Privacy Policy

Effective date: 1 October 2026

1. Who is responsible for your data

Image Stock is operated by Valerii Riaboshapko, a sole trader registered in Portugal under registration number 309928745, at R. Hermano Neves 18, Piso 3, Escritório 7, V6143, 1600-421 Lisboa. That operator is the controller of the personal data described here, and can be reached at support@imagestock.ai.

2. What we collect

Your account.

• Your email address.
• Your password, stored only as a hash. We never hold it in a form we could read, and cannot tell you what it is.
• If you sign in through Google, Facebook or Apple: the identifier that provider gives us, the email address on the account, and the display name where the provider sends one. We do not receive your password at that provider.
• Whether your email address has been verified.

What you make with the Service.

• The descriptions you write of what needs illustrating.
• The concepts and image prompts generated from them, including your edits.
• The generated images themselves.

Payments.

• Which bundle you bought, when, the amount and currency charged, the order reference returned by Stripe, and any promotional code you used.
• Your token balance and a record of every generation it paid for or was returned by.
• No card numbers and no bank details. Those are entered on Stripe’s own checkout page and never reach our systems.

Technical data.

• Your IP address, which we use to apply rate limits — chiefly on sign-in attempts, so that one person’s failed logins cannot lock out everybody else.
• A record of your signed-in sessions: when each began, the IP address and the browser it came from.
• Server logs of requests, kept briefly for diagnosis and abuse handling.

Usage and advertising data — only with your consent.

• If you agree to analytics: the pages you visit, how you arrived (the referring site and any campaign tags in the link), your device, browser and approximate location as Google Analytics derives them, and the identifiers in the Google Analytics cookies listed below.
• If you agree to marketing: the identifier of the ad you clicked, if you came from one (for example fbclid or gclid), and the identifiers in the Meta cookies listed below.
• When you create an account or complete a purchase, and only if you agreed to the category concerned, we report that event from our servers to Google Analytics and to Meta: what happened, when, the amount and currency of a purchase, and our internal identifier for your account. Meta also receives your email address in hashed (SHA-256) form, together with your IP address and browser, so that it can match the event to the ad that led to it. Google receives the Google Analytics identifiers of your browser, not your email address.

Cookies

Strictly necessary cookies are always set, because the Service cannot work without them. Everything else is set only if you agree to it in the cookie banner, and nothing from Google or Meta is even loaded before you do. You can change your choice at any time through Cookie settings, at the bottom of every public page and on your profile page in the application; withdrawing consent removes these cookies from your browser.

Cookie	Set by	What it is for	Kept for
Strictly necessary
sessionid	Image Stock	Keeps you signed in.	2 weeks
csrftoken	Image Stock	Stops another site submitting forms as you.	1 year
consent	Image Stock	Remembers your answer to the cookie banner.	1 year
Analytics
_ga, _ga_*	Google	Tell one browser and one visit from another, so that visits can be counted and attributed to how they began.	2 years
Marketing
_fbp	Meta	Identifies your browser to Meta, to measure which of our ads lead to sign-ups and purchases.	90 days
_fbc	Meta	Records the Meta ad you clicked to reach us.	90 days
_gcl_*	Google	Records the Google ad you clicked to reach us.	90 days

Until you have answered the banner, the identifier of an ad you clicked is kept only in the address of the pages you open on our site, so that it can still be used should you agree on a later page. It is not stored on your device and is not sent to anyone unless you agree.

3. Why we use it, and on what legal basis

• To run the Service — creating your account, generating concepts, prompts and images, keeping your token balance. Legal basis: performance of our contract with you.
• To take payment and keep the records — legal basis: performance of our contract, and our legal obligation to keep accounting records.
• To keep the Service secure — rate limiting, abuse handling, investigating faults. Legal basis: our legitimate interest in a service that works and is not abused.
• To answer you when you write to us. Legal basis: performance of our contract, or our legitimate interest in answering enquiries.
• To understand how the site is used — counting visits, seeing which pages work and where people come from. Legal basis: your consent to analytics.
• To measure and improve our advertising — learning which ads lead to sign-ups and purchases, so that Google and Meta can show our ads to people likely to find the Service useful. Legal basis: your consent to marketing.

We do not send marketing email, and we make no automated decisions that have a legal or similarly significant effect on you. With your consent to marketing, Google and Meta may use the events we report to decide whom to show our ads to; that is the only profiling involved, and it is done by them, within their own services.

4. Who it is shared with

Running the Service means passing some of this data to the providers below. Each receives only what its job needs.

• OpenRouter — receives the description you write and passes it on to the providers of two language models: one that checks it against our content rules before anything is generated for it, and one that produces the concepts and prompts. It is sent as content, not tied to your account.
• fal.ai — receives the image prompt, in order to generate the image. Likewise not tied to your account.
• Cloudflare — stores the generated images in its R2 object storage, and sits in front of the site as a proxy, which means it sees the metadata of every request including your IP address.
• Stripe — takes the payments, through Link. As Merchant of Record it is the seller of your purchase and an independent controller of what it collects at checkout, under its own privacy notice. We send it your email address, to fill in the checkout, and the identifier of the purchase.
• Our email provider — delivers verification and password-reset messages, and so receives your email address.
• Google, Facebook or Apple — only if you choose to sign in through one of them, and only to the extent that the sign-in itself requires.
• Google (Google Ireland Limited, and Google LLC in the United States) — only with your consent: receives the analytics data described above through Google Analytics, and, if you also agreed to marketing, may use it to measure and target our ads on Google.
• Meta (Meta Platforms Ireland Limited) — only with your consent to marketing: receives the advertising data described above through the Meta Pixel and its Conversions API. For collecting that data and passing it to Meta we and Meta are joint controllers; Meta is responsible for what it does with it afterwards, under its own privacy policy at facebook.com/privacy/policy.
• Our hosting provider — runs the servers the Service is on.

Beyond that we disclose personal data only where the law requires it, or to establish or defend a legal claim. We do not sell personal data, and we share it for advertising only with Google and Meta, and only if you consent to it.

5. Links to your images

Generated images are served through signed links that work for up to seven days and then stop. Within that window, anyone holding the link can open the image without signing in — that is how the link is able to work at all. Treat one as you would the picture itself, and do not pass it on unless you mean to share the image.

6. Where your data goes

The providers above are largely outside the European Economic Area, mostly in the United States, so using the Service involves transferring personal data there. Those transfers rely on the safeguards each provider offers — an adequacy decision where one covers them, such as the EU–US Data Privacy Framework under which Google and Meta are certified, and otherwise the European Commission’s standard contractual clauses.

7. How long we keep it

• Your account and the content in it — for as long as the account exists.
• Concepts, prompts and images you delete — they disappear from the application at once, and are kept for 30 days in case you ask us to restore them. After that they are erased for good, the image files in storage along with the records.
• Payment and token records — kept for ten years, the period Portuguese tax law requires accounting records to be held for, even after the account is closed. This is the one category we cannot delete on request.
• Session records — expired sessions are cleared nightly.
• Cookies — for the periods given in the table in section 2, or until you withdraw your consent or clear them from your browser.
• Analytics data at Google — 14 months, after which Google Analytics deletes it.
• Our record of the events reported to Google and Meta — 30 days, then deleted. What Google and Meta keep is governed by their own policies.
• Server logs — kept briefly, then discarded.

8. Your rights

If the GDPR or a comparable law applies to you, you have the right to ask us for a copy of your personal data, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent you may withdraw it at any time, through Cookie settings, without affecting what was done before you withdrew it.

Write to support@imagestock.ai. We answer within one month, and will say so if a request needs longer. There is no charge unless a request is manifestly unfounded or excessive.

Note that the application has no self-service account deletion yet. Closing an account is done by writing to us, and we act on it within 30 days.

If you think we have handled your data badly, please tell us first — but you also have the right to complain to the data protection authority in your country, or to the Comissão Nacional de Proteção de Dados (CNPD), the supervisory authority in Portugal, at www.cnpd.pt.

9. Security

The site is served over HTTPS only. Passwords are stored hashed. Payment details never reach us. Access to the production systems is limited to the operator. No system is perfectly secure, and we do not claim otherwise; if a breach affects your data and the law requires us to tell you, we will.

10. Children

The Service is for people aged 18 and over. We do not knowingly collect personal data from anyone younger. If you believe a minor has an account, write to us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The current version is always published on this page, and the effective date at the top says which version is in force.

12. Contact

Valerii Riaboshapko, R. Hermano Neves 18, Piso 3, Escritório 7, V6143, 1600-421 Lisboa — support@imagestock.ai.