Privacy Policy of Paintitai LTD 

Last Updated: September 21, 2026

This Privacy Policy ("Policy") describes how Paintitai LTD ("we," "us," or "Company") collects, uses, stores, discloses, and protects personal data of users ("you" or "User") of the Paintit.ai web application at app.paintit.ai and related products and services (collectively, the "Service"). By accessing or using the Service, you agree to the terms of this Policy.

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Input" means any text, images, or other materials you submit to the Service.
• "Output" means the results generated by the Service based on your Input.

Sources: Directly from you; automatically via cookies and similar technologies; from our advertising and affiliate partners.

We do not intend the Service to be used for the submission or processing of special categories of personal data (such as health information, financial account numbers, government identifiers, information about children, or data revealing racial or ethnic origin, political opinions, religious beliefs, or sexual orientation). Please do not include such information in your Input. If you nevertheless choose to provide such data, you do so at your own risk, and we process it only as necessary to provide the Service and in accordance with this Policy.

We use the following categories of cookies and tracking technologies:

• Strictly Necessary Cookies: enable core functionality (authentication, security).
• Performance & Analytics Cookies: Google Tag Manager (GTM), Google Analytics 4 (GA4), Microsoft Clarity.
• Marketing Cookies: used by Meta (Facebook & Instagram), TikTok, Pinterest, and Google Ads for ad targeting.

You may manage or disable cookies via your browser settings or through the "Cookie Settings" section on our website. Although we do not respond to Do Not Track signals, when DNT is enabled we refrain from using marketing cookies.

We do not set non-essential analytics or marketing cookies where prior consent is required by applicable law unless and until you have provided such consent through our cookie banner or cookie settings.

Some analytics tools, including Microsoft Clarity, may help us understand how users interact with the Service through heatmaps, session recordings, clicks, scrolling, page interactions, and similar usage analytics. We use this information to improve usability, detect friction points, debug product issues, and enhance the user experience.

Google Drive data, including imported images and data derived from them, is subject to the stricter limits in section 4C. The general permissions in this Policy for model training, advertising, marketing, human review, and sharing do not override those limits.

• 4A.1. To operate the Service, investigate abuse, provide support, and improve our products, authorized employees and contractors may access and review Content Data on a strictly “need-to-know” basis and subject to confidentiality obligations.
• 4A.2. We may process Content Data using third-party AI infrastructure providers and AI tools, such as OpenAI, Google (Gemini), Anthropic (Claude), Perplexity AI, and similar vendors, to generate responses, perform analysis, improve product quality, test features, and develop or evaluate our own systems. Where available and commercially reasonable, we configure API-based services to limit the provider’s use of submitted data for training its own foundation models. Third-party AI providers may process data in accordance with their own terms, privacy policies, data processing agreements, and technical settings applicable to the specific service used.
• 4A.3. Where feasible, we aggregate, anonymize, or pseudonymize Content Data before using it for analytics, model training, or marketing-related purposes.

We may use, display, reproduce, publish, or feature AI-generated or AI-modified images created through the Service for product improvement, demonstrations, marketing, advertising, portfolio, gallery, social media, investor materials, and similar business purposes.

Where reasonably practicable, we may remove or avoid displaying obvious personal identifiers. However, you should not upload images, prompts, or other materials containing private, sensitive, confidential, or identifying information unless you are comfortable with such content being processed as described in this Policy and our Terms of Service.

Google Drive data, including imported images and data derived from them, is subject to the stricter limits in section 4C. The general permissions in this Policy for model training, advertising, marketing, human review, and sharing do not override those limits.

Access and data received. Connecting Google Drive is optional and separate from signing in to Paintit with Google. With your authorization, Paintit requests read-only access through the Google Drive API (https://www.googleapis.com/auth/drive.readonly). This permission technically permits reading Drive files beyond a single folder; it does not allow Paintit to create, change, or delete files in your Drive. Paintit lets you browse folders to select one for Projects, then browse images and subfolders within that folder. We read folder and file IDs, names, file types, sizes, modification dates, parent-folder relationships, thumbnails, and image content needed for this feature. The Drive connection receives OAuth access and refresh tokens, their scope and expiry, and links the connection to your existing Paintit account; it does not separately request your Google profile or contacts.

Purpose and storage. We use this data only to provide the Drive browsing and image-use features you request: displaying your chosen folder and its image-containing subfolders in Projects, previewing images, and importing images you select for a project, chat, or generation. Browsing does not create a stored copy of your Drive folder tree or image library in our database. We store the selected folder ID and name, connection details, and OAuth tokens. Listings and previews are loaded on demand. When you choose an image for use in Paintit, a copy is uploaded to Paintit storage and handled as imported content; this does not change the original in Drive.

OAuth tokens and protection. Access and refresh tokens are stored in our backend database and used only to maintain your authorized Drive connection. Access to connection endpoints requires authentication and is tied to your Paintit account. Refresh tokens stay on the backend; a short-lived access token is provided to your authenticated browser to load Drive folders and images. The token endpoint instructs browsers not to cache its response. Communication with Google uses HTTPS. Google receives the authorization and API requests needed for this connection, including application identifiers, requested permissions, file or folder identifiers, and your Paintit email as an account-selection hint.

Sharing and AI processing. When you select a Drive image for a Paintit function, it may be processed by the hosting, storage, and AI providers needed to perform that function, including the relevant AI providers described in section 5. Transfers are limited to delivering your requested feature, security needs, or legal obligations. We do not sell Google user data, share it for advertising, or use it for targeting, retargeting, audience building, or marketing. We do not use Drive images or other Google user data, including imported copies and derived data, to train or improve AI/ML models, including generalized or foundation models, and do not permit our providers to do so. Using an image to generate your requested result is distinct from model training. These limits also exclude Drive-derived content from the promotional uses in section 4B.

Human access. We do not allow people to read Google user data unless you explicitly agree to access to specific data, access is necessary for security or legal compliance, or the data is aggregated and anonymized and used for internal operations as permitted by Google’s Limited Use requirements.

Retention, disconnecting, and deletion. We retain connection details and tokens while the integration is connected. You can use Disconnect in the Google Drive area of Projects at any time. Disconnecting deletes the connection record, including saved tokens and the selected folder details, from our active database and stops further access through that connection. It does not itself revoke the permission in your Google Account. You can revoke that permission separately using the Google Account connections page linked below. Revocation prevents further authorized access but does not itself delete copies already imported into Paintit. Disconnect in Paintit as well to remove its saved connection record. Imported images and related chat or generation content remain subject to section 6’s Content Data retention rules, with the use restrictions in this section continuing to apply. To request deletion of imported images, related content, or remaining connection data, contact support@paintit.ai as described in section 7. Limited backup retention described in section 6 may apply. Deleting a Paintit copy does not delete the original in Google Drive.

Revoke access in Google Account

Our use and transfer of information received from Google APIs comply with the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including their Limited Use requirements.

We share Personal Data with the following categories of service providers:

When transferring data outside the European Economic Area (EEA) or the United Kingdom, we rely on Standard Contractual Clauses (SCC) or other legally recognized transfer mechanisms to ensure adequate protection.

• Account and Transaction Data: retained for as long as necessary to provide the Service, comply with legal, tax, accounting, and contractual obligations, resolve disputes, and enforce our agreements.
• Credit and Billing Activity Data: retained for as long as necessary to manage credit balances, top-up purchases, refunds, chargebacks, billing disputes, fraud prevention, accounting, and legal compliance.
• AppSumo and Marketplace Deal Data: retained for as long as necessary to verify licenses, manage lifetime deal entitlements, provide support, handle refunds, chargebacks, fraud prevention, accounting, tax, legal compliance, and marketplace obligations.
• Content Data: including prompts, chat history, uploaded images, generated images, modified images, and related metadata, retained for as long as your account remains active and for a reasonable period thereafter, unless deletion is requested and no legal, contractual, security, fraud prevention, product integrity, or operational reason requires further retention.
• AI improvement and analytics datasets: where feasible, we use aggregated, anonymized, or pseudonymized data. Such data may be retained for longer periods because it is no longer directly associated with an identifiable user.
• Analytics and Marketing Data: retained for up to two (2) years from collection, unless a shorter or longer period is required or permitted by applicable law.
• Backup copies and security logs may remain for a limited period after deletion due to technical backup, fraud prevention, security, and disaster recovery requirements.

You have the right to:

• Access your Personal Data;
• Rectify inaccurate data or complete incomplete data;
• Erase your data ("right to be forgotten");
• Restrict processing of your data;
• Object to processing based on legitimate interests;
• Port your data in a structured, commonly used format;
• Withdraw consent at any time for processing based solely on consent.

Where we rely on legitimate interests as our legal basis (for example, to improve our models or for certain marketing and analytics uses), you have the right to object to such processing. If you object, we will cease processing your Personal Data for those purposes unless we demonstrate compelling legitimate grounds or are required to continue by law.

You also have the right to lodge a complaint with a data protection supervisory authority. If you are located in the United Kingdom, you may contact the UK Information Commissioner’s Office (ICO). If you are located in the EEA, you may contact the supervisory authority in the country where you live, work, or where you believe an infringement occurred.

Depending on your jurisdiction, you may have additional privacy rights. For example, residents of certain U.S. states may have the right to know, access, correct, delete, or obtain a copy of certain Personal Data, and to opt out of certain types of targeted advertising, sale, or sharing of Personal Data as defined by applicable law.

We do not sell Personal Data for money. However, our use of advertising and analytics technologies may be considered a “sale,” “sharing,” or targeted advertising under certain privacy laws. Where required, you may opt out through our cookie settings, browser-based opt-out signals where supported, or by contacting us at support@paintit.ai.

To exercise any of these rights, please contact us at support@paintit.ai.

We implement organizational and technical safeguards, including encryption, access controls, and regular security audits. Access to Personal Data is limited to authorized personnel only.

We may disclose Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements, to the extent permitted by law.

Consistent with our Terms of Service, we do not knowingly collect Personal Data from children under 13. Users aged 13–17 may use the Service only with parental or guardian consent.

We reserve the right to modify this Policy at any time. Material changes will be communicated at least thirty (30) days before taking effect via email and/or in-app notification.

If you have questions or concerns about this Policy or our data practices, please contact:

PAINTITAI LTD
52 Leytonstone road, London, E15 1SQ, UK
Phone: +44 7366 359241
Alternate Phone: +34 697 357 937
Email: support@paintit.ai