Privacy Policy

1. Introduction

At SpicyGen AI ("we," "our," or "us"), operated by Wayfinity Ltd, a company incorporated in the Republic of Cyprus, we respect your privacy and are committed to protecting your personal data. This Privacy Policy applies to all online services provided by SpicyGen AI and governs the collection, use, disclosure, and safeguarding of your information when you access our website and use our services ("Service"). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) (Regulation 2016/679) as implemented in Cyprus by Law 125(I)/2018. By using our Service, you agree to the terms of this Privacy Policy. If you do not agree with these terms, please do not access or use our Service.

2. Information We Collect

2.1 Personal Information

Account Details: When you register (for example, via Google authentication), we collect your name, email address, and any other information provided by your authentication provider.

Profile Information: This includes any additional details you choose to provide, such as profile images or biographical information.

Other Data: In some instances, we might collect device identifiers, geolocation data, or other information necessary to enhance your Service experience.

2.2 Content

User Content: We process your prompts, the characters you create, and the images and videos you generate on our Service to generate new content based on your prompts. All such content remains your property. As described in our Terms of Service, you grant us a license to use your content to provide and improve the Service, and a separate license to use your content for our marketing and promotional purposes. SpicyGen does not accept image uploads from users. We still hold records of images uploaded while the Service accepted them, as described in section 6.1.

Usage Considerations: The content is used only for the purposes you specify (e.g., generating AI videos) and is handled with the utmost care in compliance with this Privacy Policy.

Content Screening: While the Service accepted image uploads, we used automated technologies to screen uploaded content for the following, and the results are kept with our moderation records:

• Potential copyright violations
• Images of known individuals
• Professional photography
• Other indicators that content may not be owned by the uploader

Biometric Data: SpicyGen does not accept image uploads from users. We still hold face data from uploads made while the Service accepted them, and we still compare faces when someone asks us to remove images of them under the TAKE IT DOWN Act. Each use, how long we keep the data and how we destroy it are set out in section 6.1, Biometric Data Retention and Destruction Policy.

Consent Records: We may maintain records of user attestations regarding content ownership and consent to help resolve disputes and ensure compliance with our Terms.

2.3 Usage Data

We automatically collect information about your interaction with our Service, including:

• Log Data: IP address, browser type, pages visited, and timestamps.
• Device Data: Device type, operating system, and other identifiers.
• Cookie Data: Session IDs, authentication tokens, and other data that help maintain your session.
• Additional Details: This data may be aggregated and anonymized for analysis to improve our Service.

2.4 Analytics

We use analytics tools (DataFast, Google Analytics and Ortto) to understand how users interact with our Service. This information helps us identify trends, optimize performance, and improve the overall user experience. Section 5.1 sets out what each tool receives.

2.5 Security & Content Safety Data

To maintain a safe environment and comply with legal obligations, we collect and process specific data related to content safety:

• Report Data: When you submit a DMCA or abuse report, we collect your contact information, details of the reported content, and the nature of the violation.
• Moderation Logs: We maintain records of content moderation actions, including automated flags and manual reviews.
• Safety Signals: We process technical signals (such as the results of prompt screening and of age checks on generated images and videos) to prevent the distribution of harmful material.

3. How We Use Your Information

We use your data for several key purposes, including:

• Service Provision: To register you as a user, process transactions, generate AI images and videos from your prompts, characters and library images, and provide customer support.
• Service Improvement: To analyze usage patterns, detect and resolve technical issues, and develop new features.
• Communication: To send notifications (such as account alerts or transaction confirmations), respond to inquiries, and, if you have opted in, deliver marketing communications.
• Marketing and Promotion: To display images and videos you create on our website and in other marketing materials, as per the promotional license you grant us in our Terms of Service.
• Legal & Security: To safeguard our Service and its users by preventing fraud, enforcing our Terms of Service, and complying with legal obligations.

3.5 Content Moderation and Safety

We employ various methods to ensure platform safety and prevent misuse:

• Automated Screening: We use AI-powered tools to detect potentially unauthorized or prohibited content.
• User Reporting: We maintain systems for users to report potentially violating content.
• Moderation Team: We may employ human moderators to review flagged content.
• Legal Compliance: We maintain processes to respond to legal requests, including takedown notices.

These moderation activities are conducted to:

• Protect the rights of individuals
• Ensure compliance with our Terms
• Maintain the integrity and safety of our platform
• Fulfill our legal obligations

4. Legal Basis for Processing

Under applicable data protection laws (e.g., the GDPR), we process your personal data based on the following legal grounds:

• Consent: When you have given explicit permission for specific processing activities (e.g., marketing communications).
• Contractual Necessity: To perform our contract with you and provide the Service you have requested.
• Legitimate Interests: To maintain and improve our Service, ensure security, and carry out internal research.
• Legal Obligations: To comply with applicable laws and regulations.

5. Information Sharing and Disclosure

We share your information only in the following circumstances:

5.1 With Service Providers

We share personal data with the service providers below, who process it on our behalf. Each one receives only the data it needs for the purpose shown.

Hosting, storage and delivery

• Cloudflare: runs our website, checks sign-in and report forms for bots, and stores and processes some files. Receives the requests your browser sends us and our responses, including your IP address, device and browser details, prompts and generated content.
• Vercel: runs parts of our website and our background jobs, and stores some files (Vercel Blob). Receives the data those requests, jobs and files contain, such as your IP address, prompts, generated images and moderation records.
• Google (Firebase and Google Cloud): account sign-in (including Sign in with Google and the sign-in link emails), our main database, file storage and background functions. Receives your account details (name, email address, user ID and sign-in method), your prompts, characters and generation history, credit and purchase records, moderation records and support messages.
• Amazon Web Services (S3 and CloudFront): stores and delivers the images and videos you generate. Receives those images and videos, and your IP address when your browser loads them.
• Bunny (Bunny Stream, Bunny Storage and CDN): stores and delivers the videos shown on our site and resizes generated images for display. Receives those videos and images, and your IP address when your browser loads them.

AI generation and content safety

• Alibaba Cloud Model Studio: generates images, videos and Talk videos; rewrites prompts before generation; screens prompts and Talk scripts for prohibited content; estimates the age of people in every generated image and video; describes images and videos our staff publish in our public gallery; and helps our staff draft replies to support messages. Receives your prompts, character descriptions, the library images you start from, Talk scripts and the speech made from them, your generated images and videos, and the text of support messages.
• TypeSafe (Jev): screens prompts before generation for prohibited content, such as minors, real people and non-consent. Receives the text of your prompts.
• Amazon Rekognition (Amazon Web Services): gives a second age estimate for generated images and videos that our first check reads as 18 to 20, and runs the face checks described in section 6.1. Receives those generated images and video frames, photos supplied with TAKE IT DOWN requests, and the images in our moderation records that a takedown search compares.
• Sightengine: checked photos uploaded while the Service accepted uploads for signs of minors and other prohibited content. Received those uploaded photos.
• fal.ai: removes background noise from, and evens out the volume of, the audio in generated videos. Receives those videos.
• ElevenLabs: turns the script you write for a Talk video into speech. Receives the script text.
• OpenAI: writes titles, descriptions and tags for images and videos our staff publish in our public gallery. Receives the prompt used to make each item and an AI-written description of it.

Email and customer support

• Google Workspace (Gmail): our support mailbox and account emails such as purchase receipts. Receives the emails you send us, our replies and your email address.
• MillionVerifier: checks that an email address can receive mail when you sign up. Receives your email address.
• xAI: reads emails in our business mailbox that mention invoices or billing, to find bills we need to pay. Receives the text of those emails, which can include an email you sent us.

Security, fraud prevention and location

• SignupGate: checks new sign-ups for fraud and abuse. Receives your email address and IP address.
• proxycheck.io: finds your country, and whether you are using a VPN or proxy, when our hosting provider does not tell us your country. Receives your IP address.
• ipapi.co: finds your country and, in the United States, your state, so we can apply local rules such as age verification. Receives your IP address.
• ipify: your browser asks ipify for your IP address when you start a card payment, so we can pass it to the payment processor for fraud checks. Receives your IP address.

Age verification

• VerifyMy: verifies your age where the law requires it. Receives your user ID and country. You give any verification details directly to VerifyMy, and we receive only the result.

Payments and affiliates

• Payment processors: take payments, prevent fraud and handle refunds and chargebacks. Receive your email address, IP address, country, the payment details you enter and the details of your order.
• Tapfiliate: runs our affiliate program. If you arrived through an affiliate link, it receives your user ID, the referral details and the amounts of your purchases, so the affiliate can be credited. If you are an affiliate, it holds your affiliate account and payout details.

Analytics

• DataFast: measures visits and sales. Receives the pages you visit, the site you came from, your device and browser details, a visitor ID, and purchase amounts linked to a one-way scrambled (hashed) account ID. It does not receive your name or email address.
• Google Analytics: measures how the Service is used. In your browser it loads only if you accept all cookies, and then receives the pages you visit, your device and browser details and your IP address. Our servers also send it purchase events linked to your user ID.
• Ortto: measures website activity. Receives the pages you visit, your device and browser details and a cookie ID.

Sign-in and messaging

• Discord: if you sign in with Discord, Discord shares your Discord user ID, username and email address with us.
• Telegram: if you sign in with Telegram or use our Telegram bot, Telegram shares your Telegram ID, username and name with us, and carries the prompts you send the bot, the images and videos we send back, and any Telegram Stars payments.

These providers are contractually obligated to use your data solely for services provided to us and must maintain adequate security standards.

5.2 Legal Requirements

We may disclose your information if required by law or in response to a valid legal request from public authorities. For example, US law requires us to report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC). A report includes the content and the account details and IP address linked to it.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change in ownership or usage of your personal data.

5.4 With Your Consent

Additional sharing of your data with third parties will only occur when you have provided explicit consent.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law. For example:

• Account Data: When you delete your account, or ask us to, we delete it within 30 days.
• Transaction Data: Kept for as long as accounting, tax and payment-network rules require.
• Content (Images & Videos): Kept while your account is open so you can access it. After you delete an item or your account, we keep a copy where we need it for legal, safety or payment reasons, for example to investigate abuse reports, respond to lawful requests or resolve payment disputes.
• Moderation and Safety Records: Kept for safety and legal compliance, as described in section 6.1.

6.1 Biometric Data Retention and Destruction Policy

This is our public policy on face data, as required by the Illinois Biometric Information Privacy Act and similar laws in other states, including Texas, Colorado and Washington. "Face data" means a face template (a measurement of the geometry of a face that can be compared with other faces) and the results of analysing or comparing faces. We use face data only for the safety purposes below. We never sell, lease, trade or otherwise profit from face data.

• Upload age and safety checks (past uploads). SpicyGen does not accept image uploads from users. While the Service accepted them, automated tools found the faces in each uploaded photo and estimated their apparent age: Amazon Rekognition (face detection and age range), Sightengine (detection of minors) and AI vision models from Alibaba Cloud. Purpose: keeping anyone under 18, and real people, off the Service. No face template was created. The age estimates and the number of faces found are kept with the moderation record of the upload, together with the photo itself, for safety and legal compliance. Records made before October 2026 may also hold the positions of facial features (eyes, nose, mouth) that these tools reported. When our team rejected an upload by hand, that exact file was blocked by its fingerprint (a hash of the file), which is not face data.
• TAKE IT DOWN block list. Until 2 November 2026, when a person asked us under the TAKE IT DOWN Act to remove intimate images or deepfakes of them and gave us their signed written consent, we could create a face template from a photo of them and add it to a block list (Amazon Rekognition face search), to refuse uploads that showed that person. SpicyGen no longer accepts image uploads, so we no longer create these templates. Templates created before then are kept until the person asks us to remove them, and no longer than three years after their request.
• Takedown searches. To find copies of a reported person, our team can compare their face with the images in our moderation records from the previous 31 days: photos uploaded while the Service accepted uploads, and images generated on SpicyGen that users chose as a starting image. The comparison runs only when the search is made. No face template of the person or of any user is created or kept; only the list of matching images and their similarity scores is kept with the takedown record.
• Celebrity recognition (past uploads). While the Service accepted image uploads, some uploads were compared with Amazon Rekognition's catalogue of public figures to block deepfakes of well-known people. No face template was created; if a public figure was recognised, only their name and the match confidence are kept with the moderation record.

Consent. While the Service accepted reference photos, we asked each uploader to confirm that they were the person shown or had that person's consent to the analysis described here. Faces were added to the TAKE IT DOWN block list only with the signed written consent of the person or their legally authorized representative.

Destruction. We destroy face data when the purpose for which it was collected has been met, or within three years of the person's last interaction with us, whichever comes first, unless a valid warrant or subpoena requires us to keep it. Face templates are destroyed by deleting them from the Amazon Rekognition collections in our AWS account; deletion is permanent.

Disclosure and security. We disclose face data only to the service providers that process it for us under contract (Amazon Web Services, Sightengine and Alibaba Cloud), where the law requires it (for example reports to the National Center for Missing & Exploited Children), or with the person's consent. Face templates are stored with Amazon Web Services in the United States, are available only to the systems and staff that need them, and are protected at least as carefully as our other confidential information.

To ask what face data we hold about you, or to have it deleted, email contact@spicygen.ai.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Maintain Sessions: Store session and authentication information.
• Enhance Experience: Remember your preferences and settings.
• Analytics: Understand usage patterns to improve our Service.

Your Choices:You can control cookie settings through your browser or use any provided cookie management tools. Please note that disabling cookies may affect the functionality of certain features on our Service.

8. Data Security

We implement robust technical and organizational measures to protect your data, including:

• Encryption: Data transmitted over the Internet is encrypted using protocols such as HTTPS.
• Secure Storage: Your information is stored on secure servers with restricted access.
• Ongoing Monitoring: Regular security assessments and updates to safeguard against unauthorized access.

Content Security: We implement specific security measures for user content, including images uploaded while the Service accepted uploads:

• Secure storage with access controls
• Encryption of sensitive content
• Audit trails for content access and processing
• Secure deletion practices when content is removed

Verification Data: Any verification information collected is:

• Stored separately from general user data
• Subject to enhanced security measures
• Accessible only to authorized personnel
• Retained only as long as necessary for legal compliance

Please note: No method of transmission or storage is 100% secure. In the unlikely event of a data breach, we will follow our breach response protocol.

9. Your Data Protection Rights

Depending on your jurisdiction, you may have rights regarding your personal data, including:

9.1 For EEA Users (GDPR / Cyprus Law 125(I)/2018)

• Right to Access: Request copies of your personal data.
• Right to Rectification: Request correction of inaccurate data.
• Right to Erasure: Request deletion of your data under certain conditions.
• Right to Restrict Processing: Limit the processing of your data.
• Right to Data Portability: Receive your data in a structured, commonly used format.
• Right to Object: Object to processing under certain circumstances.

9.2 For California Residents (CCPA)

• Disclosure Rights: Request a description of the personal information we collect and share.
• Deletion Rights: Request deletion of your personal information, subject to legal exceptions.

9.3 Exercising Your Rights

To exercise any of these rights or if you have any privacy-related concerns, please contact us at:
Email: contact@spicygen.ai
We will verify your identity as necessary and respond within 30 days (or one month) as required under GDPR Article 12 and Cyprus Law 125(I)/2018. If you are unsatisfied with our response, you have the right to lodge a complaint with the Cyprus supervisory authority:

• Commissioner for Personal Data Protection (Cyprus)
  Website: www.dataprotection.gov.cy
  Email: commissioner@dataprotection.gov.cy
  Address: 1 Iasonos Street, 1082 Nicosia, Cyprus

10. International Data Transfers

SpicyGen AI is established in the Republic of Cyprus, which is an EU member state. Personal data processed within Cyprus and the European Economic Area (EEA) is protected by the GDPR and does not require additional transfer safeguards.

The service providers listed in section 5.1 process data in several countries. The locations we can confirm are:

• Amazon Web Services stores the images and videos you generate in its Stockholm, Sweden region, inside the EEA.
• Amazon Rekognition runs the age and face checks described in this policy in the United States, and stores face templates there.
• Alibaba Cloud Model Studio processes the prompts, images, videos and other content we send it in its international region in Singapore.

Our other service providers, and the content delivery networks that serve files from locations around the world, may process data outside the EEA, including in the United States. Where a service provider processes your data outside the EEA, we implement appropriate safeguards including EU Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure your data remains protected to a standard equivalent to that required under EU law. Reports we must make to NCMEC under US law are sent to the United States. To ask about the safeguards for a particular transfer, email contact@spicygen.ai.

11. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected personal data from a child under 18, we will take steps to promptly delete the information. If you believe that we have collected data from a minor, please contact us immediately at contact@spicygen.ai.

12. Marketing Communications

We only send promotional communications to users who have opted in. If you have provided consent to receive marketing emails, you may unsubscribe at any time by clicking the unsubscribe link provided in each email or by contacting us directly. Opting out of marketing communications will not affect essential transactional or service-related messages.

13. Automated Decision Making and AI Processing

Some aspects of our Service, including automated content moderation and AI image and video generation, are performed by fully automated processes. Please note:

• No Solely Automated Decisions: These processes do not result in decisions that have legal or similarly significant effects on you.
• Human Oversight: If you have concerns about automated processing, you may request human intervention or clarification regarding how your data is processed.

14. Third-Party Links and Services

Our Service may include links to third-party websites or integrations with third-party services. We do not control these external sites and are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party sites you visit.

15. Data Breach Notification

In the unlikely event of a personal data breach:

• Regulatory Notification: We will notify the Commissioner for Personal Data Protection (Cyprus) within 72 hours of becoming aware of the breach, as required under GDPR Article 33 and Cyprus Law 125(I)/2018.
• User Notification: Where the breach is likely to result in a high risk to your rights and freedoms, we will notify affected users without undue delay as required under GDPR Article 34.
• Mitigation: We will implement additional measures to prevent future breaches and minimise any adverse impact.

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Any changes will be communicated by:

• Updating the "Last Updated" date at the top of this Policy.
• Providing notifications via email or prominent notices on our website, where appropriate.

Your continued use of our Service after any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this Policy periodically.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: contact@spicygen.ai

18. Our Commitments

Find more links and information about us on our Linktree page: linktr.ee/spicygen.