2D Cosplay Studio Privacy Policy

1.1 This Privacy Policy explains how 2D Cosplay Studio ("we," "us," "our," or the "Company") collects, uses, discloses, and protects information in connection with your access to and use of our website, application, and related services (collectively, the "Service").

1.2 This Service is available to users worldwide, with the exception of individuals located in the European Union, the United Kingdom, Switzerland, and Brazil. We take reasonable measures, including geographic access restrictions, to limit use of the Service from these regions. If you access or use the Service from a restricted region, including by circumventing our geographic restrictions, you do so at your own risk, and you acknowledge that this Privacy Policy is designed to comply with United States law and may not satisfy the legal requirements of your jurisdiction. See Section 9 ("International Users & Geographic Restrictions") for additional detail.

1.3 By accessing or using the Service, you agree to the collection, use, and disclosure of information as described in this Privacy Policy. If you do not agree with this Privacy Policy, you must not access or use the Service.

1.4 This Privacy Policy should be read together with our Terms of Service. Capitalized terms not otherwise defined in this Privacy Policy have the meaning given to them in the Terms of Service.

1.5 The Service is not directed to, and may not be used by, individuals under the age of eighteen (18). See Section 8 ("Children's Privacy") for more information.

2.1 Account Information. When you register for an account, we collect your email address and password. During our beta period, we also collect a unique invite code used to grant access to the Service. Passwords are stored in encrypted/hashed form and are not accessible to us in plain text.

2.2 Uploaded Content (Reference Images). If you upload a reference image to generate content through the Service, that image is transmitted to our third-party AI processing provider solely for the purpose of generating your requested output. We do not retain a copy of your uploaded reference image after processing is complete. We retain limited metadata associated with the upload, including the date and time of the request, the generation mode used, the resolution requested, and the number of credits charged. We do not retain the visual content of the image itself.

2.3 Generated Content. Images generated through the Service are stored in your account gallery so that you may view, manage, and redownload them. Generated content is retained until you delete it, delete your account, or as otherwise described in Section 6 ("Data Retention & Deletion").

2.4 Prompts. We log the text prompts you submit in connection with generation requests. We use this information to monitor and maintain the technical performance of the Service and to enforce our Terms of Service, including our content moderation policies.

2.5 Payment Information. All payment processing is handled by Stripe, Inc. ("Stripe"), a third-party payment processor. We do not collect, view, or store your full payment card information. Stripe's collection and use of your payment information is governed by Stripe's own privacy policy, available at stripe.com/privacy. We receive limited transactional information from Stripe, such as confirmation that a payment was completed and the amount charged.

2.6 Cookies and Similar Technologies. We use cookies and similar technologies necessary to operate core functions of the Service, including maintaining your login session, tracking your credit balance, and displaying your gallery. See Section 5 ("Cookies & Tracking Technologies") for more detail.

2.7 Information We Do Not Currently Collect. As of the effective date of this Privacy Policy, we do not use third-party analytics tools, advertising trackers, or similar technologies. If this changes, we will update this Privacy Policy accordingly.

We use the information described in Section 2 for the following purposes:

3.1 To Provide the Service. Including creating and maintaining your account, processing generation requests, delivering generated content to your gallery, and processing payments.

3.2 To Maintain and Improve the Service. Including monitoring system performance, diagnosing technical issues, and reviewing logged prompt data to ensure the generation system is functioning as intended.

3.3 To Enforce Our Terms of Service. Including reviewing prompts and account activity to detect and address violations of our content policies, prohibited use restrictions, and other terms.

3.4 To Communicate With You. Including sending transactional emails related to your account, purchases, and Service updates. If you have opted in, we may also send marketing communications and newsletters. See Section 10 ("Marketing Communications") for more detail.

3.5 To Protect the Service and Our Users. Including detecting, investigating, and preventing fraud, abuse, security incidents, and violations of our Terms of Service.

3.6 To Comply With Legal Obligations. Including responding to lawful requests from courts, law enforcement, or regulatory authorities, and enforcing our legal rights.

3.7 We may use anonymized or de-identified Generated Content for marketing and promotional purposes, as further described in our Terms of Service.

4.1 We do not sell your personal information. We do not share your personal information with third parties for their own independent marketing or advertising purposes.

4.2 Service Providers. We share information with third-party service providers who perform services on our behalf, solely for the purpose of operating the Service. These providers are contractually or otherwise obligated to handle information consistent with the purpose for which it was shared. Our current service providers include:

(a) Google LLC ("Google") — We use Google's AI image generation API to process uploaded reference images and generate output content. Uploaded and generated content is transmitted to Google's servers for processing. Google's handling of this data is governed by Google Cloud's Terms of Service and Privacy Policy. We do not control, and are not responsible for, Google's independent data retention or processing practices.

(b) Stripe, Inc. ("Stripe") — We use Stripe to process payments. See Section 2.5.

(c) Supabase, Inc. ("Supabase") — We use Supabase to manage user account authentication and data storage infrastructure.

(d) Lovable — We use Lovable to host and maintain the Service's website and application infrastructure.

4.3 Legal Disclosures. We may disclose your information if we believe in good faith that disclosure is necessary to: (a) comply with applicable law, regulation, legal process, or governmental request; (b) enforce our Terms of Service, including investigation of potential violations; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect the rights, property, or safety of the Company, our users, or the public, as required or permitted by law.

4.4 Business Transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will provide notice, where required by law, before your information becomes subject to a different privacy policy.

4.5 Aggregated or De-Identified Information. We may share aggregated or de-identified information that cannot reasonably be used to identify you, for any business purpose, including analytics and business development.

5.1 We use cookies and similar technologies that are necessary for the core functionality of the Service. These include:

(a) Authentication cookies — used to keep you logged in and maintain your session as you navigate the Service.

(b) Functional cookies — used to support features such as displaying your credit balance and loading your generation gallery.

5.2 The cookies described above are strictly necessary for the Service to function and cannot be disabled through our Service. You may be able to block or delete cookies through your browser settings; however, doing so may prevent you from logging in or using core features of the Service.

5.3 As of the effective date of this Privacy Policy, we do not use cookies or similar technologies for advertising, cross-site tracking, or third-party analytics purposes. If this changes in the future, we will update this Privacy Policy and, where required by applicable law, provide additional notice or obtain consent.

5.4 We do not currently respond to "Do Not Track" browser signals, as no consistent industry standard for such signals currently exists.

6.1 Account Information. We retain your account information for as long as your account remains active.

6.2 Generated Content. Generated images are retained in your account gallery until you delete them individually, delete your account, or as described below.

6.3 Reference Image Metadata. As described in Section 2.2, we do not retain uploaded reference images. We retain associated metadata (timestamp, mode, resolution, credit cost) for so long as reasonably necessary for record-keeping, fraud prevention, and dispute resolution purposes.

6.4 Prompt Logs. We retain logged prompts for so long as reasonably necessary to monitor system performance and enforce our Terms of Service.

6.5 Account Deletion. If you delete your account, or request that we delete it, we will delete your personal information, including your account credentials and generated content, within ninety (90) days. Some information may be retained for a limited period beyond this window where necessary to comply with legal obligations, resolve disputes, enforce our agreements, or address fraud or abuse.

6.6 No Backup Retention. We do not currently maintain backup copies of deleted data beyond the deletion window described in Section 6.5. Once data is deleted, it is not recoverable.

6.7 Payment Records. Transaction and billing records may be retained separately by Stripe in accordance with Stripe's own retention practices and applicable financial recordkeeping laws, independent of any deletion request made to us directly.

7.1 We offer all users, regardless of location, the following choices with respect to their information:

(a) Access. You may request a copy of the personal information we hold about you by contacting us using the information in Section 13.

(b) Correction. You may update or correct your account information at any time through your account settings, or by contacting us.

(c) Deletion. You may request deletion of your account and associated personal information at any time. See Section 6.5 for details on our deletion process and timeline.

(d) Marketing Opt-Out. You may opt out of marketing communications at any time. See Section 10 ("Marketing Communications") for details.

7.2 We will respond to verified requests under this Section within a reasonable time, and in any event within the timeframes required by applicable law, if any.

7.3 We may need to verify your identity before fulfilling a request under this Section, such as by confirming access to the email address associated with your account.

7.4 Note on Applicable Law. The rights described in this Section are offered as a matter of Company policy and good practice. Depending on your state of residence, you may have additional or different rights under applicable state privacy laws. Because the Company's current scale of operations may not meet the statutory thresholds triggering certain state privacy laws (such as the California Consumer Privacy Act), some legally mandated procedures under those laws may not yet formally apply to the Company. We nonetheless aim to honor the spirit of these rights for all users as described above.

8.1 The Service is not directed to, and is not intended for use by, individuals under the age of eighteen (18). We do not knowingly collect personal information from anyone under the age of eighteen (18).

8.2 By using the Service, you represent and warrant that you are at least eighteen (18) years of age, consistent with the age requirement set forth in our Terms of Service.

8.3 If we become aware that we have collected personal information from an individual under the age of eighteen (18), we will take reasonable steps to promptly delete that information. If you believe a child under eighteen (18) has provided us with personal information, please contact us using the information in Section 13.

9.1 The Service is available to users worldwide, with the exception of individuals located in the European Union, the United Kingdom, Switzerland, and Brazil. We take reasonable measures, including geographic access restrictions implemented through our infrastructure provider, to restrict access to the Service from these regions.

9.2 If you attempt to access the Service from a restricted region, your access may be blocked or limited. If you circumvent these restrictions through a virtual private network (VPN), proxy, or similar means, you acknowledge and agree that this Privacy Policy — which is designed to comply with United States law — governs our collection and use of your information, and that we make no representation that our practices satisfy the legal requirements of the General Data Protection Regulation, the Lei Geral de Proteção de Dados, or any other law of a restricted jurisdiction.

9.3 We do not knowingly direct the Service toward, or market the Service to, individuals located in a restricted region.

9.4 If you are located in a restricted region and believe you have accessed the Service in error, or wish to request deletion of any information collected in connection with such access, please contact us using the information in Section 13.

10.1 During account registration, you may voluntarily opt in to receive marketing communications, product updates, and promotional emails from us by checking an opt-in box. Marketing communications are not sent unless you affirmatively opt in.

10.2 You may withdraw your consent to receive marketing communications at any time by:

(a) clicking the "unsubscribe" link included in any marketing email; or

(b) adjusting your communication preferences in your account settings; or

(c) contacting us using the information in Section 13.

10.3 Even if you opt out of marketing communications, we may continue to send you transactional or administrative emails related to your account, purchases, or the operation of the Service, such as receipts, security notices, or updates to our policies. These communications are not considered marketing and cannot be opted out of while you maintain an active account.

11.1 We implement reasonable technical and organizational measures designed to protect your personal information, including:

(a) Encryption in transit. All data transmitted between your device and our servers is encrypted using HTTPS/TLS protocols.

(b) Encryption at rest. Data stored on our behalf is encrypted at rest in accordance with the standard security practices of our infrastructure providers.

(c) Access restrictions. Access to personal information is restricted to authorized personnel only.

11.2 Despite these measures, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your information, and you acknowledge and accept this risk by using the Service.

11.3 If we become aware of a security incident that compromises your personal information in a manner requiring notification under applicable law, we will notify you and take appropriate steps consistent with our legal obligations and good industry practice.

11.4 You are responsible for maintaining the confidentiality of your account password and for restricting access to your device and account. Notify us immediately if you become aware of any unauthorized use of your account.

12.1 We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.

12.2 If we make material changes to this Privacy Policy, we will notify you by posting the updated Privacy Policy on the Service with a revised "Last Updated" date, and, where appropriate, through additional notice such as email or an in-app notification.

12.3 Your continued use of the Service after any changes to this Privacy Policy take effect constitutes your acceptance of the revised Privacy Policy. If you do not agree to the revised terms, you must stop using the Service and may request deletion of your account as described in Section 6.5.

13.1 If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, you may contact us at 2D Cosplay Studio, Email: support@2dcosplaystudio.com

13.2 We will make reasonable efforts to respond to privacy-related inquiries in a timely manner.