Privacy Policy

1. Introduction and Data Controller

This Privacy Policy explains what personal data OxieAI ("we", "us") collects, how we use it, who we share it with, and the rights you have under the GDPR and the Law of Ukraine "On Personal Data Protection" No. 2297-VI. By using OxieAI, you confirm that you have read this Policy.

Data Controller: OxieAI is operated by Mykhailo Skulskyi, an individual entrepreneur based in Ternopil, Ukraine, who is the data controller responsible for your personal data within the meaning of Art. 4(7) GDPR. For privacy requests, including exercising your rights, contact:

Mykhailo Skulskyi
Ternopil, Ukraine
Email: privacy@oxieai.com
Website: https://oxieai.com

2. Data We Collect

2.1 Account data:

Name and email address.
Password (stored as a salted hash, never in plain text).
Profile settings you choose to configure.

2.2 Payment data:

Payment tokens and transaction references processed by our payment provider. We do not store full card details on our servers.
Credit balance and purchase history.

2.3 Content and technical data:

Images you upload for image or video processing.
Images and videos generated by the Service and custom styles you create.
Technical data: IP address, browser and device identifiers, logs.

3. How and Why We Use Your Data

We process your personal data only where a valid legal basis exists under the GDPR and the Law of Ukraine "On Personal Data Protection" No. 2297-VI.

Purpose	Legal Basis
Providing the Service and generating images	Performance of a contract (Art. 6(1)(b))
Account management and support	Performance of a contract (Art. 6(1)(b))
Processing payments and credits	Performance of a contract (Art. 6(1)(b))
Fraud prevention and security	Legitimate interests (Art. 6(1)(f))
Anonymised usage analytics	Legitimate interests (Art. 6(1)(f))
Tax, accounting, and legal compliance	Legal obligation (Art. 6(1)(c))
Marketing emails (where applicable)	Consent (Art. 6(1)(a))

We do not use your uploads, generated images, or videos to train AI models.

4. Data Retention

Uploaded images: stored for up to 90 days, then automatically deleted.

Generated images: stored for 30 days, then automatically deleted.

Generated videos: stored for 30 days, then automatically deleted.

You can download or delete any result earlier, at any time.

Account data: kept for as long as your account is active. Deleted within 30 days after account closure, except where longer retention is required by law.

Payment records: retained for up to 7 years to comply with tax and accounting law.

Logs: retained for up to 30 days for security and diagnostic purposes.

5. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit (TLS 1.2+), encryption at rest, hashed passwords, access controls, isolated processing environments, and regular security reviews. Our primary infrastructure is hosted in ISO 27001-certified data centres within the European Union. No system is 100% secure, but we work continuously to protect your data.

6. Who We Share Data With (Sub-processors)

We share personal data only with trusted third parties acting as data processors under GDPR Art. 28. Each is bound by a data processing agreement and may only process data on our instructions. Our current sub-processors are:

Provider	Purpose	Location
Hetzner Online GmbH	Cloud hosting, compute, object storage, and outgoing transactional email (verification, receipts, notifications)	Germany / Finland (EU)
Paddle.com Market Limited	Payment processing, Merchant of Record, tax handling	United Kingdom / Ireland
Runware	AI inference — image generation and the text processing behind it	EU (SCCs apply where relevant)
Google Ireland Limited	"Sign in with Google" — we receive your name, email address and profile picture only if you choose this sign-in method	Ireland (EU)

6.1 Hosting and storage: Our servers, databases, object storage, and outgoing email are operated on infrastructure provided by Hetzner Online GmbH in EU-based data centres. Hetzner is ISO 27001-certified. We do not use a separate third-party email marketing or delivery service.

6.2 Payment processing: Payments are handled by Paddle.com Market Limited, which acts as the Merchant of Record. Paddle processes your payment data (including card details) directly and is PCI DSS certified. OxieAI receives only transaction references and billing metadata, not your full card number. Paddle's processing is governed by its own Privacy Notice.

6.3 AI generation: Image generation and the text processing behind it run through Runware, our AI inference provider, which routes each request to the model provider that serves it. The specific models change as better ones become available, so we do not list them here; the safeguards in this section apply to all of them, and Runware holds the licences required for our commercial use of the models it operates. Uploaded images, generated images and any text you enter for a generation are transmitted to Runware solely to process your request and are not used to train AI models. Runware acts as our data processor under a data processing agreement.

6.4 Analytics: We may use privacy-focused analytics tools to monitor Service health. These tools process anonymised usage data only and do not collect personally identifiable information.

6.5 Legal disclosures: We may disclose data if required by law, court order, or to protect our legal rights, users, or the public.

We do not sell your personal data. Ever.

7. Your Rights

Under the GDPR and Ukrainian law you have the following rights. To exercise them, contact privacy@oxieai.com. We respond to verified requests within 30 days.

Access (Art. 15): Request a copy of your personal data.
Rectification (Art. 16): Correct inaccurate or incomplete data.
Erasure (Art. 17): Request deletion of your data, subject to legal retention obligations.
Portability (Art. 20): Receive your data in a machine-readable format.
Restriction (Art. 18): Restrict processing while a dispute is pending.
Object (Art. 21): Object to processing based on legitimate interests or direct marketing.
Withdraw consent: Withdraw any consent at any time, without affecting prior lawful processing.
Complaint: Lodge a complaint with your local supervisory authority. EU authorities: edpb.europa.eu.
Ukraine residents: You may file a complaint with the Ukrainian Parliament Commissioner for Human Rights (Ombudsman) at ombudsman.gov.ua.

8. Cookies

8.1 Essential cookies: Required for authentication and core functionality. Cannot be disabled.

8.2 Analytics cookies: We do not currently use analytics cookies. If we add them, we will ask for your consent first and update this Policy.

8.3 Advertising cookies: We do not show third-party advertising and set no advertising cookies.

8.4 Managing cookies: Because we only set the cookies needed to sign you in and keep the site working, there is nothing to switch off on our side. You can delete or block cookies in your browser settings at any time; if you block them, you will not be able to stay signed in.

9. International Data Transfers

Our primary infrastructure is located within the European Union. Some sub-processors (for example, certain AI model providers) may be located outside the European Economic Area. In such cases, transfers are protected by Standard Contractual Clauses approved by the European Commission, adequacy decisions, or other lawful mechanisms under Chapter V of the GDPR. You may request a copy of the relevant safeguards by emailing privacy@oxieai.com.

10. Age and photographs of children

Who may hold an account. The Service is intended for users aged 18 and older. We do not knowingly create accounts for, or collect account data from, anyone under 18. If we learn that an account belongs to a person under 18, we will close it and delete the associated data.

Photographs that show a child. Some of our styles are made for family and children's photography, so a photo you upload may show a child. Where it does, you must be that child's parent or legal guardian, or have the guardian's consent — this is required by our Community Guidelines. We then process the child's image only to carry out the generation you asked for, under the same retention periods as any other upload, and we do not use it to train AI models. A parent or guardian may exercise every right in section 7 on the child's behalf.

If you believe a child's photograph has been uploaded without a guardian's consent, or that an account belongs to someone under 18, contact privacy@oxieai.com and we will act on it.

11. Changes to This Policy

We may update this Policy as our Service, sub-processors, or legal obligations change. For material changes, we will notify you at least 14 days in advance by email or in-app notice. The updated date is always shown at the top of this page. Continued use of the Service after the effective date constitutes acceptance.

12. Contact

For questions about this Policy or to exercise your rights, contact us:

Email: privacy@oxieai.com
Website: https://oxieai.com