Privacy Policy

The data controller is Nikola Tech Group SIA, registration number 40203773109, Rēzeknes nov., Feimaņu pag., Feimaņi, "5" - 5, LV-4623, Latvia.

We process the following categories of data.

• Account information — name, email address, hashed password, authentication provider identifiers, account status and preferences.
• Uploaded images — the product photographs you upload, together with technical metadata such as dimensions, format, file size and a content hash.
• Generated images — the images produced from your uploads, together with provenance records describing how they were generated.
• Product and workspace data — product names, categories, SKUs, notes and Brand Kit settings.
• Billing data — plan, subscription status, billing period and payment provider identifiers. Full card details are handled by the payment provider and are not stored by us.
• Support messages — the contents of messages you send through the contact form or by email.
• Logs — technical records of requests and errors, retained for security and troubleshooting.
• Device and security information — a hashed IP address and a truncated browser user agent, used for rate limiting and abuse prevention.

• To provide the service — creating and maintaining your account, storing your products and producing the images you request.
• To operate billing — managing subscriptions, invoices and plan entitlements where paid plans are active.
• To provide support — answering your messages and investigating issues you report.
• To keep the service secure — detecting and preventing abuse, fraud and unauthorised access.
• To comply with legal obligations — including accounting and tax record-keeping.
• To improve the service — diagnosing errors and understanding failures in the generation pipeline.

When you request a photoshoot, the reference images for the selected product and the scene instructions are transmitted to the configured AI generation provider so that output images can be produced.

We keep a provenance record for each generated asset, including the provider, model, prompt template version and content hashes of the inputs and output. Where the provider adds machine-readable AI metadata to the file, we preserve it rather than removing it.

We use the following categories of service provider. The list reflects the current configuration of the service.

• Hosting provider — Serving the application and processing requests.
• Database provider — Storing account, product, generation and billing records.
• Storage provider (Application server file system) — Storing uploaded reference images and generated assets.
• AI generation provider — Processing uploaded product images and scene instructions to produce generated imagery.

We do not sell personal data and we do not share it with third parties for their own marketing purposes.

• Account data is kept while the account exists.
• Uploaded and generated images are kept until you delete them or delete your account, after which they are queued for removal.
• Support messages are kept for as long as needed to handle the request and to evidence how it was resolved.
• Billing and accounting records are kept for the period required by applicable law, which may extend beyond account deletion.
• Security logs are kept for a limited period and then deleted.

Subject to the conditions in applicable data protection law, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with your local data protection authority.

Account settings include controls to export your data and to delete your account. You can also contact us using the details below.

• Passwords are stored hashed, never in plain text.
• Uploads are validated server-side and stored under randomly generated object names.
• Stored files are not publicly listable and are served through short-lived signed URLs.
• IP addresses are hashed before storage.
• Access to production data is limited to what is necessary to operate the service.

No system is perfectly secure. If a breach affecting your personal data occurs, we will notify you and the relevant authority where the law requires it.

We use cookies that are strictly necessary to operate the service, including authentication, security and preference cookies. Optional cookies are not loaded without your consent. See the Cookie Policy for details.

The service is intended for business use and is not directed at children. We do not knowingly collect personal data from children.

We may update this policy. The version number and last updated date at the top of this page indicate the current revision. Where a change is material, we will notify account holders.