following sub-processors. Each is contractually bound to process your data only on our instructions and to maintain appropriate safeguards.

• Supabase — auth, database, storage. Hosts your account data and Inputs/Outputs.
• Vercel — application hosting and edge network.
• Cloudflare — DNS, WAF, bot mitigation, Turnstile challenge.
• fal.ai — image, video, and audio model inference.
• Anthropic — chat-assistant inference.
• ElevenLabs — voice synthesis and cloning (when used).
• World Labs — 3D world generation (when used).
• Cloudflare Workers AI — embedding generation for the assistant’s knowledge base.
• Resend — transactional email delivery.
• Upstash — rate limiting and workflow scheduling (Redis + QStash).
• Sentry — error monitoring with PII redaction.
• Stripe — payments (when wired).
• Google / Dropbox — only if you connect your account to use Drive / Dropbox upload nodes.

We do not sell your personal information.

See our Cookie Policy for details on what we set and why.

• Account data: retained while your account is active and for up to 30 days after deletion (recovery window). After 30 days, account records are anonymised or deleted.
• Inputs and Outputs: retained while you keep them in your workspace. Items you delete are removed within 7 days from primary storage and within 30 days from backups.
• Credit ledger and billing records: retained for at least 7 years to satisfy tax and audit requirements.
• Diagnostic logs: retained for up to 90 days.

We protect your data with industry-standard controls: TLS 1.2+ for all transport, AES-256-GCM encryption for stored OAuth tokens, row-level security on every database table, short-lived signed URLs for all media, strict origin and CSRF checks on every mutation, and continuous secret-scanning in our build pipeline. Despite our efforts, no system is 100% secure; please use a strong, unique password.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data or complete incomplete data.
• Delete your account and the data associated with it.
• Object to or restrict certain processing.
• Receive a copy of your data in a portable format.
• Withdraw consent (where processing is based on consent).

You can exercise most rights from your account settings. For anything not self-serve, email privacy@frameshot.ai and we will respond within 30 days.

Frameshot is operated from the United States. By using the Service from outside the US, you understand that your data will be transferred to and processed in countries that may not have the same data-protection laws as your jurisdiction. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

The Service is not directed to children under 13 (or the applicable minimum age). If we learn that we have collected personal data from a child under that age without parental consent, we will delete it.

Material changes to this policy will be announced via email or in-product notice at least 14 days before they take effect.

Privacy questions or data-rights requests: privacy@frameshot.ai.