1. Controller and Scope
Mindrift is the data controller for personal data processed through the website, console, and public API (collectively, the "Service"). Contact our Data Protection Officer at [email protected] for any privacy matter, including rights requests and breach reports.
We process data under the EU General Data Protection Regulation (GDPR) and, where applicable, frameworks such as the California Consumer Privacy Act (CCPA). Using the Service constitutes acknowledgment of this Policy. The Data Privacy Notice details storage, retention, and transfers in practice.
2. Data We Collect
A. Provided by You
- Account: email address, username, avatar, authentication secrets (hashed), role, status, newsletter preference, and other preferences.
- Creations: prompts, reference images, parameters, generated images, collections, likes, and reports.
- Billing: wallet balance, top-up invoices, and fee records. Full card numbers never touch our servers (see Section 3).
- API usage: keys metadata, endpoints called, models, tokens, costs, durations, and error traces.
- Correspondence: support tickets, appeals, and any messages you send us.
B. Collected Automatically
- Security telemetry: IP addresses, user agents, timestamps, and request metadata, used strictly for fraud prevention, rate limiting, and abuse investigation.
- Diagnostics: error logs and performance metrics needed to operate and debug the Service.
- Cookies: strictly necessary cookies for authentication and sessions. Any analytics or marketing storage requires your prior consent and can be withdrawn anytime with equivalent effect.
3. Payments
Card payments are processed entirely by our PCI-DSS Level 1 payment provider. We receive only non-sensitive artifacts: billing tokens, invoice history, and card last-four digits for receipts. We never process, intercept, or store full card numbers, CVVs, or banking credentials.
4. Purposes and Legal Bases (GDPR)
- Contract: account administration, generation and delivery of Assets, wallet billing, API metering, customer support.
- Legitimate interests: platform security (fraud, DDoS, abuse), safety moderation, service improvement and debugging, exercised only after balancing against your rights and limited to what is necessary.
- Legal obligation: tax invoicing and retention, responses to lawful authority requests, CSAM reporting duties.
- Consent: Mindrift news emails (newsletter, product updates, promotions in a single email) and non-essential tracking. Subscription is opt-in only, withdraw anytime from your settings, via the link at the bottom of any email, or at mindrift.art/newsletter/unsubscribe; withdrawal does not affect prior lawful processing and never affects account, security, or billing emails.
5. Sharing and Sub-processors
We never sell personal data and never use your prompts or creations for third-party advertising. Data is shared only with:
- GPU compute providers: prompt payloads are transmitted solely for the duration of the computation and discarded by design. Contractually barred from any secondary use.
- Hosting, CDN, and email delivery: infrastructure strictly necessary to run the Service, bound by data processing terms.
- Payment provider: card transactions only, as described in Section 3.
- Authorities: where compelled by valid legal process, or to report serious criminal activity (notably CSAM), to competent bodies without delay.
A current sub-processor list is available on written request to [email protected]. We notify material sub-processor changes on this page at least 14 days in advance.
6. International Transfers
Depending on your location, data may be processed outside your jurisdiction, including outside the EEA. Transfers rely on adequacy decisions where available, otherwise on standard contractual clauses and supplementary safeguards (encryption in transit and at rest, access minimization).
7. Retention
- Active accounts: identity, creations, settings, and API history for the account lifetime.
- Deletion: on image deletion or account closure, data is hard-deleted from production immediately and purged from encrypted backups within 30 days.
- Billing: invoices up to 7 years per tax obligations.
- Safety: moderation records tied to serious violations may be kept longer where necessary for legal defense or law enforcement cooperation, with access strictly restricted.
8. Your Rights
Available to all users regardless of jurisdiction:
- Access and portability: obtain a copy and a machine-readable export of your data and creation history.
- Rectification: correct inaccurate profile data at any time, directly or on request.
- Erasure: request deletion of your account and personal data without undue delay, subject to Sections 7 and 9 limits.
- Restriction and objection: contest specific processing, including direct marketing and non-essential profiling.
- Withdraw consent: for consent-based processing, with future effect only.
Exercise rights at [email protected] from your account email, describing the request. We verify identity proportionately and respond within 30 days (extendable once by 60 days for complex cases, with notice). Unfounded or excessive repeat requests may be reasonably charged or declined with reasons. You may also lodge a complaint with your supervisory authority (in France: the CNIL).
9. Security and Breach Notification
Protections include TLS 1.3 in transit, AES-256 at rest for sensitive stores, hashed credentials and API keys, role-based production access, and regular external testing. No internet system is impregnable. If a breach likely risks your rights, we notify you without undue delay with the nature, likely consequences, and mitigation steps, and we notify the competent authority within 72 hours where required.
10. Minors and Changes
The Service is not directed at children under 13, and accounts require majority age or supervised parental consent per the Terms. We do not knowingly process children's data beyond account administration; contact us for prompt removal. Material Policy changes are announced on this page (date revised) and, where significant, by email at least 14 days before effect.