Privacy Policy

This Policy applies to personal information we process through the Service, whether you are a website visitor or a registered user. It does not apply to third-party websites, products, or services that we do not own or control. We will update this Policy as the product evolves.

2.1 Information you provide. We collect information you give us directly, including:

• Contact details such as your email address when you create an account;
• Account information such as your name, username, and the sign-in identifier from the provider you use to sign in;
• Onboarding answers such as your role, design experience, and age range. We use the age range you give us to confirm you meet the minimum age for the Service, and an answer below 13 will end your access;
• Content you submit such as the designs, files, prompts, instructions, and other materials you provide to the Service to generate output;
• Payment information such as billing details, which are collected and processed by our payment provider rather than stored by us; and
• Communications such as the messages, feedback, and support requests you send us.

2.2 Information collected automatically. When you use the Service, we and our providers may collect certain information automatically, including device and browser information, IP address, approximate location derived from it, general usage and interaction data, referral information and marketing attribution, and information collected through cookies and similar technologies. We collect this to operate, secure, and improve the Service.

2.3 Information from third parties. We may receive limited information about you from service providers and partners, such as analytics providers or, where applicable, the source that referred you to us.

2.4 Sensitive information. We do not seek to collect sensitive personal information through the Service, and we ask that you not submit it.

We use personal information to:

• provide, operate, and maintain the Service, including creating and managing your account;
• process the content you submit and deliver the resulting output to you;
• communicate with you, including sending confirmations, service updates, security alerts, changes to these policies, and (where permitted) news about the product;
• process payments and manage subscriptions;
• understand how the Service is used and improve it, including on an aggregated and de-identified basis;
• protect the Service, detect and prevent fraud, abuse, and security incidents, and enforce our terms; and
• comply with legal obligations and respond to lawful requests.

Where required by law, we rely on a lawful basis for each use, such as performing our contract with you, your consent, our legitimate interests in operating and improving the Service, or compliance with a legal obligation.

The Service uses third-party artificial-intelligence providers to generate output from the content you submit. Your input is routed to those providers for processing, and the resulting output is returned to you. We do not use your input or output to train or develop AI models, and we do not use your content to learn or replicate your specific styles or brand. Once your content reaches a third-party AI provider, it is processed under that provider’s own terms, privacy policy, and retention practices, which we do not control. The Service is an AI system: output is generated by models, not by a person, and is not reviewed by a person before you receive it.

5.1 Service providers. We share personal information with vendors who process it on our behalf to run the Service, under confidentiality and data-protection obligations. These fall into categories such as hosting and infrastructure, database and storage, email and communications, payment processing, analytics, customer support, and artificial-intelligence providers. We disclose vendor categories rather than implementation details, except where the law requires more.

5.2 Legal and safety. We may disclose information if required by law or legal process, or where we believe in good faith that disclosure is necessary to protect the rights, safety, or property of Gesso, our users, or the public, or to detect and prevent fraud or abuse.

5.3 Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

5.4 With your direction. We share information with others when you ask us to or otherwise direct us to. If you make a project public or create a share link for it, the content of that project becomes visible to the people described in the Terms of Use, including people who are not registered users, and others may copy it into their own account. Making the project private again does not recall copies already made.

5.5 No sale of personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We and our service providers use the following technologies for automatic data collection.

Cookies. Cookies are pieces of information stored directly on the device you are using. They let us collect information such as browser type, time spent on the Service, pages visited, language preferences, and other traffic data. We and our service providers use that information to keep you signed in, to secure the Service, to make navigation work, to display information more effectively, to conduct analytics, and to improve your experience.

Local storage technologies. These provide cookie-equivalent functionality but can store larger amounts of data, including on your device outside of your browser. We use them to hold your work in progress and your interface preferences.

Pixel tags. Also known as web beacons and clear GIFs, pixel tags may be used to track the actions of users of the Service, including email recipients, to measure the success of our campaigns, and to compile statistics about usage and response rates.

You can control cookies through your browser settings; disabling some will affect how the Service functions, and disabling them all will prevent you from staying signed in. We do not use third-party advertising or cross-site tracking cookies, and we do not currently respond to browser do-not-track signals.

We keep personal information for as long as needed to provide the Service and for the purposes described in this Policy, and afterward only as long as necessary to meet legal, accounting, or reporting requirements, resolve disputes, and enforce our agreements. Your projects and the content in them are retained while your account is open. If you delete your account, it enters a 30-day recovery window during which signing back in restores it; after that window we permanently delete your account and its content, including any projects you had made public. When information is no longer needed, we delete it or de-identify it.

We use reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, or misuse. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

9.1 Your choices. You can opt out of marketing emails at any time using the unsubscribe link or by contacting us. You can also control cookies through your browser.

9.2 Your rights. Depending on where you live, you may have the right to access, correct, update, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of certain regions (including the EEA, the UK, and California) may have additional rights, such as the right to know what information we process, the right to deletion, the right to non-discrimination for exercising your rights, and the right to opt out of any sale or sharing (which we do not do).

9.3 How to exercise them. To exercise any of these rights, contact us at [email protected]. We will respond within the time required by applicable law and may need to verify your identity first. You may also have the right to lodge a complaint with your local data-protection authority.

We are based in the United States, and your information may be processed and stored in the United States or other countries where we or our providers operate, which may have different data-protection rules than your own. Where required, we use appropriate safeguards for such transfers.

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn that an account belongs to someone under 13, we terminate it and delete their information. If you believe a child under 13 has given us information, contact us at [email protected] and we will delete it.

Users who are under the age of majority where they live may use the Service only with the consent of a parent or legal guardian, as described in the Terms of Use. A parent or legal guardian who has given that consent can contact us at the same address to review, correct, or delete the information we hold about their child.

The Service may link to or integrate with third-party sites and services that we do not control. This Policy does not apply to them, and we encourage you to review their privacy policies.

We may update this Policy as the Service evolves or as required by law. When we make material changes, we will revise the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

Questions about this Policy or your information? Contact us at [email protected].