1. Information We Collect

We collect the information you give us and the information we need in order to run the Service:

• Account information — your name, email address and password, which is stored only as a cryptographic hash
• Content you create — characters, prompts, reference images you upload, and the images and videos generated from them
• Workspace data — workspace names, membership and collaboration settings
• Billing information — your subscription, credit balance and payment history; card details go directly to Stripe and never reach our servers
• Technical and usage data — IP address, browser and device type, pages visited and actions taken in the product

2. How We Use Your Information

We use this information to:

• Provide the Service: generate the output you request, store it, and show it to you and your workspace
• Operate your subscription: take payment, track credits and apply plan limits
• Send transactional email such as verification codes, password resets and billing notices
• Provide support and respond to what you ask us
• Keep the Service secure and reliable, detect abuse, and understand which features are used so we can improve them

3. Legal Bases for Processing

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases:

• Performance of a contract — to give you the Service you signed up for and to take payment for it
• Legitimate interests — to keep the Service secure, prevent abuse and improve the product, balanced against your rights
• Consent — for optional analytics cookies, which you can withdraw at any time
• Legal obligation — to keep tax and accounting records and to answer lawful requests from authorities

4. Your Content and AI Processing

You keep ownership of everything you create. We do not use your content to train artificial intelligence models. To generate output, your prompts and reference images are sent to the third-party model provider that runs the model you selected, purely so it can return the result you asked for. Your characters and generated assets are private to you and your workspace unless you deliberately publish them to Discover, the Marketplace or a public profile, and you can unpublish them at any time.

5. Data Storage and Security

Your account data is held in a managed PostgreSQL database and your media in object storage, both operated for us by the providers listed below. Data is encrypted in transit, passwords are hashed and never stored in readable form, and access by our team is limited to the people who need it to operate and support the Service. No system can be guaranteed completely secure, but we work to protect your information and will notify you and the relevant regulator if a breach affects your personal data and the law requires it.

6. Service Providers

We share data with a small number of providers who process it on our behalf, under contract and only for the purposes below:

• AI model providers — Google (Vertex AI), BytePlus, fal.ai, Replicate, OpenAI and ElevenLabs — receive prompts, reference images and audio in order to generate output
• Cloudflare R2 and Google Cloud Storage — store the images and videos you create
• DigitalOcean — hosts our application, database and background workers
• Stripe — processes payments and holds your card details as an independent controller
• Resend — delivers transactional email such as verification and billing messages
• PostHog — provides product analytics on EU-hosted infrastructure so we can see how features are used

7. International Transfers

We and our providers operate internationally, so your information may be processed outside your country, including in the United States. Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses or on an adequacy decision, together with technical measures such as encryption in transit.

8. We Do Not Sell Your Data

We do not sell, rent or trade your personal information, and we do not share it for cross-context behavioural advertising. Beyond the providers listed in section 6, we disclose personal data only with your consent, to comply with a legal obligation or a valid request from an authority, to establish or defend legal claims, to protect the rights and safety of our users or the public, or to a successor entity in the event of a merger or acquisition, in which case we will tell you first.

9. Cookies and Similar Technologies

We use cookies that are strictly necessary to keep you signed in and to keep the Service secure; these cannot be switched off. We also use optional analytics cookies, which we set only after you accept them in the cookie banner. You can change your choice at any time in your browser settings or by clearing the consent stored by the banner.

10. Your Rights

Depending on where you live, you have the right to:

• Access the personal data we hold about you and receive a copy of it
• Correct information that is inaccurate or incomplete
• Delete your account and the personal data associated with it
• Object to or ask us to restrict certain processing
• Receive your data in a portable, machine-readable format
• Withdraw consent you previously gave, and complain to your local data protection authority

11. Data Retention

We keep your personal data for as long as your account is open. When you delete your account we delete or anonymise it, normally within 30 days, apart from records we are legally required to keep — invoices and tax records, for example, which we retain for the period required by law. Backups are overwritten on a rolling cycle, so a copy may persist there for a short period after deletion.

12. Children's Privacy

onzero is not intended for anyone under 18 and we do not knowingly collect personal information from children. If you believe a child has given us personal data, write to privacy@onzero.ai and we will delete it.

13. Changes and Contact

This Privacy Policy is issued by GenieApp Inc., a Delaware corporation that operates onzero and is the controller of the personal data described here. We may update this policy as the Service develops or as the law requires, and we will change the date at the top of this page when we do. If a change materially affects your rights we will tell you by email or in the product before it takes effect. For any privacy question, or to exercise the rights in section 10, contact us at privacy@onzero.ai.