Privacy Policy

XmodelsAI ("we", "us", "the Service") respects your privacy. This Privacy Policy describes what personal data we collect, how we use it, how long we keep it, with whom we share it, and what rights you have. By using the Service, you agree to the practices described here. This policy should be read together with our Terms of Service.

We collect the following categories of personal data:

• Account data — username, email address, password (hashed), account creation date, login timestamps.
• Usage data — generated and uploaded images and videos, prompts, model parameters, generation timestamps, credit balances and history.
• Payment data — invoice records, deposit amounts, gateway transaction IDs. We do not store full card numbers; card payments are processed by our payment partners.
• Technical data — IP address, browser, device, referrer, language, timezone, ad-tracking cookies (UTM and click IDs).
• Moderation metadata — automated and human review labels, risk scores, reasons for blocks or removals, and records of enforcement actions.

We use your data to operate the Service (account, generation, payment, support); to enforce our Acceptable Use Policy and prevent abuse, fraud, and illegal content; to comply with legal obligations including obligations relating to child sexual abuse material (CSAM) and law-enforcement requests; and to secure, maintain, and improve the Service. Generated content is private to your account by default and only becomes public if you explicitly choose to publish it.

For the purposes of EU data protection law (including the General Data Protection Regulation), XmodelsAI acts as a data controller for personal data processed in connection with your account and your use of the Service. We process personal data on the following legal bases: (i) performance of a contract (to provide and operate the Service), (ii) compliance with legal obligations (illegal content, CSAM, law-enforcement requests), and (iii) our legitimate interests in securing, maintaining, and improving the Service, preventing abuse, and protecting our users and third parties. Where required by law, certain processing may also be based on your consent.

In addition to training data and generated content, we may process upload logs (timestamps, IP addresses, device information, file identifiers, prompts and parameters), abuse reports (the content of the report, reporter information, follow-up communications), and moderation metadata (review labels, risk scores, reasons for blocks or removals, records of enforcement actions) to operate the Service safely, investigate misuse, and comply with our legal obligations.

We generally retain logs and moderation records only for as long as necessary for the purposes described above, for example: security and operational logs for a limited period (such as 12–24 months), and abuse and moderation case files for the duration of the investigation and any related proceedings, and for a reasonable period thereafter where required for record-keeping, dispute resolution, or to comply with legal obligations. In some cases, legal obligations (including obligations regarding illegal content or active investigations) may require us to retain certain data for longer periods. When data is no longer needed, we take steps to delete or irreversibly anonymize it.

We do not sell your personal data. We share data only with categories of service providers that are necessary to operate the platform: AI inference providers (which receive your prompts and any uploaded images to generate the requested output), cloud hosting and storage providers (which store the generated content and operational data), payment processors (which receive the data needed to take payment), email delivery providers, and advertising-attribution partners (for users who arrived via paid advertising campaigns). Each is bound by appropriate confidentiality and data-protection commitments.

We may cooperate with and disclose relevant information to law-enforcement authorities and competent regulators when we have a good-faith belief that such disclosure is necessary to (i) comply with applicable law or a valid legal request, or (ii) prevent, detect, or respond to illegal activities or serious harms, including the creation or distribution of non-consensual intimate images, deepfakes used for harassment or extortion, CSAM, exploitation of minors, or credible threats of violence. Such disclosures are assessed on a case-by-case basis, in accordance with applicable law.

Some of our service providers process personal data on servers located outside the European Economic Area (EEA), including in the United States and other countries. When data is transferred to a country that the European Commission has recognised as providing an adequate level of data protection (including transfers under the EU-US Data Privacy Framework, where applicable), we rely on that adequacy decision.

Where no adequacy decision applies, we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission, together with supplementary technical and organisational measures, as a safeguard under Article 46 GDPR. A list of the countries to which your personal data may be transferred, together with a copy of the safeguards in place, is available on request at [email protected].

Depending on your jurisdiction (in particular under the GDPR), you may have the right to access, rectify, delete, restrict, port, or object to the processing of your personal data. You also have the right to lodge a complaint with your local data-protection authority.

To exercise any of these rights — including requesting the deletion of your account and associated data — contact us at [email protected]. We will respond within the time frames required by applicable law.

We use cookies and similar technologies for authentication, age verification, security, and (where applicable) ad-attribution tracking from advertising networks that referred you to our site. Most browsers allow you to manage or block cookies; doing so may affect functionality.

We may update this Privacy Policy from time to time. When we do, we'll post the changes on this page. By continuing to use the Service after changes are made, you accept those changes.

[email protected]