Privacy Policy

We collect only the data required to operate KDP AI Studio, bill your subscription and keep the platform secure. This falls into three groups: information you provide, information generated when you use the service, and technical information collected automatically.

• Account data: email address, display name, password hash and authentication identifiers (including Google OAuth identifiers when you use social sign-in).
• Project data: the books, niches, prompts and AI outputs you create and store in your workspace.
• Security data: sign-in events, session device and approximate location, and two-factor authentication settings.
• Support data: any information you include when contacting us.

We never sell personal data, and we do not use your private project content for advertising.

When you generate content we record the request type, model used, credit cost, timestamp and success or failure state. This usage data powers your credit balance, usage history, rate limits and abuse prevention. Aggregate usage metrics also help us prioritise product improvements.

Technical logs may include IP address, browser and device type, and error diagnostics. Logs are retained for a limited period and used only for reliability, fraud prevention and security.

We use cookies and similar browser storage for authentication, session persistence, preferences and analytics. A full description of each category, and instructions for controlling them, is available in our Cookie Policy.

Payments for subscriptions and AI Credits are processed by our payment providers, including PayPal, Stripe and NOWPayments for cryptocurrency. Card numbers and wallet credentials are entered directly with those providers.

We never see or store full card numbers. We retain only the provider customer or order ID, subscription plan, status, renewal date and invoice history, which we need to grant the correct AI Credits and to comply with tax and accounting obligations.

Refund handling is described in our Refund Policy.

We use privacy-conscious product analytics, including Google Analytics and TikTok measurement, to understand how features are discovered and used in aggregate. Where these tools receive identifiers, they are pseudonymised or hashed before transmission. Analytics is treated as non-essential and is subject to your cookie choices where consent is required.

We rely on a small set of processors, each bound by contractual data-protection obligations:

• Cloud database, authentication and storage infrastructure for your account and projects.
• AI model providers that process the prompts you submit in order to return generated content.
• Payment providers for checkout, subscriptions and invoicing.
• Email delivery providers for transactional messages such as verification and receipts.
• Analytics and error-monitoring providers.

Prompts sent to AI providers are transmitted for the sole purpose of generating your output and are not used by us to train public models. See our AI Transparency Policy.

Data is stored in encrypted databases with row-level access controls that restrict every record to its owning account. Traffic is encrypted in transit with TLS. Sensitive secrets such as two-factor seeds are encrypted at rest. Administrative access to production systems is limited, logged and protected by multi-factor authentication. No system is perfectly secure, so we also maintain incident response and notification procedures.

You can exercise the following rights at any time, most of them directly in Settings:

• Access and export the personal data and project content associated with your account.
• Correct inaccurate account information.
• Delete your account and associated data.
• Object to or restrict specific processing, and withdraw consent for non-essential cookies.
• Request a human review of any automated decision that materially affects you.

If you cannot complete a request in the product, email support@kdpaistudio.app and we will respond within 30 days.

Account and project data is retained while your account is active. When you delete your account, your projects, generations and profile are deleted or irreversibly anonymised within 30 days, except where longer retention is legally required.

• Security and audit logs: up to 12 months.
• Billing and invoice records: as required by tax law, typically 7 years.
• Support correspondence: up to 24 months.

If you are in the EU, EEA or UK, we process personal data under the following legal bases: performance of a contract (providing the service and your subscription), consent (marketing and non-essential cookies), legitimate interests (security, fraud prevention and product improvement) and legal obligation (tax and accounting records).

You have the right to access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with your local supervisory authority. Where data is transferred outside the EEA, transfers are covered by Standard Contractual Clauses or an adequacy decision.

For any privacy question, data request or complaint, contact support@kdpaistudio.app or use our contact page. We aim to reply within two business days.