Privacy Policy

1. Scope of This Policy

This Policy applies to personal data we collect through the Service, including our website, generation tools, account and billing systems, and communications with you. It does not apply to third-party websites, applications, or services that we do not control, even if you access them through a link on the Service.

2. Information We Collect

Information you provide to us:

• Account information: When you sign up, we (through our authentication provider, Clerk) collect your email address, authentication identifiers, and, if you use a social login, basic profile information from that provider.
• Payment information: When you buy credits or subscribe to a plan, our payment processors collect your billing details. Card payments are processed by Stripe; cryptocurrency payments are processed by a third-party crypto payment processor. We do not store your full card number or private wallet keys on our own servers.
• User Content: The text prompts, images, videos, audio, and other material you upload, and the images, videos, and audio our tools generate for you ("User Content").
• Communications: Information you provide when you contact support, respond to a survey, submit a Promotion, or otherwise correspond with us, including your email address and the content of your message.
• Referral information: If you participate in our referral program, we collect the referral code used and information about the accounts referred through it.

Information we collect automatically:

• Usage data: The tools and features you use, the number and type of generations you request, pages visited, referring pages, and timestamps of activity.
• Device and log data: IP address, browser type and version, operating system, device identifiers, and standard server log data.
• Cookies and similar technologies: As described in Section 8 below.

Information from third parties: We may receive limited information from our service providers (for example, subscription status and payment confirmations from Stripe or Clerk, or delivery/fraud signals from our crypto payment processor) that we use to operate billing, prevent fraud, and provide support.

3. How We Use Your Information

We use the information described above to:

• Provide, operate, and maintain the Service, including generating output from your Input and delivering it back to you.
• Create and manage your account, and authenticate you when you sign in.
• Process payments, manage your credit balance and subscription, and prevent fraudulent or unauthorized transactions.
• Operate the referral program and Promotions marketplace, including verifying eligibility and reviewing submissions.
• Communicate with you about your account, transactions, security alerts, and support requests, and, where you have not opted out, about product updates and offers.
• Monitor, investigate, and enforce our Terms of Service and Acceptable Use Policy, including detecting abuse, fraud, and prohibited content.
• Analyze aggregated or de-identified usage trends to improve the reliability, performance, and design of the Service.
• Comply with our legal obligations, respond to lawful requests from public authorities, and establish, exercise, or defend legal claims.

We do not use your private prompts or generated Content to train our own foundation models. Where a third-party AI model provider we integrate with may use API inputs to improve its own models, we select providers and, where available, configuration options intended to keep such data out of model training; see Section 5.

4. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases to process your personal data:

• Performance of a contract: to create your account, provide the Service, and process payments.
• Legitimate interests: to secure the Service, prevent fraud and abuse, and improve our products, balanced against your rights and interests.
• Consent: for optional cookies, marketing communications, and any other processing where we ask for your consent, which you may withdraw at any time.
• Legal obligation: to comply with applicable tax, accounting, and other legal requirements.

5. How We Share Your Information

We do not sell your personal data, and we do not share your User Content with other users without your action (for example, choosing to submit a public Promotion or gallery entry). We share information with the following categories of service providers, each of which is only permitted to use your data to provide services to us:

• Clerk: user authentication, session management, and account security.
• Stripe: processing of card payments and management of subscriptions.
• Crypto payment processor (NOWPayments): processing of cryptocurrency payments.
• Supabase: database hosting and storage of account records, credit balances, and generated Content.
• WaveSpeed AI and other AI model providers: your Input (prompts, images, audio) is transmitted to these providers solely to generate the output you request; it is processed as necessary to fulfill your request and is subject to that provider's own data handling terms.
• Creem (content moderation): the text of your prompts, together with an internal account identifier, is screened by Creem's moderation service before generation so that we can block content prohibited by our Acceptable Use Policy.
• Hosting and infrastructure providers: to host, serve, and secure the website and its underlying data.
• Email and communications providers: to send transactional messages and, where you have opted in, product updates.

We may also disclose information: (a) to comply with a subpoena, court order, or other legal process, or a lawful request from a public authority; (b) to investigate or respond to violations of our Terms, fraud, security incidents, or claims of illegal content, including reporting suspected child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) or other relevant authorities where required by law; (c) to protect the rights, property, or safety of NightWaveAi, our users, or the public; and (d) in connection with a merger, acquisition, financing, or sale of all or part of our business, in which case personal data would remain subject to the protections described in this Policy or a policy at least as protective.

6. AI Processing of Your Content

When you submit a prompt, image, or other Input for generation, that Input (and the resulting output) is transmitted to the third-party AI model provider we use to run that particular tool in order to produce your result. We select providers that offer API-level processing rather than consumer-facing products, and we do not knowingly permit those providers to use your Input to train models available to other customers; however, each provider's own retention and processing practices govern how long they hold data needed to service the request (for example, brief retention for abuse monitoring). Please avoid uploading sensitive personal data belonging to other people (such as another person's photo used without their consent) that you are not authorized to share.

7. Data Retention

We retain account information for as long as your account is active and for a reasonable period afterward to comply with legal, accounting, and fraud-prevention obligations. We retain generated Content and transaction records for as long as reasonably necessary to provide the Service (for example, so you can access your generation history), to resolve disputes, and to enforce our agreements. You may request deletion of your account and associated Content at any time as described in Section 9; some information may be retained in backups or anonymized form for a limited period after deletion.

8. Cookies and Similar Technologies

We and our service providers use cookies, local storage, and similar technologies to:

• Keep you signed in and remember your session and preferences (strictly necessary).
• Measure and analyze how the Service is used so we can fix bugs and improve performance.

You can control or delete cookies through your browser settings; most browsers let you refuse cookies or alert you when a cookie is being set. Blocking strictly necessary cookies may prevent parts of the Service, such as signing in, from working correctly.

9. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding your personal data: access to the data we hold about you; correction of inaccurate data; deletion of your data; restriction of, or objection to, certain processing; portability of data you provided to us; and the right to withdraw consent where we rely on it. California residents have similar rights under the California Consumer Privacy Act, including the right to know, delete, and correct personal information, and the right to non-discrimination for exercising these rights; we do not sell or share personal information for cross-context behavioral advertising as those terms are defined under the CCPA.

To exercise any of these rights, email us at nightwaveai@gmail.com from the address associated with your account. We will verify your request and respond within the time required by applicable law. You may also have the right to lodge a complaint with your local data protection authority.

10. Data Security

We use technical and organizational measures designed to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including encryption of data in transit, access controls, and reliance on reputable infrastructure providers for authentication, payments, and storage. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

11. International Data Transfers

We and our service providers may process and store your information in countries other than the one in which you reside, including the United States, which may have data protection laws that differ from those in your jurisdiction. Where required, we rely on appropriate safeguards, such as standard contractual clauses or equivalent mechanisms, to protect personal data transferred internationally.

12. Children's Privacy and Child Safety

The Service is not directed to children, and we do not knowingly collect personal data from anyone under the age of 13 (or the equivalent minimum age in your jurisdiction). If we learn that we have collected personal data from a child under that age, we will take steps to delete it promptly. If you believe a child has provided us with personal data, please contact us at nightwaveai@gmail.com.

We have zero tolerance for child sexual abuse material ("CSAM") and any content that sexualizes or exploits minors, whether real or AI-generated, as described in our Terms of Service. Privacy rights described in this Policy do not protect such activity. If we detect or are made aware of it, we will preserve the related account information, IP addresses, device and log data, prompts, uploads, generated Content, and payment records; report it to the National Center for Missing & Exploited Children (NCMEC) and/or other competent authorities; and disclose that information to law enforcement in response to valid legal process. Deletion requests do not apply to data we are required to preserve for this purpose. To report suspected child exploitation on the Service, contact us at nightwaveai@gmail.com.

13. Marketing Communications

We may send you transactional and account-related emails (such as receipts, security alerts, and service notices) regardless of your marketing preferences, as these are necessary to operate the Service. Where we send optional marketing or product-update emails, every such message includes an unsubscribe link, and you may opt out at any time without affecting your ability to use the Service.

14. Third-Party Links

The Service may contain links to third-party websites, including Promotion destinations submitted by other users. We are not responsible for the privacy practices or content of any third-party site, and we encourage you to review the privacy policy of any site you visit.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will post the updated Policy on this page and revise the "Last Updated" date above. If we make material changes, we will provide additional notice where required by law. Your continued use of the Service after an update takes effect constitutes your acceptance of the revised Policy.