Privacy Policy

1. Who we are

We operate Pozset and are responsible for your data. For any privacy question, contact info@pozset.com.

2. What we collect

Account data: name, email address, hashed password or social login identifier.

Content: the images you upload and the images generated from them, together with the settings used.

Usage data: token transactions, generation history, and technical logs such as IP address and browser user agent held for security and debugging.

Payment data: we never see your card details. Polar processes payments and returns only a customer identifier, the amount and the status.

3. Signing in with Google

If you choose "Continue with Google", Google sends us your name, email address, profile picture and Google account identifier. We use them for one purpose: to create and identify your Pozset account.

We request no other Google account data, we do not read your Gmail, Drive, Contacts or Calendar, and we never sell or transfer this data to third parties. It is stored in our own database alongside the rest of your account data and is deleted when your account is deleted.

You can disconnect Pozset at any time from your Google Account permissions page.

4. Why we use it

To operate your account and generate the images you ask for; to charge and refund tokens correctly; to detect abuse; and to meet legal and accounting obligations. We do not sell your data, and we do not use your uploads to train our own models.

5. Who processes it

Google (AI generation — your images are sent to the Gemini API), Amazon Web Services (image storage, EU region), Supabase (database, EU region), Vercel (hosting), Polar (payments).

Some of these providers may process data outside your country. Transfers rely on the providers’ standard contractual clauses.

6. How long we keep it

Account and content data are kept for as long as your account exists. There is no self-service account closure: write to info@pozset.com and we will delete your account and its content within 30 days. Transaction records are kept for the period required by tax law even after deletion. Technical logs are kept for 90 days.

7. Your rights

You may request access to, correction of, or deletion of your personal data, object to processing, or ask for a portable copy. Write to info@pozset.com; we respond within 30 days.

If you are in Turkey these rights arise under KVKK; in the EEA and UK, under the GDPR. You may complain to your local supervisory authority.

8. Cookies

We use a session cookie to keep you signed in and a preference cookie to remember your language. Neither is used for advertising.

9. Security

Data is encrypted in transit. Uploaded images are stored in a private bucket and served only through short-lived signed links scoped to your own account. Passwords are stored hashed.