Privacy Policy

1. Introduction

This Privacy Policy explains how Estaray ("we", "us") collects, uses, and protects information when you visit our website, create an account, make payments, use credits, and generate AI images. By using Estaray, you agree to the practices described in this Policy.

This Policy is designed to comply with applicable data protection laws, including the EU General Data Protection Regulation (GDPR), the UK Data Protection Act, and the California Consumer Privacy Act (CCPA / CPRA). Where local laws provide stronger protections, those laws prevail.

2. Eligibility

Estaray is intended for users aged 18 and over. We do not knowingly collect personal information from individuals under 18. If you believe a minor has provided us with personal information, please contact support@estaray.com and we will take steps to delete it.

3. Data We Collect

We collect the following categories of information:

• Account data — name, email address, OAuth identifiers when you sign in with Google, authentication tokens, and password hash if you use email and password sign-in.
• Payment data — Stripe customer ID, subscription status, payment history, and billing-related metadata. We do not store full credit card numbers; payment cards are processed by Stripe.
• Generation data — prompts, reference images and other materials you upload, generation parameters, watermark settings or status, and AI-generated images.
• Credit and transaction data — credit balances, credit transaction history (purchases, usage, refunds, monthly distributions).
• Server logs — IP address, user agent, request timestamps, and operational metadata used for security, abuse detection, and troubleshooting.
• Support communications — emails and messages you send to support@estaray.com, and our responses.
• Attribution and referral data — when you arrive via a marketing link, partner referral, or UTM-tagged URL, we record the landing path, referrer, campaign parameters, and timestamp. After you create an account, this information is bound to your user record to attribute conversions to the originating channel.
• Cookie data — see the Cookies section below.
• Unauthenticated visitor data — When you use the trial without an account, we set a first-party visitor identifier in your browser to enforce the daily trial quota and prevent abuse. We may also process your IP address in hashed form for the same purpose. We do not use third-party fingerprinting services.

We do not intentionally collect sensitive categories of personal data (such as health information, racial or ethnic origin, or biometric data). If you provide such information through prompts or reference materials, we process it only as part of providing the AI image generation service.

4. How We Use Your Data

We use the information we collect to:

• create and manage your account;
• provide AI image generation services;
• provide the anonymous trial generation experience and enforce daily quota;
• link generations created during your unauthenticated trial to your account when you register from the same browser session (the claim flow);
• track affiliate referrals and other marketing channel attribution when you arrive via a partner link or marketing URL;
• process payments, refunds, and credit transactions;
• maintain your generation history and account workspace;
• prevent abuse, fraud, and violations of our Terms;
• respond to your support requests;
• send service-related notifications (such as account verification, password reset, billing, and policy updates);
• comply with legal and regulatory obligations;
• improve the reliability and performance of the service.

We do not use your prompts, reference materials, or generated outputs to train our own AI models. See the Service Providers section below for how third-party AI providers may handle your data.

5. Legal Basis for Processing

Where the GDPR or similar laws apply, we rely on the following legal bases:

• Performance of a contract — for processing necessary to provide the service you have requested (such as account creation, generation requests, and payment processing).
• Legal obligation — for processing required by law (such as retaining payment records for tax purposes).
• Legitimate interests — for processing necessary for our legitimate operations, such as security monitoring, operating the unauthenticated trial, enforcing daily quota, preventing abuse, and improving the service, where these do not override your rights and freedoms.
• Consent — where we ask for your specific consent (such as opt-in to optional model improvement programs or analytics cookies).

You may withdraw consent at any time, where consent is the legal basis for processing. Withdrawing consent does not affect processing already performed based on previous consent. For cookie-based consent, you may withdraw at any time by clearing the estaray_consent cookie in your browser settings.

6. Service Providers and Third Parties

We use the following categories of service providers and third parties:

• Payment processing — Stripe. You are redirected to stripe.com during checkout.
• Authentication — Google only when you choose Sign in with Google. Email/password authentication is handled in-house.
• Email delivery — a third-party email delivery service for transactional email, such as account verification, password reset, billing, and service notices.
• Hosting and object storage — third-party hosting and S3-compatible object storage providers for running the service and storing generated assets.
• AI image generation — third-party AI image generation services. We send prompts, reference materials, and generation parameters as needed to process your requests.
• Operational alerting — a third-party messaging service for internal operational alerts. User content is not routed through this service.
• Affiliate tracking — a third-party affiliate tracking service attributes signups and purchases when you arrive via a partner link. It sets the affonso_referral first-party cookie. See our Cookie Policy.
• Bot protection — a third-party bot protection service may verify that anonymous trial requests are not automated.

These providers process your data only as needed to deliver their services and under their own respective terms or data processing commitments. We share with them only what is necessary for the agreed purpose. We do not sell personal information to third parties.

7. International Data Transfers

Estaray operates globally. Your data may be transferred to and processed in countries other than your country of residence, including the United States. Where data is transferred to countries that do not provide an adequate level of protection under your local law, we rely on appropriate safeguards such as EU Standard Contractual Clauses, equivalent contractual frameworks, adequacy decisions where available, or other lawful transfer mechanisms made available by our service providers.

Business customers who need a Data Processing Agreement may contact support@estaray.com.

8. Data Retention

We retain your information for the following periods:

• Account data — for as long as your account is active. After you close your account, we delete personal account data within 30 days.
• Generation data (prompts, reference materials, generated images, and related parameters) — retained while your account is active. After account closure, we delete this data within 90 days.
• Trial generation data — retained for a limited period to support the claim flow and abuse prevention. If you claim trial generations by registering from the same browser session, those generations follow the account-data retention periods above.
• Payment and credit transaction records — retained for 7 years to comply with tax and accounting obligations.
• Abuse and violation records — retained for up to 2 years to prevent repeat violations.
• Server logs — retained for 30 days.
• Backups — retained for 30 days, after which they are overwritten or deleted.
• Support communications — retained for 2 years.

We may retain information for longer where required by law or where reasonably necessary for ongoing investigations, dispute resolution, or compliance.

9. Your Rights

Subject to applicable law, you have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your data, subject to legal retention obligations (such as the 7-year payment record retention).
• Data portability — request your data in a machine-readable format.
• Restriction of processing — request that we restrict processing in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Opt-out of sale or sharing — we do not sell your data; California residents may confirm this and exercise opt-out rights under the CCPA / CPRA.
• Non-discrimination — exercising your privacy rights will not result in adverse treatment of your account or service.
• Lodge a complaint — if you are not satisfied with our response, you may lodge a complaint with your local data protection authority.

To exercise any of these rights, please contact support@estaray.com. We will respond within 30 days; in complex cases, we may extend the response period by up to an additional 60 days and will inform you of the reason. We may ask you to verify your identity before responding to certain requests to protect your data from unauthorized access.

We may decline or limit a request if it is manifestly unfounded, excessive, or where we are required to retain the data by law.

10. Cookies

We use cookies and similar technologies for the following purposes:

• Strictly necessary cookies — session cookies, authentication cookies, and CSRF protection. These are required for the service to function and cannot be disabled.
• Trial and quota cookies — visitorId helps provide the anonymous trial experience, enforce daily quota, and prevent abuse.
• Preference cookies — NEXT_LOCALE remembers your language preference and estaray_consent stores cookie consent choices where available.
• Affiliate cookies — affonso_referral attributes visits, signups, or purchases that arrive through partner links.
• Analytics cookies (where enabled) — privacy-friendly analytics tools to understand site usage. Where these set cookies, they are configured to minimize personal data collection.

You can manage cookies through your browser settings. Estaray currently operates a single consent banner without category granularity; to re-prompt the banner or change your choice, clear the estaray_consent cookie in your browser. See our Cookie Policy for details. Note that disabling strictly necessary cookies may prevent the service from functioning properly.

11. Security and Data Breaches

We use technical and organizational measures designed to protect your information, including encryption in transit, access controls, and operational logging. No system is perfectly secure, and we cannot guarantee the absolute security of your data.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required by law, and we will inform affected users without undue delay.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' advance notice through email or in-product notification before the changes take effect. Non-material changes (such as typo corrections, formatting, or clarifications that do not affect your rights) may take effect immediately upon posting. Your continued use of Estaray after the effective date constitutes acceptance of the updated Policy.

Where applicable law requires separate consent for a particular change (such as expanded uses of your data), we will seek that consent separately.

13. Data Controller and Contact

Estaray is operated by Estaray Inc., incorporated in Delaware, USA.

For privacy-related questions, requests, or complaints, please contact:

support@estaray.com

Effective date: 2026-05-28