GENSTA AI — Политика конфиденциальности (Privacy Policy)

PRIVACY POLICY (EN)

Version: 2.1 • Effective date: 2026-08-01

1. Data We Collect

1. Account Data: Telegram user ID, username, display name, language preference; or Google account email and display name (for web/iOS users).
2. User-Submitted Content: Text prompts, uploaded photos, uploaded videos, and any other media you submit for AI generation.
3. Face Data: When you upload photos containing faces (e.g., for portrait presets, avatar creation, or image/video generation), the uploaded images are sent to third-party AI providers for processing. We do not extract, store, or create face templates, face embeddings, or biometric identifiers. The photos are used solely as visual input for the AI model to generate the requested output. Face data is processed only as part of the uploaded image and is not separated or analyzed independently.
4. Generated Outputs: AI-generated images and videos produced from your inputs.
5. Payment Metadata: Transaction identifiers, package IDs, amounts. We do not store credit card numbers or banking details.
6. Technical Logs: Request identifiers, timestamps, device type, error diagnostics. We do not collect IP addresses from Telegram interactions.

2. How We Use Your Data

1. To provide the AI generation service: your prompts and uploaded media (including photos with faces) are sent to third-party AI providers to generate the requested output.
2. Content moderation and compliance with our Content Policy and applicable law.
3. Customer support, billing, abuse prevention.
4. Anonymized analytics to improve the service.

3. Third-Party AI Services — Data Sharing Disclosure

To generate images and videos, we transmit your submitted data (text prompts and uploaded photos/videos) to the following third-party AI service providers:

• fal.ai (Fal AI, Inc.) — hosts models including Google Veo 3, OpenAI Sora, Nano Banana, Kling Motion Control, Seedream
• WaveSpeed AI (WaveSpeed AI, Inc.) — hosts models including Wan 2.5, Seedream v4.5
• MiniMax (MiniMax Technology Co., Ltd.) — MiniMax/Hailuo video generation

These providers process your data solely to generate the requested AI output. They operate under their own privacy policies and data protection commitments. We do not share your data with these providers for advertising, profiling, or any purpose other than fulfilling your generation request.

What is sent: The text prompt you write and any images/videos you upload (which may contain faces or other personal data).

User consent: By submitting content for generation, you explicitly consent to your data being transmitted to these third-party AI providers for processing. You may choose not to upload personal photos if you do not wish this data to be shared.

4. Face Data — Detailed Disclosure

1. What face data is collected: We collect only the photos you voluntarily upload that may contain facial imagery. We do not use facial recognition technology, do not create face prints or biometric templates, and do not identify individuals.
2. How face data is used: Uploaded photos containing faces are sent to third-party AI providers (listed in Section 3) as visual input for AI image/video generation (e.g., portrait presets, avatar creation, animation). The AI model uses the visual appearance in the photo to generate the requested creative output.
3. Third-party sharing: Photos with faces are shared only with the AI providers listed in Section 3 and only for the purpose of generating the requested output. No face data is sold to or shared with any other third party.
4. Storage: Uploaded images are stored on AWS S3 (Amazon Web Services) for delivery to you and for your project history. Generated outputs are stored on AWS S3/CloudFront.
5. Retention: Uploaded photos and generated outputs are retained as long as your account is active. You may request deletion of your data at any time by contacting support in the telegram bot /help.
6. Protection: All data transfers use HTTPS/TLS encryption. Access to storage is restricted by access control policies.

5. Legal Bases

1. Contract: acceptance of Terms of Service, your request to use the generation service.
2. Consent: by uploading photos and submitting generation requests, you consent to data processing as described.
3. Legitimate interests: service reliability, security, abuse prevention.
4. Legal obligations: compliance with applicable law.

6. Payment Providers and Subscription Data

• Stripe (for USD card payments)
• YooKassa (for RUB payments)
• Telegram Stars (for in-bot purchases)
• Apple In-App Purchase (for iOS purchases)

Payment providers process transactions under their own privacy policies. We receive only transaction metadata (IDs, amounts, status). Card details are neither transmitted to nor stored by us.

Additional data for subscriptions:

• Card (YooKassa). To charge recurring payments we store the payment token (payment_method_id) issued by YooKassa and a card “mask” (type and last 4 digits): the token is required for recurring charges, the mask lets you see which card is linked. Unbinding the card in your account deletes the token from our system, after which no further charge is possible.
• Apple. Purchases carry an appAccountToken — a random identifier of your account in our system (a UUID containing no personal data). It lets us match Apple’s renewal and refund notifications, which arrive without the app being involved, to your account. When Apple reviews a refund request we share consumption data as defined by the App Store Server API: share of credits consumed, account status and whether the result was delivered (see Section 6B of the Terms of Service).
• Subscription history. We keep the history of subscription payments and credit grants (plan, amounts, period dates, charge attempt statuses) for accounting, support, refunds and tax obligations.

7. Storage and CDN

User content and generated outputs are stored on Amazon Web Services (AWS) S3 and delivered via AWS CloudFront CDN. Servers may be located outside your country of residence.

8. Children

The service is intended for users aged 18 and older. We do not knowingly collect data from minors.

9. Your Rights

You may request access to, correction of, or deletion of your personal data by contacting support in the telegram bot /help. We may request verification of your identity before processing the request.

10. Security

We implement reasonable technical and organizational measures (access controls, encryption in transit and at rest where applicable, audit logs). No method guarantees absolute security.

11. Cross-Border Transfers

Data processing may occur outside your country (AI provider and cloud infrastructure locations). By using the service, you consent to such transfers.

12. Updates

We may update this policy by posting a new version and date here.