Privacy Policy

How JoyInAIGC collects, uses, stores and shares your data, and the rights you have over it. Last updated 2026-07-21.

About this policy

JoyInAIGC (“we”, “us”) respects and protects your privacy. This Privacy Policy explains how we collect, use, store and share your personal information when you use JoyInAIGC (the “Service”), and the rights you have. Please read it before using the Service — using the Service means you have read and agree to it. We may update this policy from time to time; for material changes we will notify you in advance by email or in-app notice.

1. Data controller

Controller: JoyInAIGC
Privacy contact: support@joyinaigc.online
Data Protection Officer (DPO): not appointed (small business).

2. Information we collect

2.1 Information you provide

Account: name / nickname, email, password (stored encrypted), sign-in identity.
Payment: transaction amount and status. We do NOT store full card numbers — card data is handled by the payment processor (see §5).
Generation inputs: the prompts you enter and reference images you upload.
Communications: emails, tickets and feedback you send to support.

2.2 Information collected automatically

Device & network: IP address, device model, OS, browser type, time zone.
Usage: pages visited, features used, action logs, session duration.
Generation history: the images / videos you generate and their records.
Logs: request time, error logs, performance data.

Optional

Third-party sign-in: when you sign in with Google, we receive the basic profile info you authorize.

3. How we use your information

Purpose	Legal basis
Provide and maintain the Service	Performance of a contract
Billing and payment processing	Performance of a contract
Customer support	Contract / legitimate interest
Service notices (billing, security, policy updates)	Legitimate interest
Security and fraud prevention	Legitimate interest
Product improvement and analytics	Legitimate interest
Legal compliance	Legal obligation
Marketing (optional)	Consent

We may aggregate or de-identify data for statistics; such data cannot identify an individual.

4. Cookies & tracking

Type	Purpose	Optional
Strictly necessary	Keep you signed in, core features	No
Functional	Language and personalization	Yes
Analytics	Anonymous usage stats, improvements	Yes
Marketing (optional)	Targeted ads and measurement	Yes

Analytics tools in use: Google Analytics 4 (aggregate traffic and conversion statistics) and Microsoft Clarity (session replay and heatmaps, used to find where the interface fails people). Clarity records page interactions such as clicks, scrolling and page structure. Prompt inputs, your generation history and the admin area are explicitly marked for masking, so their text is not captured. Live chat is provided by tawk.to. These providers set their own cookies. You can adjust cookie preferences in your browser settings, or block these providers with a tracker-blocking extension — sign-in, generation and payment keep working either way.

5. Sharing & disclosure

We do not sell your personal information (including any “sale” as defined by laws such as the CCPA). We share it only in these cases:

Service providers (cloud, payment, support), bound by confidentiality. Card data is handled exclusively by our payment partner, a PCI-DSS-compliant merchant of record, and is not stored on our servers. Authentication and database by Supabase; hosting by Vercel; generation requests are processed by third-party AI model providers.
Legal & regulatory: where required by law, court order, or a lawful request from a competent authority.
Business transfers: in a merger or acquisition, with advance notice and continued protection obligations.
With your consent: for other purposes, with your explicit prior consent.

6. Data security

Encryption in transit: TLS / HTTPS.
Storage: passwords and sensitive data are hashed or encrypted.
Access control: least-privilege principle; staff bound by confidentiality.
Regular security review and vulnerability scanning.

If a security incident affects your rights, we will notify you and the relevant regulator within 72 hours of discovery, as required by law. Please keep your account credentials safe and do not share them.

7. Data retention

Data type	Retention	On expiry
Account information	While active; up to 30 days after closure	Delete or anonymize
Transaction records	As required by law, typically 5 years	Delete or archive
Support records	2 years	Secure deletion
Security audit logs	12 months	Secure deletion

8. Your data rights

To exercise the following rights, contact us and we will respond within 30 calendar days.

Right	Description
Be informed	Know what data we collect and how we use it
Access	Get a copy of your personal information
Rectification	Correct inaccurate or incomplete information
Erasure	Request deletion under certain conditions
Restrict processing	Pause processing in certain cases
Data portability	Receive your data in a machine-readable format
Object	Object to processing based on legitimate interest or marketing
Withdraw consent	Withdraw consent-based processing

You may also delete your account in-app (Settings). If you believe we have not handled your data properly, you may complain to your local data protection authority.

9. Marketing & opt-out

With your consent, we may send marketing about the Service by email or in-app notice. You can opt out anytime via the “unsubscribe” link, by turning off marketing notices in account settings, or by contacting us. Opting out does not affect essential service notices (billing, security).

10. International transfers

Our servers and providers may be located in the United States and other regions (e.g., Vercel, Supabase). For cross-border transfers we rely on appropriate safeguards:

Data processing agreements incorporating EU Standard Contractual Clauses (SCC).
Transferring only to recipients with an equivalent level of protection.

11. Children

The Service is intended for users aged 18 and above. We do not knowingly collect information from anyone below that age. If you believe your child has provided us information, please contact us and we will delete it promptly.

12. Third-party links & services

The Service may contain third-party links or integrations. This policy applies only to information we collect directly. We are not responsible for third parties’ data practices; please review their policies before use.

13. Changes to this policy

For material changes, we will notify you at least 15 days in advance via a platform announcement or your registered email, and update the “Last updated” date at the top. Continued use after the effective date means acceptance.

14. Contact us

Privacy email: support@joyinaigc.online
Support email: support@joyinaigc.online
Hours: Mon–Fri, 9:00–18:00 (UTC+8)

This policy is for reference only and does not constitute legal advice. Consider having a qualified lawyer in your target market review it before publishing.