Privacy Policy

1. Who is responsible

Nystrel is the controller of the personal data described in this policy. For privacy questions, write to [email protected].

2. What we collect

3. Device recognition and abuse prevention

Free credits are given to every new account. To stop one person from collecting them repeatedly by opening many accounts, we recognise the device used to sign up and sign in. This section explains exactly what that means, because it involves reading characteristics of your browser.

What we store. When you register, and each time you sign in, we record:

We do not store the characteristics themselves. They are combined and converted into a single irreversible hash. We keep that hash, not your screen size, graphics card or any other individual value. The hash can be compared with another hash to see whether two sign-ins came from a similar device; it cannot be turned back into a description of your computer.

What we do with it. We compare these signals across accounts to see whether the same device is behind several of them. Where that happens we may:

• decline to award the free starter credits to additional accounts created on the same device — those accounts still work normally and can still be used and paid for;
• raise an internal notice for the operator to review;
• where the operator has enabled it, decline further registrations from the same device.

None of these signals is treated as proof of identity, and none of them is used on its own. Shared computers are ordinary — families, offices, schools and internet cafés all produce several accounts on one device — so matches are weighted and reviewed rather than acted on automatically.

When it happens. These characteristics are read only on the sign-in and registration page, and only at the moment you submit that form. They are not read while you browse the rest of the site.

Our basis for this. We rely on our legitimate interest in preventing fraud and abuse of a free allowance, and we consider this processing strictly necessary to provide sign-in and account security. It is not part of the optional analytics and advertising consent described in section 13, and turning those off does not affect it.

How long. Device records are deleted automatically 180 days after they are created.

If you object. You can ask us to review or erase your device records, or object to this processing, using the contact details in section 16. If you do, we may still need to keep a minimal record where it is necessary to prevent repeated abuse, and we will tell you if that is the case.

4. Why we use it, and our legal basis

Where the GDPR or a similar law applies to you, these are the bases we rely on:

Non-essential notifications can be turned off under Account settings → Notifications. Transaction records such as receipts and renewal reminders cannot be turned off, because we are required to send them.

5. Images you upload and generate

Reference images you upload are used only for the corresponding generation task. We do not use your prompts, uploads or generated images to train our own models. If we ever wanted to, we would ask for your explicit consent first, separately from this policy.

Generated results are kept in your creation history so you can revisit and keep refining them. You can delete any conversation and its full history at any time.

Prompts and reference images are sent to the AI provider that performs the generation. Its handling is covered by its own terms — see section 6.

6. Content you share or submit

• Share links. A share link makes that image viewable by anyone who has the link. We do not index share pages in search engines. Turning a link off stops further visits but cannot recall a copy someone already saved.
• Library submissions. A submission is reviewed by us and, if published, its title, prompt and image are visible to everyone — including visitors who are not signed in. We do not display your email address.

7. Who we share with

We do not sell your personal information. We share the minimum necessary with:

• The AI image generation provider — only what a request requires: the prompt, any reference images, and the size and quality settings.
• The payment provider — see section 7.
• Email delivery and hosting providers — to send service email and to run the Service.
• Analytics and advertising providers — Google (Analytics, and Ads for conversion measurement) and Microsoft (Clarity), as described in section 13. When a purchase completes, Google Ads receives the amount, the currency and our own order number. It does not receive your name, your email address, or anything you have generated.
• Your team owner, if you belong to a Team plan — they can see your credit usage within that team.
• Authorities or advisers, where required by law or to establish or defend legal claims.

If we are acquired or reorganised, personal data may transfer as part of that, subject to this policy.

8. Payment information

We do not collect or store your card number, CVV or other payment credentials. The payment flow happens on the payment provider’s own pages; we see only the outcome and the limited details needed for reconciliation.

• We give the payment provider: your email address, the order amount and product identifier, and location information used to calculate tax.
• The payment provider returns: transaction status, order number, the brand and last four digits of the payment method, and the invoice number.
• That provider is the merchant of record for those transactions and handles your information under its own privacy policy.

9. International transfers

The Service and the providers it depends on may process data in countries other than yours. Where we transfer personal data out of the European Economic Area or the UK, we rely on an adequacy decision where one exists, and otherwise on Standard Contractual Clauses with the recipient.

You can ask us for details of the safeguards that apply by writing to [email protected].

10. How long we keep things

11. Storage and security

We apply reasonable technical and organisational measures, including password hashing, encrypted transmission (HTTPS), encrypted storage of third-party credentials, and access controls. Share links use long random tokens, and we store only a hash of each token rather than the token itself.

No method of internet transmission or storage is completely secure. If a breach occurs that is likely to result in a high risk to your rights, we will notify you and the relevant authority as required by law.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our use of your personal data, and to data portability. You can exercise several of these directly:

• See and correct your details — Account settings
• Change your email address — Account settings; the change takes effect once you confirm it from the new address
• Delete a conversation and its history — from the studio
• Turn off a share link, or ask us to remove a published submission
• Close your account — Account settings. Personal content is deleted; financial records are retained as set out in section 9

For anything not available in the product — including a copy of your data in a portable format — write to [email protected] and we will respond within the time the applicable law allows.

13. Cookies and similar technologies

We use essential cookies to keep you signed in and to protect forms against cross-site request forgery. These cannot be turned off without breaking the Service.

We also use the following measurement tools, which load on the pages you visit:

• Google Analytics — aggregate usage: which pages people reach, where they stop. Used to decide what to fix and what to build.
• Google Ads conversion measurement — when a purchase completes we send Google the amount, the currency and our own order number, so we can tell which advertising pays for itself. We do not send your name, email address or the content of anything you generate.
• Microsoft Clarity — aggregated interaction heatmaps and session replay, used to find broken layouts and confusing steps.

These load when you visit the Service. You can opt out of all of them without losing any functionality:

• Turn on Do Not Track in your browser. We honour it for the tags this site sets directly, and we do not load advertising tags for you at all when it is on.
• Use Google’s Analytics opt-out browser add-on, and your Google My Ad Center settings.
• Block third-party scripts in your browser settings or with an extension. Everything in the Service keeps working — none of these tools are involved in generating images, spending credits or taking payment.

If you are in a jurisdiction that requires prior consent before non-essential cookies are set, and you would prefer these tools were not loaded for you, write to [email protected] and we will exclude your account.

14. Children’s privacy

This Service is not intended for children under 16, or under the minimum age for consent to online services where they live, whichever is higher. If we learn that we hold a child’s personal data without the necessary consent, we will delete it promptly.

15. Changes to this policy

We may update this policy. Significant changes will be communicated by email or in-product notice before they take effect. The date at the top shows when it was last updated.

16. Contact us and complaints

For questions about this policy or to exercise your rights, contact us through the Help & feedback page or email [email protected].

If you are in the European Economic Area or the UK and you are not satisfied with our response, you have the right to complain to your local data protection supervisory authority.