1.Who we are
Artside (“ArtSide”, “we”, “us”) is the controller of the personal data described in this notice. Registered office: [INSERT REGISTERED OFFICE ADDRESS]. Company number: [INSERT COMPANY NUMBER].
Privacy contact: [INSERT PRIVACY EMAIL — e.g. privacy@artside.ai once the mailbox exists]. General contact: [INSERT GENERAL CONTACT EMAIL].
Data Protection Officer: [REQUIRES BUSINESS DECISION — whether a Data Protection Officer or privacy contact is appointed]
ICO registration: [REQUIRES BUSINESS DECISION — ICO registration / data protection fee]
This is the current beta-version Privacy Notice, prepared from how ArtSide works. It has not yet been independently reviewed by a solicitor and is not a statement that ArtSide is GDPR compliant.
2.What personal data we collect
Account information
Your email address, display name, optional avatar, password (stored only as a secure hash by our authentication provider), email-confirmation status and account creation date.
Content you submit
Photographs and images you upload, brush masks you draw, prompts and instructions you write, and the style or quality options you choose. Uploaded photographs may show you or other people.
Images we generate
The images produced for you, any print-ready versions, thumbnails, and the record of which workflow, style and settings produced them.
Priority waitlist
If you join the Priority Waitlist we store your email, the plan or credit pack you are interested in, your billing preference, optional marketing consent (and when you gave it) and basic campaign attribution. We use this to notify you when paid plans launch and to administer the Early Supporter offer. No payment is taken. You can change your preferences, withdraw marketing consent or leave the waitlist from your account at any time, or contact us to export or delete this data.
Billing and credits
Your plan, subscription status, credit balance, credit transactions (charges, refunds, grants) and payment confirmations from Stripe. Card details are collected and held by Stripe, not by ArtSide.
Usage and technical data
Product events such as which studio tab you opened, when a generation started, succeeded or failed, and when a print check or handoff ran; plus device and browser information, IP address, request logs, rate-limit records and error reports generated when you use the site.
Print and framing
Print handoff references and confirmations received from MyArtLane about completed orders.
Safety and moderation records
When an automated safety check blocks a prompt, upload or generated image, we record a minimal moderation incident: the type of check, the high-level category flags and severity, the time, and a short masked excerpt where one is needed for review. We do not store the full prompt text or detailed classifier output in these records. We also keep your account safety status (for example active, warned or suspended) and any strikes issued after human review.
Support and communications
Messages you send us and our replies.
3.Why we use it, and our lawful basis
- Creating and managing your account, and signing you in — necessary to perform our contract with you.
- Running generations, transformations and AI Brush edits, including storing your uploads and results in your private gallery — contract.
- Metering and accounting for credits, including reservations, refunds and grants — contract.
- Taking payments, handling subscriptions, renewals, refunds and billing records — contract, and legal obligation for tax and accounting records.
- Sending service emails such as email confirmation and password resets — contract.
- Keeping the service secure, preventing fraud and abuse, enforcing our Terms and Acceptable Use Policy, applying rate limits and investigating incidents — legitimate interests in protecting users, the service and our business, and legal obligation where reporting is required.
- Running automated safety checks on prompts, uploads and generated images, and reviewing blocked content — legitimate interests in keeping users and the public safe and keeping the service lawful, and legal obligation where reporting is required.
- Understanding how features are used so we can improve them, using first-party product events — legitimate interests in improving the service. You can object; see section 9.
- Handling your requests, questions and complaints — contract and legitimate interests.
- Complying with legal obligations, and establishing, exercising or defending legal claims — legal obligation and legitimate interests.
- Marketing emails about ArtSide, where we send them — consent, or the soft opt-in for our own similar services with an unsubscribe option in every message. [REQUIRES BUSINESS DECISION — confirm whether marketing email is sent and through which provider; no marketing mailing tool is configured in the application today.]
Where we rely on legitimate interests, we have considered the impact on you and you have the right to object.
4.What happens when your images and prompts go to the AI model
This is the most important section for an AI image service, so we set it out plainly.
- When you run a generation or edit, your prompt text, your chosen settings and — for photo workflows — the image or mask you submitted are sent to our image model provider through the Lovable AI Gateway under a zero data retention configuration: requests are processed in memory, are not stored by the provider, and are not used to train AI models.
- This happens because it is the only way to produce the image you asked for. Our servers, not your browser, make that request; the browser never holds the provider's credentials.
- Your uploaded photographs and your generated images are stored by ArtSide in private storage on our own backend (Supabase), not only at the AI provider. They are not public: they are served to you through links that expire.
- The link we give the AI provider is time-limited (currently 15 minutes for photo workflows and shorter for masks), but the provider may retain inputs and outputs for its own operational period.
We do not use your photographs, prompts or generated images to train our own AI models. ArtSide does not run biometric identification or biometric categorisation on uploaded photographs; the checks we run confirm file type, size and dimensions.
Automated safety checks
Before a prompt is processed, a photograph is registered, or a generated image is stored, it is screened by an automated safety classifier that checks it against our Acceptable Use Policy. The classifier runs through the Lovable AI Gateway under a zero data retention configuration: the request is processed in memory, is not stored or cached by the provider, and is never used to train AI models.
If the safety service cannot be reached or does not respond, the request is refused rather than allowed through unchecked, and any reserved credits are returned. Blocked content is recorded as a minimal moderation incident (category flags and severity only, not your full prompt) and may be reviewed by our team. Suspected child sexual abuse material and similarly serious illegal content is deleted immediately and permanently; it is never retained on our storage.
5.Sensitive information in images
Photographs can incidentally reveal sensitive information — for example about health, religious belief, ethnicity or sexual life. Please avoid uploading images containing sensitive information unless it is necessary and lawful for you to do so.
We do not intentionally seek out special category data and we do not use images to infer such characteristics. Where special category data reaches us incidentally inside an image, we process it only to deliver the service you requested and to keep the service safe.
[REQUIRES UK ADVISER REVIEW — confirm the analysis and condition relied on for incidental special category data, and whether a DPIA is required for the photo workflows.]
7.International transfers
Some of our providers process data outside the UK — in particular the AI model provider and the payment provider, which operate in the United States.
Where a restricted transfer happens, it must be covered by an appropriate safeguard: UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another mechanism the law allows. A transfer risk assessment is required where the safeguard is contractual.
[INSERT — record, for each provider named above, the actual hosting region, the transfer mechanism actually in place and the date of any transfer risk assessment. Do not publish a specific mechanism for a provider until it has been confirmed in that provider's contract.]
8.How long we keep data
- Account data: for as long as your account exists, and then for a limited period afterwards to handle disputes and to stop abuse.
- Uploaded photographs: kept in private storage while you use them and while related generations exist, unless you delete them.
- Generated images and gallery items: kept until you delete them or close your account.
- Prompts and generation records: kept with the related image record for the same period.
- Credit and billing records: retained for the period required by tax and accounting law (in the UK, generally six years).
- Support messages: kept for as long as needed to handle the matter and a reasonable period afterwards.
- Security, error and rate-limit logs: kept for a short operational period.
- Moderation incident records: kept for 180 days and then deleted automatically, unless the incident has been escalated (for example to authorities or for legal review), in which case it is kept for as long as the matter requires.
- Closed accounts: content associated with the account is removed, other than records we must keep by law or need to retain to prevent abuse.
Moderation incident records are deleted automatically after 180 days (unless escalated). [REQUIRES BUSINESS DECISION — set and document concrete retention periods for the remaining categories (for example, logs 30–90 days, deleted-account content 30 days) and implement automated deletion for them before publishing this section as final.]
9.Your rights
Subject to conditions in the law, you can ask us to: give you access to your personal data; correct inaccurate data; erase data; restrict how we use it; provide it in a portable format; or stop processing based on legitimate interests or direct marketing. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.
ArtSide does not make decisions producing legal or similarly significant effects about you by purely automated means. Automated safety checks may block an individual prompt, upload or image, but strikes, suspensions and other material enforcement decisions on your account involve human review, and you can ask for any decision to be looked at again.
To make a request, email [INSERT PRIVACY EMAIL — e.g. privacy@artside.ai once the mailbox exists]. We may need to verify your identity, and we will normally respond within one month.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk), or to your local supervisory authority.
10.Security
We use technical and organisational measures appropriate to the risk. At a high level these include: authenticated accounts; row-level access rules so a signed-in user can only reach their own records; private storage buckets with time-limited signed links rather than public URLs; server-side handling of all provider credentials so they are never exposed to the browser; validation of uploads; rate limiting on generation and print endpoints; and operational logging and monitoring.
No online service can be completely secure, and we do not claim that ArtSide is 100% secure. If a personal data breach occurs that is likely to present a risk, we will notify the ICO and, where required, affected users.
[REQUIRES BUSINESS DECISION — confirm the backup and restore arrangement provided by the hosting platform, and document a written incident response process.]
12.Children
ArtSide is not intended for children. You must be at least 18 to hold an account.
[REQUIRES BUSINESS DECISION — confirm the minimum age with a solicitor; the current beta policy assumes 18+ because ArtSide is a paid AI image service that accepts photographs of people.]
If we learn that an account belongs to someone below the minimum age, we will close the account and delete the associated content, other than records we must keep. If you believe a child has provided us with personal data, contact [INSERT PRIVACY EMAIL — e.g. privacy@artside.ai once the mailbox exists].
13.Changes to this notice
We will update this notice when our processing changes. The version and dates are shown at the top of the page, and we will tell you about significant changes through the product or by email.