Privacy Policy
This policy explains what personal data GenImgMarket AI keeps, why it is kept, who else receives a copy and what you can do about it.
Who we are
GenImgMarket AI is operated by the company named at the end of this page.
The platform runs a studio and a shop on one account: a prompt becomes a paid generation, and a file from that run can be published for sale as a single copy. The operator decides why and how personal data is processed, which makes it the controller for everything on this page.
The operator's name, registration number and address sit in the block at the end of this page. For anything about your data, write to support@example.com.
What we collect
The register below is everything the service keeps, grouped by where it comes from.
2.1 Your account. When you sign up we store your email address, a hashed password, your first and last name and the date your account was created. Signing in requires a verified email address.
2.2 Your profile. Sign-up also asks for a phone number, date of birth and a postal address: street, city, country and postcode. You can edit these in your profile settings.
2.3 Your generations. Each run stores the prompt you typed, the assembled prompt sent to the model, the settings you chose — style, aspect ratio, resolution, quality, quantity — and a per-run cost breakdown.
2.4 Your money. The euro balance; every transaction with its euro amount and the display currency and exchange rate it was shown in; invoices for top-ups; and orders that freeze the fee and the seller payout of a sale.
2.5 Your correspondence. A message sent through the contact form stores the name, email address and body you give, linked to your account when you are signed in.
2.6 Technical records. A signed-in session stores its IP address, browser user agent and expiry. Email-verification and password-reset tokens are stored until they are used or expire.
How we use it
Every use of your data rests on a legal basis in Article 6 of the GDPR.
Running your account, charging the balance for a generation and settling a sale are steps in our contract with you, so they rest on that contract. Accounting law makes us keep records of top-ups, purchases and sales. Securing the service — rate limits, session expiry, blocking abusive accounts — rests on our legitimate interest.
We do not sell personal data and we do not use it for advertising.
Prompts & AI generation
What a prompt is, where it goes and what stays behind.
When you start a run, your prompt and its assembled form are sent to the image model — OpenAI — to produce the files. The prompt, the settings and the cost then stay as the run's record in your archive.
A failed run, or failed units inside a batch, are refunded to your balance automatically.
Payments & payouts
How money moves, and who touches the card.
The balance is kept in euro. A top-up is charged through the payment provider's hosted checkout: card numbers and CVV go straight to the provider and never reach our servers. The invoice stores the euro amount, the display currency and the exchange rate frozen with it; an unpaid invoice expires after 30 minutes.
A sale splits once, at purchase: the platform keeps 15% and 85% is credited to the seller's euro balance. A confirmed top-up or purchase is confirmed by email with a PDF receipt.
International transfers
Some of the services above process data outside the European Economic Area.
Cloudflare and Google run globally, so a copy of a file, a prompt or an email may be processed outside the EEA.
How long we keep it
How long each kind of record lives.
Profile data, generations, files, transactions and orders are kept while the account is open, so the archive, the ledger and the receipts keep working. A session expires after 30 days, and expired session rows are swept from the database. Verification and password-reset tokens are removed when they are used or expire.
There is no hidden archive: deleting a record deletes it for good.
Security
The service is built so a breach has as little to hand as possible.
Passwords are stored only as hashes, and signing in requires a verified email address. Card data never touches the service: checkout happens on the payment provider's hosted page.
Originals live in a private bucket and are served only through an authorized route; the public bucket holds watermarked previews capped at 1024 px on the longest edge. Generation is limited to 10 runs per hour and the contact form to 5 messages.
Your rights
What you can ask for, and how.
You can see most of this register yourself: the profile and security pages hold your account details and sessions, the ledger shows every transaction, and the order history keeps every receipt.
10.1 Access and portability. Ask for a copy of your data by writing to support@example.com from the account's address.
10.2 Rectification. Profile fields are edited in your profile settings; anything beyond them, ask in the same email.
10.3 Erasure. Self-service deletion is not built yet. Until it ships, erasure runs through support@example.com.
10.4 Objection and restriction. Write to support@example.com; the processing in question stops while the request is checked.
10.5 Complaint. You can complain to your national data protection authority.
Changes to this policy
How this policy changes.
The current text always lives on this page; its version and effective date sit in the line under the title.
Questions about this document
Write to support@example.com and we will get back to you.
Foundation · Reg No: 00000000 · Example Street 1, 10111 Tallinn, Estonia