Privacy Policy

Last updated: August 14, 2026

PhotoBot (“we,” “us,” “our”) values your privacy. This Privacy Policy explains what information we collect, how we use it, and your choices regarding that information.

Who We Are

PhotoBot is operated by JAITE APPS, which is the controller of the personal data described in this policy. You can reach us about anything in this policy, including to exercise your privacy rights, at support@photobot.studio.

Information We Collect

We may collect the following data:

• Account Information
  Email address and other details when you create an account or sign in. If you sign in with Google or Apple, we receive the basic profile information those services release to us; we do not receive your password.
• Content Data The photos (products) and text prompts you upload, and the AI-generated images we create for you. User Responsibility: You are solely responsible for ensuring you have all necessary permissions, consents, and legal rights for any biometric data, personal images, or likenesses you provide as input.
• AI Processing Data When you use AI features, we may send the photos or product images you choose, text prompts, selected styles, effects, generation settings, and related technical metadata to third-party AI providers so they can create, moderate, upscale, or validate the requested result.
• AI Transparency Data Generated media contains machine-readable provenance information such as the PhotoBot provider and system name, generation time, a technical generation identifier, content type, watermark scheme, verification-key identifier, and whether the operation generated or manipulated the content. We do not embed your name, email address, prompt, or source image in this provenance data.
• Public AI Verification Uploads Media submitted to PhotoBot's public AI-content verifier is analyzed in request-temporary storage and is not copied into PhotoBot content storage. The verifier returns the file hash and technical detection result. Application and proxy logging are configured not to record the uploaded file body; ordinary security logs may still contain request time, IP address, user agent, response status, and rate-limit events.
• Moderation Data Records of screening decisions on your inputs and outputs, including the prompt, the source image reference, the decision, and the reason.
• Usage Data Technical details such as IP address, device type, operating system, app version, language, and app usage logs. Where you have consented, this includes product analytics and session replay of your interactions with the app interface.
• Order and Shipping Data If you order a physical product, the recipient name, postal address, and contact details needed to produce and deliver it.
• Communications Messages you send through in-app chat or to support, and the contents of those exchanges.
• Payment Data
  Records of your credit purchases (credit card details are handled by the app stores).

We do not ask for and do not want special-category data such as health, racial or ethnic origin, religious belief, political opinion, sexual orientation, or genetic data. Please do not submit it.

Facial Images and Biometric Information

Many PhotoBot features work on photographs of people, which may include your face or the face of someone who has given you permission to use their image.

• We use facial imagery only to produce the result you request. We do not use it to identify or verify who you are, to match you against any database, to track you across services, or to build a face recognition system.
• To the extent our processing or that of our AI providers derives a temporary representation of facial geometry in order to render a result, that representation is created for that generation, is not used to identify anyone, and is not retained as a separate biometric template after the generation completes.
• We do not sell, lease, trade, or otherwise profit from facial imagery or any biometric information, and we do not disclose it except to the AI providers listed below strictly to deliver the feature you requested, or where the law compels disclosure.
• Facial imagery you upload is retained under the same rules as your other content: it stays in your account until you delete it or your account, subject to the retention exceptions below.
• Some jurisdictions give you additional rights over biometric information. Where they apply, we honor them; contact us to exercise them.

If you do not want your face processed this way, do not upload photographs of yourself, and do not upload photographs of anyone else without their explicit, documented permission.

How We Use Your Information

• To provide and improve PhotoBot features and services.
• To process your uploaded photos and prompts, generating the requested images.
• To send your selected inputs to AI service providers only as needed to provide the AI feature you request.
• To screen content for safety and legal compliance, and to investigate suspected abuse.
• To fulfill and deliver physical product orders you place.
• To analyze usage data for optimizing servers and fixing issues.
• To send you service messages and, where you have enabled them, push notifications about your generations.
• We do not use your personal photos for advertising or marketing—only to run the app.
• Generated images are stored on our servers until you choose to delete them.

Legal Bases for Processing

Where the GDPR or UK GDPR applies to you, we rely on the following legal bases:

• Performance of a contract — creating and maintaining your account, processing your prompts and images to deliver generations, taking payment, and fulfilling product orders.
• Legitimate interests — keeping the service secure, preventing abuse and fraud, moderating content, debugging and improving the app, measuring aggregate advertising performance, and defending legal claims. We balance these against your rights and you may object as described below.
• Consent — personalized advertising, product analytics and session replay, push notifications, and any optional feature we present with a separate opt-in. You may withdraw consent at any time without affecting processing already carried out.
• Legal obligation — retaining transaction records, responding to lawful requests, and meeting reporting duties relating to illegal content.

Model Training

We do not use your uploaded images, prompts, or generated results to train our own AI models.

Our AI providers process your inputs in order to return a result. We access them through their business or API terms and, where those terms offer a choice, we select the option that excludes customer inputs from model training. Each provider's own policy ultimately governs what it does with data it receives, and those policies can change; the current provider list is above so you can review them. If we become aware that a provider we use trains on inputs, we will disclose it here and, where practical, move the feature to another provider.

Data Sharing and Third Parties

• We do not sell or rent your personal information.
• We share data only with trusted service providers who help run the app. For AI features, this includes OpenAI, Replicate, Kie AI, and Wavespeed. Depending on the feature, these providers may receive your selected photos or product images, text prompts, selected styles, effects, generation settings, and related technical metadata.
• Other categories of provider we use:
  • Printify and its print providers — name, shipping address, contact details, and the design file, to produce and deliver physical orders.
  • DigitalOcean Spaces / Amazon Web Services — storage and delivery of your images and videos.
  • Google Firebase — authentication, push notifications, crash reporting, and analytics.
  • Pusher — real-time delivery of chat and generation status updates.
  • PostHog — product analytics and, where you have consented, session replay.
  • Google Ads — advertising measurement, subject to the consent choices described below.
  • Apple App Store and Google Play — purchase processing and receipt validation.
  • DataCrunch — on-demand GPU capacity used to run generation workloads at times of high demand.
• We require our service providers to protect the data they process for us with the same or equivalent safeguards and to use it only to provide the requested service.
• We may share basic purchasing information with app stores or analytics providers as required.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you if it becomes subject to a materially different privacy policy.
• Law Enforcement Cooperation: We explicitly cooperate with law enforcement and regulatory authorities worldwide if user-generated content is found to be illegal (e.g., criminal material, prohibited generations). This includes, but is not limited to, active cooperation with investigations into violations of publicity rights, the creation of non-consensual synthetic media (deepfakes), or unauthorized likeness use.
• We do not share your images or content with advertisers or other outside parties, except where legally required.

International Data Transfers

We operate from the Kingdom of Saudi Arabia and our providers are located in several countries, including the United States and the European Union. Using PhotoBot therefore involves transferring your personal data across borders, including to countries whose data protection laws differ from those where you live.

Where we transfer personal data out of the European Economic Area, the United Kingdom, or another region that restricts such transfers, we rely on an adequacy decision where one exists, and otherwise on Standard Contractual Clauses or the equivalent mechanism approved in your region, together with additional technical and organizational safeguards. You can request details of the mechanism used for a particular transfer at support@photobot.studio.

Advertising and Personalization

• We use Google Ads and Firebase Analytics to measure campaign effectiveness and attribute conversions.
• Aggregate Conversion Data: Regardless of your preferences, we collect aggregate, non-personalized conversion data (such as purchase events) to measure and improve our advertising. This processing is based on our legitimate interest under GDPR Article 6(1)(f).
• Personalized Advertising: With your explicit consent, we may enable personalized ad targeting, ad storage, and ad user data sharing with our advertising partners. You can grant or withdraw this consent at any time in the app's Settings menu under "Personalized Ads."
• If you decline personalized advertising, you may still see ads, but they will not be tailored to your activity or profile.

Cookies and Tracking

• We may use cookies or SDKs to maintain sessions, remember settings, and gather analytics.
• You can disable cookies in your device settings, but this may limit functionality.
• On iOS, tracking that requires App Tracking Transparency permission happens only if you allow it in the system prompt. You can change that choice at any time in iOS Settings.
• Tracking is used solely to improve the app and user experience.
• We do not currently respond to browser “Do Not Track” signals.

Automated Screening and Decision-Making

Inputs and outputs are screened automatically for safety and legal compliance. An automated decision can block a generation, restrict a feature, or flag an account for review.

We do not use automated processing to make decisions producing legal effects on you without a route to a person. Account suspensions and terminations are reviewed by a member of our team. If an automated decision affects you and you believe it is wrong, contact support@photobot.studio to ask for human review, to state your point of view, and to contest the outcome.

Data Retention

• We retain your content and information only as long as needed.
• All photos, prompts, and generated images remain in your account until you delete them.
• When you delete content or your account, we remove it from active systems promptly and it is purged from routine backups within 90 days.
• Account and transaction records are kept for as long as required by applicable tax, accounting, and consumer-protection law after your account closes.
• Moderation records relating to a blocked or flagged generation are kept for up to 24 months so that we can handle appeals, identify repeat violations, and respond to legal requests.
• Media uploaded to the public AI-mark detector is read from request-temporary storage to produce the detection result and is not copied into PhotoBot content storage. Ordinary security and rate-limit logs may still record request metadata such as time, IP address, response status, and file size, but not the uploaded media or its prompt.
• Data Misuse & Forensics: In cases of suspected illegal activity or attempts to bypass filters (prompt injection), the app reserves the right to retain and share relevant metadata (IP, device info, prompts, source images, and generated content) with authorities for forensic purposes. This specifically includes instances involving suspected deepfake creation or the unauthorized use of a person's likeness.
• If you delete content or your account, we promptly erase that data from our active systems, except where data must be retained for legal compliance or the forensic reasons stated above.
• We may keep anonymized or aggregated data for analytics and legally required records for the minimum period required by law.

Security

• We implement reasonable security measures (encryption, access controls, etc.) to protect your information.
• Access to user content by our staff is limited to what is necessary to operate the service, investigate abuse, or respond to a support request, and is logged.
• Disclaimer on Security: While the app has filters, users are responsible for the legality of their outputs.
• While we strive to protect your data, no transmission is completely secure.
• We cannot guarantee absolute security, but we maintain industry-standard safeguards.
• If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority and, where the risk is high, affected users, within the timeframes the applicable law requires.

Your Privacy Rights

Subject to the law that applies to you, you may:

• Access the personal data we hold about you and obtain a copy.
• Correct data that is inaccurate or incomplete.
• Delete your data, including by deleting your account in the app.
• Port data you provided to us, in a structured, commonly used, machine-readable format.
• Restrict or object to processing based on our legitimate interests, including profiling.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these, email support@photobot.studio from the address on your account, or use the in-app account deletion option. We respond within one month and may extend that by two further months for complex requests, telling you if we do. We may need to verify your identity before acting, and we will not discriminate against you for exercising a right.

If you are in the EEA or the UK and believe we have not handled your data properly, you may lodge a complaint with your national data protection authority (in the UK, the Information Commissioner’s Office). We would appreciate the chance to address your concern first.

Notice to California Residents

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know the categories and specific pieces of personal information we collect and the purposes for collecting them, to delete personal information, to correct inaccurate personal information, to opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined by the CPRA. We do not knowingly sell or share the personal information of anyone under 16.

Photographs containing facial imagery may be treated as sensitive personal information. We use it only to deliver the feature you requested and for the purposes permitted without a right to limit under the CPRA; we do not use or disclose it to infer characteristics about you.

To exercise any California right, contact support@photobot.studio. You may use an authorized agent, in which case we will require proof of authorization. You will not receive different pricing or service quality for exercising a right.

Children’s Privacy

• PhotoBot is intended for users aged 13 and over. Purchasing credits, ordering physical products, and uploading or generating images of an identifiable person other than yourself require you to be 18 or over.
• We do not knowingly collect personal data from children under 13.
• In the EEA and the UK, where processing relies on consent and you are below the age of digital consent in your country (13 to 16 depending on the country), that consent must be given or authorized by a parent or guardian.
• If we learn that a user is under 13, we will delete their data.
• Parents or guardians of minors (ages 13–17) should supervise their use of the app.
• If you believe a child has provided us with personal data, contact support@photobot.studio and we will delete it.

Your Choices

• You may delete your account at any time and remove any content.
• You may disable certain features (e.g., notifications) in your device settings.
• You may withdraw analytics, session replay, and personalized advertising consent in the app's Settings.
• Credit purchases are final, so please use them before signing out.

Policy Updates

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via the app or email. Your continued use of PhotoBot after changes indicates your acceptance of the new policy.

Contact Us

Questions, requests, and complaints about this Privacy Policy or your personal data should be sent to support@photobot.studio.