Privacy Policy

1. Introduction

ProtoShop ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered content creation platform ("Service").

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Name (if provided)
• Profile information
• Authentication credentials (securely hashed)
• Payment information (processed by Stripe; we do not store full card numbers)

2.2 Content & Usage Data

When you use our Service, we collect:

• Content you upload (images, videos, audio, text)
• Prompts and inputs you provide for AI generation
• Generated content (images, videos, audio, text outputs)
• Avatar profiles and settings you create
• Usage patterns and feature interactions
• Credit usage and transaction history

2.3 Technical Data

We automatically collect:

• IP address
• Browser type and version
• Device information
• Operating system
• Access times and dates
• Pages viewed and actions taken
• Referring URLs

2.4 AI Assistant (ProtoBot) Data

When you use our AI assistant (ProtoBot), we collect:

• Conversation history: Messages you send and responses you receive
• Communication preferences: Your preferred language style (casual or professional) and AI experience level
• Feedback: Thumbs up/down ratings and comments you provide on responses
• Action logs: Actions the assistant performs on your behalf (e.g., navigating, checking balances)
• Support escalations: Conversations transferred to human support

This data is used to provide personalized assistance, improve response quality, train our systems, and provide customer support. Conversations may be reviewed by our team to improve the service and resolve issues. You can request deletion of your conversation history by contacting privacy@protoshop.ai.

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve our Service
• Process AI generation requests through our third-party providers
• Process payments and manage subscriptions
• Send transactional emails and service updates
• Respond to your inquiries and provide customer support
• Enforce our Terms of Service and detect abuse
• Comply with legal obligations
• Analyze usage patterns to improve user experience
• Prevent fraud and maintain platform security

4. Third-Party Services & Data Sharing

We share data with third parties only as necessary to provide our Service:

4.1 AI Generation Providers

Your prompts and input content are transmitted to third-party AI providers (including but not limited to video, image, audio, and text generation APIs) to process your generation requests. These providers process data according to their own privacy policies.

4.2 Infrastructure & Services

• Supabase: Database and authentication services
• Stripe: Payment processing
• Backblaze B2: Cloud storage for your content
• Vercel: Hosting and deployment
• Resend: Transactional emails

4.3 Legal Requirements

We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

5. Data Retention

We retain your data as follows:

• Account data: Retained while your account is active and for up to 30 days after deletion request
• Generated content: Retained until you delete it or close your account
• Transaction records: Retained for 7 years for legal and tax compliance
• Usage logs: Retained for up to 90 days
• Content flagged for violations: May be retained longer for legal or safety purposes

6. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS) and at rest, secure authentication, access controls, and regular security assessments. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data
• Portability: Request your data in a machine-readable format
• Objection: Object to certain processing of your data
• Restriction: Request restriction of processing
• Withdraw consent: Withdraw consent where processing is based on consent

To exercise these rights, contact us at privacy@protoshop.ai

8. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act:

• Right to know what personal information is collected, used, and shared
• Right to delete personal information
• Right to opt-out of the sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your privacy rights

9. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), we process your data based on:

• Contract: Processing necessary to provide our Service to you
• Legitimate interests: Processing for fraud prevention, security, and service improvement
• Legal obligations: Processing required by law
• Consent: Where you have provided explicit consent

You have the right to lodge a complaint with your local data protection authority.

10. Children's Privacy

Our Service is not intended for children under 13 years of age (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately and we will delete it.

11. Cookies & Tracking

We use cookies and similar technologies to:

• Maintain your session and authentication state
• Remember your preferences
• Analyze usage patterns
• Prevent fraud

You can control cookies through your browser settings, but disabling cookies may affect functionality.

12. International Data Transfers

Your data may be transferred to and processed in countries other than your own, including the United States. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses where required.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact Us

For questions about this Privacy Policy or to exercise your rights, contact us at: