Privacy Policy

1Information we collect

Account information. When you sign up we collect your email address and authentication credentials. Passwords are handled by our authentication provider in hashed form; we never see or store them in plain text. If you sign in with Google, we receive your email address and basic profile information from Google, not your Google password.

What you work on. Your conversations with the agent: the briefs you write, the references you upload, the findings the agent returns, what you approved, and the media it generated. This is the working material of the Service.

Billing records. Your subscription status, plan, credit balance and invoice identifiers — the metadata needed to run your account. Not your card.

Usage and device information. Standard technical data — log records, approximate region, browser and device type, and interactions with the Service — to keep it secure and to understand how it is used.

2Payment information

We do not collect, store or process your payment card details — at all. All payments are handled by Stripe, our payment processor, on its own systems and under its own privacy policy. Checkout, payment methods, invoice history and cancellation happen in Stripe’s customer portal, not on our servers. What we receive back is limited billing metadata: subscription status, plan and invoice records.

3How we use information

We use the information we collect to:

• run the Service — research, generation, editing and assembly, and the conversation that holds them together;
• price and meter runs in credits, and maintain your subscription and credit records through Stripe;
• secure the Service, prevent abuse and debug problems;
• respond to support requests sent to our inbox;
• send service communications, which we keep separate from optional marketing email; and
• comply with legal obligations.

4Sending your material to model providers

Fulfilling a run you approved requires sending the relevant material — the prompt, the settings, and any references it draws on — to the third-party model provider that runs it. We send what the run needs and nothing more, under commercial agreements with those providers.

We do not sell your information, and we do not use your material to train models of our own.

5Research the agent performs for you

When you ask for research, the Service retrieves publicly available material on your behalf and returns it with its source. That retrieval happens from our infrastructure, not from your browser or your accounts: the Service never connects to, signs into, or posts from your social accounts, and it does not read anything private on them.

6How we share information

We share information only with:

• service providers that run the Service for us — cloud hosting, database and file storage, our authentication provider, Stripe for payments, and the model providers that perform generation — each bound to use it only to provide their service to us;
• authorities or other parties where required by law, to protect rights and safety, or to enforce our Terms; and
• a successor entity in a merger, acquisition or asset sale, in which case this Policy continues to apply to your information.

We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.

7Cookies and similar technologies

The Service uses strictly necessary storage — authentication tokens kept in your browser — to keep you signed in and the application working. We do not use third-party advertising cookies or trackers.

8Retention and deletion

Files have a short life by design. Uploaded references are retained for 15 days and generated outputs for 30 days, after which they are deleted from our storage. Download anything you want to keep before its window closes.

Your conversations and account records are kept while your account is active and as needed to provide the Service. To delete your account, write to us at the address below; we will delete or irreversibly anonymise your personal information within a reasonable period, except for records we must keep for legal, billing or security reasons, which are kept only as long as required.

9Security

We protect information with industry-standard measures: encryption in transit, access controls, isolated infrastructure and least-privilege practices. No system is perfectly secure, so we cannot guarantee absolute security — but card data never touching our systems removes the highest-risk category entirely, and a storage window measured in days limits what there is to lose.

10International transfers

We and our service providers may process information in countries other than yours. Where we transfer personal data internationally from regions that restrict such transfers — such as the EEA or the UK — we rely on appropriate safeguards, including standard contractual clauses with our providers.

11Your rights

Depending on where you live, you may have rights to access, correct, delete, export or restrict the processing of your personal information, to object to certain processing, and to complain to a supervisory authority. You can exercise several of these directly in the Service, and the rest by writing to us. We respond to verified requests within the time required by applicable law, and we do not discriminate against you for exercising your rights.

12Children

The Service is for business use and is not directed at children. We do not knowingly collect personal information from anyone under 16; if you believe a child has provided us information, contact us and we will delete it.

13Changes to this Policy

We may update this Policy as the Service evolves. Material changes will be announced through the Service or by email before they take effect, with the effective date above updated accordingly.

14Contact

Privacy questions and requests: hello@oneirosea.com.