Privacy Policy
This policy explains what information GPT Image 2 collects, how we use it, with whom we share it, and the choices you have.
Contents
搂 1Who we are
GPT Image 2 ("we", "us", "our") operates the website images2gpt.com and the AI image-generation service offered through it (the "Service"). For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, we are the data controller for personal data processed in connection with the Service.
If you have any privacy questions, contact us at [email protected].
搂 2Data we collect
2.1 Information you give us
- Account data. Email address and a hashed password (PBKDF2-SHA-256 with a per-user random salt 鈥?we never store the plain password).
- Prompts & generation parameters. The text you enter, the aspect ratio, and the resolution you choose.
- Reference images (optional). Files you upload for image-to-image generation.
- Support correspondence. Anything you send to [email protected].
2.2 Information collected automatically
- Device & connection data. IP address, user-agent, country (derived from IP), and timestamps.
- Session tokens. A random opaque token stored in your browser localStorage to keep you signed in.
- Anonymous-trial marker. If you generate one free image without signing in, we store a single key-value record keyed on your IP address ("this IP has used its free generation"), kept for 90 days, to prevent abuse.
- Usage events. Generation history (task IDs, resolution, cost in credits, success/failure, timestamps) and a credit-transactions ledger.
2.3 Information from payment processors
We do not see or store your full card number, CVV, or bank account details. When you upgrade a plan we use a third-party Merchant of Record who collects payment details directly. We receive only a transaction reference, the plan you bought, the amount, your billing country, and the last 4 digits of your card (where applicable).
2.4 Information we do NOT collect
- We do not collect biometric identifiers.
- We do not buy or rent personal data from third parties.
- We do not maintain advertising profiles, and we do not sell your personal data.
搂 3How we use your data
| Purpose | Data used | Legal basis (EEA/UK) |
|---|---|---|
| Provide the Service (auth, image generation, credits) | Account data, prompts, IP, session tokens | Contract |
| Bill subscriptions, prevent fraud and chargebacks | Plan, transaction references, IP, country | Contract / legitimate interest |
| Enforce free-tier limits and prevent abuse | IP-based anonymous-trial marker | Legitimate interest |
| Trust & safety: filter prohibited content from prompts | Prompt text, generation events | Legal obligation / legitimate interest |
| Customer support | Email, support correspondence, account data | Contract / legitimate interest |
| Improve reliability & fix bugs | Aggregated, non-identifying usage logs | Legitimate interest |
| Comply with law (tax, accounting, requests) | Whatever the law requires | Legal obligation |
We do not use your prompts or generated images to train any AI model.
搂 4Legal bases (GDPR)
If you are in the European Economic Area, the United Kingdom, or Switzerland, we process personal data only when we have a lawful basis: (a) performance of a contract with you; (b) compliance with a legal obligation; (c) our legitimate interests (running, securing, and improving the Service); or (d) your consent, where required.
搂 5Sharing & sub-processors
We share personal data only with the third parties below, all of whom are bound by data-processing agreements:
| Vendor | Purpose | Data shared | Region |
|---|---|---|---|
| Cloudflare, Inc. | Hosting (Pages, Functions, D1, KV, CDN) | All Service data, IPs, requests | Global edge |
| kie.ai | AI image generation (GPT Image 2 model) | Prompt text, aspect ratio, resolution | Singapore / US |
| Creem (Armitage Labs O脺) | Merchant of Record 鈥?payment, tax, invoicing | Email, plan, billing country, card metadata | EU / global |
| Google Fonts | Web font delivery | IP address, user-agent | Global |
We may also disclose personal data when required by law, valid legal process, or to protect the rights, safety, or property of GPT Image 2, our users, or the public.
搂 6International transfers
Because Cloudflare and kie.ai operate globally, your data may be processed in countries outside the EEA / UK that do not have an "adequacy decision". When we transfer personal data internationally we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) and/or other valid transfer mechanisms.
搂 7Data retention
- Account & credits. While your account is active, plus up to 12 months after deletion for legal and accounting purposes.
- Generated images. Image URLs returned by kie.ai are typically valid for ~14 days at the upstream provider; we do not permanently host generated images on our own servers.
- Anonymous-trial marker. 90 days from creation, then deleted automatically.
- Session tokens. 30 days, automatically expired.
- Server logs. Up to 30 days at the edge provider, retained only for security and abuse prevention.
- Billing records. 7 years (statutory tax and accounting requirements).
搂 8Security
We implement industry-standard safeguards: TLS in transit, password hashing with PBKDF2 (100,000 iterations + per-user salt), opaque session tokens with TTL expiry, atomic credit-deduction at the database layer (so credits cannot be double-spent), and least-privilege secrets management on Cloudflare. No system can be 100% secure, however, and you are responsible for keeping your own password confidential.
搂 9Your rights
Depending on where you live (EEA, UK, California, Brazil, etc.), you may have the right to: access the data we hold about you; rectify inaccurate data; delete your data ("right to be forgotten"); restrict or object to processing; receive a copy in a portable format; and withdraw consent at any time where consent is the basis.
To exercise any of these rights, email [email protected] from the address associated with your account. We will respond within 30 days. We will not discriminate against you for exercising any right.
If you are in the EEA / UK and believe we have not handled your data lawfully, you also have the right to lodge a complaint with your local supervisory authority.
搂 10Cookies & tracking
The Service uses only strictly-necessary browser storage:
localStorage["gi2_token"]鈥?your session token (set after sign-in, cleared after sign-out).localStorage["gi2_anon_used"]鈥?a single boolean indicating that this browser has used its free trial.
We do not use third-party advertising or behavioural-tracking cookies. See our Cookie Policy for details.
搂 11Children
The Service is not directed to children under 13 (or under 16 in jurisdictions that require it). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.
搂 12Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision. For material changes we will give you reasonable notice (e.g. by email or an in-product banner) before the change takes effect.
搂 13Contact
Questions, requests, or complaints about privacy:
- Email: [email protected]
- Mail: see our Contact page.