Privacy policy.

1. Who is responsible

This policy covers the AI Paint macOS app and ai-paint.app. The controller responsible for processing personal data is:

Company details are available in our Imprint. Features can differ between app versions; the sections below apply when you use the corresponding feature.

2. Your drawings and local documents

AI Paint works with drawings, shapes, text, imported pictures and layers on your Mac. Documents and exports are saved to locations you choose. We do not receive a copy of every document simply because you draw or save it.

If you choose iCloud Drive or another synced folder as a save location, that provider processes the saved file under its own terms. Files you export or share are handled by the destination you select. Local app preferences and sign-in session information are stored on your device.

3. Account, credits and purchases

Online account features process your email address, account identifier and authentication information. If you choose Sign in with Apple or Google, we receive the identity information that provider makes available, such as your email address or Apple relay address and, where supplied, profile information.

We store your credit balance, feature entitlements, purchases and credit usage. Purchase records can include product and transaction identifiers, dates and verification information. Apple processes Mac App Store payments; AI Paint does not receive your full payment-card details.

We use this information to provide your account, verify purchases and deliver paid AI features (Article 6(1)(b) GDPR), fulfil applicable accounting obligations (Article 6(1)(c)), and prevent fraud and protect the service (Article 6(1)(f)). Without the required account and transaction information, we cannot provide those online features.

4. What happens when you use AI

A generation request sends your text prompt and selected generation settings. An editing request additionally sends a rendered image from your canvas and, when applicable, a selection mask. The image can include surrounding visible artwork needed as context, not only the area you want changed. Hidden layers are excluded from the rendered canvas input.

Requests using credits are processed by our backend and forwarded to the image provider for the selected model. OpenAI processes requests for OpenAI models. If your app version offers another provider or your own API key, requests for that feature are sent to the selected provider; that provider also processes connection and account information under its policies.

Our backend stores generated images so they can be delivered to the app. It also records credit usage, including prompts, model/settings references, timestamps and available usage information, to operate the service, account for credits and investigate failures or abuse. An expiring image-download link does not mean the underlying image is immediately deleted.

This processing is necessary to perform the AI operation you request (Article 6(1)(b) GDPR). Security, abuse prevention and operational troubleshooting are based on our legitimate interests in a reliable service (Article 6(1)(f)). Please only submit images and information you are entitled to share, including where they contain another person’s personal data.

5. Service providers and international processing

• Supabase: authentication, app backend, database and generated-image storage. See Supabase’s privacy policy.
• OpenAI: image generation and editing for OpenAI models. See OpenAI’s privacy policy and API data-use information.
• Apple: app distribution, purchases, and Apple sign-in or iCloud features you choose. See Apple’s privacy information.
• Google: Google sign-in if selected, and Firebase Hosting for this website. See Google’s privacy policy and Firebase’s processing information.
• Other image providers: if enabled and selected in your version, Stability AI or DeepAI receives the corresponding AI request.

These services may process data outside the EU/EEA, including in the United States. Applicable provider data-processing terms describe transfer safeguards, such as adequacy decisions or EU Standard Contractual Clauses. You can contact us for information about the safeguards relevant to your data. Provider retention and safety-processing rules apply in addition to storage in AI Paint’s backend.

6. Visiting ai-paint.app

This website is delivered through Google Firebase Hosting. Requests necessarily include technical information such as your IP address and the requested resource; hosting infrastructure processes connection information to deliver and secure the site. Google states that Firebase Hosting retains IP data for a few months. Our legal basis is our legitimate interest in operating a secure, accessible website (Article 6(1)(f) GDPR).

We do not embed advertising trackers, Google Analytics or social-media plugins on ai-paint.app, and we do not set analytics or advertising cookies. Fonts and artwork are served with the website. The sketch comparison slider runs in your browser without uploading anything.

Following an App Store, company or other external link opens that provider’s service. If you email us, we process your message and contact details to answer your request, based on Article 6(1)(b) for contractual enquiries or Article 6(1)(f) for other correspondence.

7. Storage and deletion

Account information is retained while needed to provide your account. Credit-usage records, including prompts, and generated images can remain in the backend after delivery; they are not automatically erased when you close the app. We retain operational information only as needed to provide the service, resolve support or security issues, and meet legal obligations.

You can request account and associated-data deletion at info@smart-byte.com, or use Delete Account in app versions that provide it. Account deletion includes associated usage records and stored generated images. Legally required billing records may be retained with the account link removed, and backup copies may remain until the applicable backup cycle expires. We restrict retained information to the purposes that require it.

Deleting your account or uninstalling the app does not delete documents you saved or exported yourself, including copies in iCloud Drive or other storage. Those copies remain under your control.

8. Your rights and contacting us

Subject to the conditions in applicable data-protection law, you can request access, correction, deletion, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.

Contact info@smart-byte.com to exercise these rights. You may also complain to a supervisory authority, including the Bavarian State Office for Data Protection Supervision (BayLDA) or the authority where you live or work.

AI image generation does not itself make decisions about you with legal or similarly significant effects. We update this policy when our processing changes and publish the current date above.