Privacy Policy

Tracia Creative is the data controller for personal information processed through the Service. You can reach us at hello@traciacreative.com for any privacy question, request or complaint.

We collect only what we need to run the Service:

• Account data: email address, hashed password (or OAuth identifier if you sign in with Google), display name, plan tier and account preferences.
• Shop profile: optional details you provide about your shop, niche, brand voice and target audience to personalise generations.
• Uploads: product images and files you upload to generate listings, plus any text prompts or notes you enter.
• Generated content: listings, titles, tags, descriptions, blog drafts, image prompts and other output, stored so you can access them across sessions.
• Usage and quota data: number of generations, features used, project counts, trial status and timestamps, used for billing, limits and product improvement.
• Support and feedback: messages, bug reports and feature requests you submit, including anything you choose to include in them.
• Payment data: processed entirely by Stripe. We receive only a customer/subscription identifier, plan, status and the last four digits and brand of your card. We never see or store full card numbers.
• Affiliate data: if you join the partner program — referral codes, click and conversion counts, and your PayPal payout email.
• Technical data: IP address, browser and device type, pages viewed, referring URL, timestamps and error logs, collected for security, abuse prevention and diagnostics.

We do not intentionally collect special-category data (health, biometrics, political or religious beliefs) and ask that you do not upload it. The Service is not intended for children under 18 and we do not knowingly collect their data.

• Provide, operate, secure and improve the Service and generate the output you request.
• Authenticate you and maintain your session.
• Enforce plan limits, trials, quotas and fair use.
• Process payments, renewals, refunds and affiliate payouts via Stripe and PayPal.
• Send transactional email: receipts, password resets, quota alerts, trial reminders, support replies and important service notices.
• Send product updates and marketing email where permitted — you can unsubscribe at any time from any such email.
• Respond to support requests, bug reports and feature requests.
• Detect, investigate and prevent fraud, abuse, security incidents and breaches of our Terms.
• Comply with legal obligations and enforce our agreements.

• Contract: to provide the Service you signed up for, including billing and support.
• Legitimate interests: product improvement, security, fraud prevention and direct marketing to existing customers.
• Consent: non-essential cookies and analytics, and marketing where consent is required. You may withdraw consent at any time.
• Legal obligation: tax, accounting and lawful requests from authorities.

Your uploaded images and prompts are transmitted to our AI model providers solely to generate the output you requested, then returned to you and stored in your account. We do not sell your uploads or output, do not license them to third parties, and do not use them to train AI models. We contract with providers on terms that prohibit using your content to train their models. You retain ownership of your uploads, and rights in generated output are addressed in our Terms of Service.

We may review content in a limited, targeted way where necessary to investigate abuse, fraud, security incidents or legal claims.

We do not sell personal information. We share data only with service providers who help us operate the Service:

• Supabase — database, authentication and file storage.
• Stripe — payment processing, subscriptions and refunds.
• AI model providers — text and image generation for the features you invoke.
• Email delivery provider — transactional and notification email sent from our tracialabs.com sending domain.
• Hosting and CDN — serving the application.
• PayPal — affiliate payouts, if you participate.

Each is bound by contractual confidentiality and data-protection obligations and may process data only on our instructions. We may also disclose information if required by law, to enforce our Terms, or in connection with a merger, acquisition or sale of assets — in which case we will notify you and the acquirer remains bound by this policy.

Our providers may process data in the United States and other countries. Where personal data is transferred out of the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

• Account data: kept while your account is active.
• Projects, uploads and output: kept until you delete them. Deleting a project removes it from our database; backups are purged on a rolling cycle of up to 30 days.
• Cancelled subscriptions: your projects remain view-only in your library until you delete them or close your account.
• Account deletion: on request, we delete your account and associated content within 30 days, except records we must retain.
• Billing and tax records: retained as required by law (typically up to 7 years).
• Security and abuse logs: typically retained up to 12 months.

We use strictly necessary cookies for authentication, session management and security — these cannot be disabled without breaking the Service. We may use privacy-focused analytics to understand feature usage and improve the product. Where required, we ask for your consent via our cookie banner before setting non-essential cookies, and you can change your choice at any time. We do not use third-party advertising cookies and do not run cross-site behavioural ad tracking.

We apply industry-standard safeguards including TLS/SSL encryption in transit, encryption at rest by our infrastructure providers, hashed passwords, row-level security on every database table, least-privilege service credentials, signed URLs for private file access, webhook signature verification and restricted administrative access. Access to production data is limited to personnel who need it.

No online service can guarantee absolute security. If a breach affecting your personal data occurs, we will notify affected users and any required regulator without undue delay and in line with applicable law.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy.
• Correct inaccurate or incomplete information.
• Delete your account and personal information.
• Export your data in a portable format.
• Object to or restrict certain processing, including direct marketing.
• Withdraw consent where processing is based on consent.
• Not be discriminated against for exercising your rights (CCPA/CPRA).
• Lodge a complaint with your local data protection authority.

To exercise any right, email hello@traciacreative.com from your account address. We respond within 30 days and may need to verify your identity. California residents: we do not sell or share personal information as those terms are defined under the CCPA/CPRA.

You can opt out of marketing email at any time using the unsubscribe link in any message or by contacting us. We will still send essential transactional messages relating to your account, billing and security.

The Service uses AI to generate content and scores, but we do not make automated decisions that produce legal or similarly significant effects about you. Suspension decisions for abuse are reviewed by a human.

We may update this Privacy Policy as the Service evolves. The "Last updated" date above reflects the current version, and material changes will be communicated by email or in-app notice before taking effect.

This Privacy Policy and any dispute relating to it are governed by the laws of the State of Wyoming, USA, without regard to conflict-of-law rules, and are subject to the dispute-resolution provisions of our Terms of Service. If you are a consumer resident in the EU/EEA or UK, this does not deprive you of mandatory protections available under the law of your country of residence.

Privacy questions, requests and complaints can be sent to hello@traciacreative.com or via our contact page. To report a suspected security vulnerability, please email us with the subject line "Security" and allow us a reasonable period to investigate before public disclosure.