Privacy Policy

This policy explains what personal data Increation collects, why, who we share it with, how long we keep it, and what choices you have. The data controller is Increation, 1968 S. Coast Hwy #1921, Laguna Beach, CA 92651, United States. To ask about privacy, email legal@increation.ai.

1. What we collect#

When you sign in. You sign in with Google or Apple through our authentication provider, Supabase.

• Increation's own database stores your account ID, your email address and the date you joined.
• Supabase's authentication service also keeps the profile details Google or Apple share at sign-in.
• We don't read or store your name or profile picture in Increation.

When you create. For each generation we store:

• the prompt;
• the model and settings you chose, including any reference images you attached;
• the images or videos that come back;
• the generation's status;
• what it cost us at the provider.

When you use Chat. We store your conversations: the text of each message you send, links to the images you attach, and the assistant's replies and plans. That's what lets you come back to a conversation.

When you use the prompt enhancer. We don't store the prompt you send to the enhancer. The reference images you include are the uploads and outputs already described above. For each request we log your account ID, the model, the number of images, the outcome and the token counts.

When you talk to Creatorb. Voice is optional, and the microphone opens only after you tap to start a conversation. Before your first conversation we show you what happens to your voice, and we record that you agreed and when.

• While the microphone is on, your voice streams live from your browser to OpenAI, which listens and speaks Creatorb's replies in an AI-generated voice.
• We don't record or store your audio.
• We save a text transcript of what you and Creatorb said, as messages in that Creator project.
• For each conversation we count its length, to apply the voice time limits: a daily allowance, a cap on each conversation, and a small total for the free trial.
• We don't create voiceprints, and we don't use your voice to identify you or to guess your age, gender or emotions.

When you share. If you share a generation by link or publish it to the Gallery, we store your sharing choices with it: who can see it, whether the prompt is shown, whether others can remix it, and any title and tags you add. If someone reports a shared page, we store the report with a one-way fingerprint (hash) of the reporter's IP address, not the address itself.

Content screening. Every generation request, Chat message and Gallery publish is checked against our Content Policy before it runs. For each check we keep the result, the category scores and a fingerprint (hash) of the text. For refused requests we also keep the text, so we can review mistakes. We never keep a copy of the images that were checked.

Credits. We keep a record of every credit grant, spend and refund on your account.

Rate limiting. To prevent abuse, we count requests for a short window: generations per account and per IP address, Chat messages and prompt enhancements per account, and reports of shared pages per IP address. Where an IP address is counted, it's stored as part of that counter, and the counter is deleted after the window expires.

Server logs. Our hosting provider, Vercel, records standard request logs (such as IP address, URL, time and errors) when you use the site.

Analytics. We use Google Analytics, through Google Tag Manager, to count visits, pages viewed, sign-ups and purchases, with your device, browser, approximate location and the link that brought you. It never receives your email, name, prompts, Inputs or Outputs. In the EU, the EEA and the UK it stays off until you accept it.

Tool page counts. Our tool pages count the steps of a visit on our own servers, with a random ID kept in your browser and the campaign tags on the link that brought you. In the EU, the EEA and the UK this also waits until you accept analytics.

Advertising (Meta). We advertise on Facebook and Instagram. To measure those ads we use the Meta Pixel in your browser and Meta's Conversions API from our servers. They tell Meta when you view a page, create an account, or buy a plan or credits (with the amount and currency). They send your IP address, your browser, Meta's cookie IDs (_fbp, _fbc) and the page address. For sign-ups and purchases, and whenever you're signed in, our servers also send your email address and account ID, each hashed (SHA-256) first, so Meta can match them without receiving them in plain text. The Pixel in your browser never receives your email or account ID. Meta handles this data under its own terms. In the EU, the EEA and the UK none of this happens until you accept it. In California, "Do Not Sell or Share My Personal Information" and Global Privacy Control turn it off.

What we don't collect. Apart from Meta, above, we don't use advertising tools. We don't fingerprint devices. See the Cookie Policy for what we store in your browser.

Payments. Plans and credit packs are bought through Stripe's checkout, embedded in our site. Stripe is the merchant of record: it handles your payment details, not us, and adds tax at checkout.

2. Why we use it#

• To run the Service: to sign you in, generate what you ask for, store it, show it back to you, and share it when you choose to. (Legal basis where applicable: performance of our contract with you.)
• To run credits: to grant your free credits once, charge for generations and refund failed ones. (Contract.)
• To understand and improve the Service: analytics on how people find and use it. (Consent in the EU, the EEA and the UK; legitimate interests elsewhere.)
• To measure our advertising: telling Meta which of our ads led to visits, sign-ups and purchases. (Consent in the EU, the EEA and the UK; legitimate interests elsewhere.)
• To keep the Service safe: content screening, rate limiting, preventing abuse, and enforcing our Terms and Content Policy. (Legitimate interests.)
• To meet legal obligations: for example, tax and accounting records, and responding to lawful requests. (Legal obligation.)

We don't sell your personal data. Its only advertising use is measuring our own ads with Meta (section 1). We don't use your prompts, Inputs or Outputs to train AI models. Section 3 covers what our providers do.

Your work is private unless you choose to share it. We won't use it in our showcase or marketing without your consent.

3. Who we share it with#

We share data only with the service providers that run Increation:

Requests to the AI model providers, Anthropic and OpenAI route through Vercel's AI Gateway. There are two exceptions. Our servers send requests for the models fal and ElevenLabs host straight to them, and your browser never talks to either. When you talk to Creatorb, our server sets up the connection, and then your browser streams your voice straight to OpenAI.

The AI model providers with enabled models are OpenAI, Google, Black Forest Labs, xAI, Recraft, Kling (Kuaishou), Alibaba Cloud, fal and ElevenLabs. fal hosts models made by others (Alibaba's HappyHorse and Lightricks' LTX-2.3), and the makers of those models don't receive your data. fal also runs Stability AI's Stable Audio 2.5 for music and sound effects, and ByteDance's Seedance 2.5 video model on its US-hosted service. fal also runs models from MiniMax, PixVerse, VEED, Topaz Labs, Ideogram, HeyGen, Luma, Creatify and Sync Labs; for those, the model's maker may receive your prompt, settings and reference media through fal. Each handles the data it receives under its own terms:

• OpenAI (privacy policy) and xAI don't train on API data by default, and keep it for up to 30 days for abuse monitoring. Creatorb's voice is the exception: it runs under OpenAI's zero data retention, so OpenAI doesn't keep your audio or the conversation, and doesn't train on it.
• Google (Gemini API terms) doesn't use paid-tier API data to improve its products, and keeps logs for a limited period for abuse detection.
• Black Forest Labs: we use their models through their API, under their API terms.
• Recraft (Developer Terms) doesn't train on API data.
• Kling (API privacy policy) doesn't train on API data.
• Alibaba Cloud (privacy policy) doesn't train on API data without our separate consent, and we haven't given it.
• fal (privacy policy): our servers call fal under its API Services Terms.
• ElevenLabs (privacy policy): we've switched off ElevenLabs' use of our data to improve its models. ElevenLabs stores data in the United States.
• The makers whose models fal runs for us handle what they receive under their own privacy policies: MiniMax (privacy policy), PixVerse (privacy policy), VEED (privacy policy), Topaz Labs (privacy policy), Ideogram (privacy policy), HeyGen (privacy policy), Luma (privacy policy), Creatify (privacy policy) and Sync Labs (privacy policy). MiniMax's terms let it use the data it receives to improve its services.
• Anthropic (commercial terms) doesn't train on commercial API data.
• Vercel processes gateway traffic under its AI Product Terms.

We may also disclose data when the law requires it, to protect people's safety or our rights, or to a buyer as part of a merger, acquisition or sale of assets.

4. Where it's stored and how long we keep it#

• Your images, videos and uploads are stored in a private Vercel Blob store. Only your signed-in account can view them through our site, unless you share them.
• Outputs have no automatic expiry. They stay until you delete them.
• Deleting a generation moves it to Trash. It stays there for 30 days, hidden from your history, collections and any share link. After 30 days, or sooner if you delete it from Trash, its images or video and its stored record are permanently removed from file storage, and reference images that no remaining generation uses are deleted automatically after that. One database row for that generation is kept: it holds the prompt, model, settings, status, cost and dates. We keep that row as the audit trail for credits and billing, for as long as your account exists.
• Reference images that no generation uses are deleted automatically once they're more than 24 hours old. Reference images attached to a generation stay with it.
• Chat conversations are kept for as long as your account exists.
• Voice. We don't store audio. Transcripts of your conversations with Creatorb are messages in their Creator project and are kept for as long as your account exists. So is the record that you agreed to the voice notice.
• Screening records are kept as abuse records (see "After you close your account" below).
• Credit records are kept for as long as your account exists, as the accounting record.
• Rate-limit counters are deleted after their short window.
• Server logs are kept by Vercel for its standard retention period.
• Closing your account. There's no in-app control for this yet. Email legal@increation.ai from the email address you sign in with. Once we've verified the request, we delete your account and its data within 30 days: your account record, sign-in details, generations, Chat conversations, and stored images, videos and uploads.
• After you close your account. We keep your credit records and abuse records (screening records, reports and enforcement decisions) for up to 7 years, for legal, tax and fraud-prevention reasons. Then we delete them.

International transfers. We process your data in the United States. If you're in the European Economic Area, the United Kingdom or Switzerland, we rely on the Standard Contractual Clauses in our providers' data processing agreements to protect it when it's transferred.

5. Security#

Sign-in uses Google or Apple through Supabase. Your files are stored privately and served only to your signed-in session, or through a share link you created. Database access from the browser is closed off, and all access goes through our server. No system is perfectly secure, and we can't guarantee that data will never be exposed.

6. Your choices and rights#

• You can delete any generation from your history at any time (see section 4 for exactly what that removes).
• You can make a shared item private again at any time.
• You can sign out at any time.
• To access, correct, export or delete your personal data, or to object to how we use it, email legal@increation.ai from the email address you sign in with. That's how we verify the request comes from you. We'll respond within 30 days.
• California: you can opt out of the sale or sharing of your personal information. We don't sell it, but Google Analytics and our Meta advertising may count as sharing. Use "Do Not Sell or Share My Personal Information" in the site footer, or turn on Global Privacy Control in your browser, which we honour automatically.
• Depending on where you live, you may have these rights under laws such as the GDPR, the UK GDPR or the CCPA/CPRA, and you can complain to your local data protection authority. We haven't appointed a representative in the EU or the UK. Send all requests, from anywhere, to legal@increation.ai.

7. Children#

The Service is for adults (18 and over). We don't knowingly collect data from children. If you believe a child has an account, tell us and we'll delete it.

8. Changes#

We'll update this policy when our practices change. For a material change, we'll give you at least 14 days' notice before it takes effect, by email and by a notice in the Service. Other changes take effect when we post them, and the date at the top of this page will change.

9. Contact#

Increation 1968 S. Coast Hwy #1921, Laguna Beach, CA 92651, United States legal@increation.ai