Privacy Policy

Your account: email address, a hashed password, and whether the email is verified. Sign in with Google and we store the Google account id instead of a password. Your profile (display name, Slug, avatar) lives on your personal studio, not on the account record.

What you make: projects, canvases, documents, timelines, uploaded assets, and generated output. Your prompts, and the model each request went to.

Assistant conversations: what you say to the assistant and what it replies, plus the memory the system derives from them: a running summary of older turns, kept per project and per conversation so later ones start with context.

How you use it: generation records with the model, provider, tokens and credits each one cost, kept so your credit balance can be audited against what you were charged. Standard server logs with IP address and browser user-agent, for security and debugging.

Product analytics, when it is on (see section 3): events that mark steps in the product: viewing this website or its pricing, signing up, signing in, creating a project or a Space, a first generation or a first assistant reply, inviting someone or accepting an invitation, a collaborator's first action in a project, opening a project, buying credits, subscribing, renewing or cancelling, and a completed refund. Each event carries the details that tell it apart: the studio and project involved, a member's role, a sign-up method, an error code, the kind of generation, credits, a plan and billing period, an amount and currency. Events about your account carry your account id. This website and the product share the analytics cookies, so once you have signed in to the product in this browser, events from this website carry your account id too. Events sent from a browser also carry the interface language, your country, and your device type and browser; those sent from the product also carry the app version. The analytics service marks when each visit starts and ends. Events never carry your prompts, your content, file names or your email address, and we tell the analytics service not to record your IP address.

Where you came from: the campaign parameters in the link you arrived by (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the ad-click identifier our advertising platform adds to links from our ads, the address of the page that sent you without its query string, and the page you landed on. When you sign up we keep the first and the latest of these with your account. With analytics on, the first and latest source, medium, campaign and landing page are also recorded on your account in the analytics service.

Billing: handled by a payment processor. It holds your card details; we never see or store a card number. We keep the record of which pack or plan you bought and when.

To run the service: store your work, sync collaboration, route a generation to the provider behind the model you picked, and bill you correctly. To keep accounts secure and to investigate abuse. To email you about your account: the outcome of a refund you asked for, and material changes to these documents.

The assistant writes memory on its own. Once a conversation grows too long to send in full, a language model summarises the older turns so the conversation carries its context forward. This runs before the reply, on the turn that grew too long. Ask us and we delete it.

Product analytics shows us which steps people complete and where they stop, so we know what to fix. Ad measurement tells our advertising platform which of our ads led to a sign-up, a purchase or another step listed in section 4, so we spend on the ads that work. In the EEA, the UK, Switzerland and mainland China, and wherever we cannot tell where you are, we run them only after you agree. Elsewhere they run on our legitimate interest in measuring our own product and ads, and you can turn either off at any time.

We do not sell your personal information. To measure our ads we share some of it with the advertising platform described in section 4; section 3 explains how to opt out. We do not use your content to train our models, and we do not grant providers the right to train on it. If we ever want to use your content for anything beyond running the service, we will ask you first and it will be off by default.

Necessary cookies keep the product working and are always on: a session cookie that keeps you signed in for up to 30 days, a short-lived cookie that holds a sign-up in progress until you confirm your email, and a cookie named breatic_consent that remembers your choice below. Your browser's local storage holds interface preferences: which theme you chose, which panels you left open. Those stay on your device.

Product analytics and advertising each have their own switch. With product analytics on, our analytics service sets cookies whose names start with AMP_. They hold a random device identifier, the current visit and, once you sign in, your account id, and last up to a year; events not yet sent wait in local storage under names starting with AMP_. The analytics service also keeps a small database for its own diagnostics in your browser's IndexedDB, under a name starting with AMP_. With advertising on, our advertising platform's tag sets cookies whose names start with _gcl_. They hold the identifier of the ad you clicked, or a random identifier used to measure conversions, and last 90 days. While either is on, local storage also keeps where you came from (section 1), so a sign-up can be credited to the campaign that brought it. Turn one off and the cookies and stored data it left on our site are deleted, and nothing more is sent for it.

In the EEA, the UK, Switzerland and mainland China, and wherever we cannot tell where you are, a banner asks before either one loads. Elsewhere both start on, and you can turn either off at any time under Cookie settings, in the footer of this site and in the account menu of the product. Your choices are kept in a cookie in this browser for up to 13 months. If you clear your cookies, or your browser deletes them sooner, you are asked again or the rule for your region applies.

If your browser sends Global Privacy Control, advertising starts off in that browser. If you turn advertising on yourself, in the banner or under Cookie settings, your choice applies. When you are signed in, we record the choices of the browser you are using with your account; the most recent one counts, and we use it only for the events described next.

Events our servers send follow the choice of the browser that caused them. A few events about your account are caused by no browser of yours: a subscription renewal, an approved refund, and a collaborator's first action in your project. Those follow the choice most recently recorded with your account, and nothing is sent for them if there is none.

You have the right to opt out of the sale or sharing of your personal information. We do not sell it, and we share it only to measure our ads. We process opt-out preference signals such as Global Privacy Control without asking anything more of you. Many browsers can send it, either built in or through an extension, usually from their privacy settings. You can also turn advertising off under Cookie settings.

Text you type into a canvas is part of the collaborative document and syncs to our servers as you type, including a prompt you have written but not run yet. That is what lets collaborators see it and what keeps it from being lost.

Model providers: when you request a generation, the prompt and any input asset go to the company that runs the model you chose. Some models are reached through an aggregator that forwards the request for us, so that company receives it as well. These are AI model and cloud-inference companies operating in the United States, Europe and Asia; which ones are involved depends on the model you pick, and the set changes as models are added and retired. Write to contact@breatic.ai for the current list.

Some model calls are not ones you asked for by name. A few image models rewrite your prompt through a language model first, so that language model sees the prompt before the image model does. The text tools in the editor run on a language model we choose. The assistant's replies, and the summaries it writes into its memory, run on a language model we choose. These calls carry your text to providers from the same set above.

Infrastructure: a cloud object-storage provider holds your assets, and a payment processor handles payments. Both act on our instructions and may not use your content for their own purposes.

With a subscription order the payment processor also stores the ad-click identifier, if there is one, so the subscription can be credited to that ad when it starts.

Product analytics: a product analytics company in the United States receives the events in section 1. It works on our instructions as our processor and may not use them for its own purposes.

Advertising: when advertising is on, our pages load our advertising platform's tag, which receives your IP address, your browser's details and the address of the page without its query string. If you arrived from one of our ads in the last 90 days, the platform also receives the ad-click identifier, which step you completed (sign-up, first project, a collaborator's first action in your project, purchase or subscription), when, a reference from our records (an order number, or our internal account number), and the amount of a purchase or subscription. It receives no email address and none of your content, and we tell it not to use any of this to personalise ads. It handles this as an independent controller under its own privacy policy.

Our list of service providers names both companies.

People you invite: collaborators you add to a studio or project see what that studio or project contains. That is the point of inviting them; remove them and the access ends.

We disclose data to authorities only against valid legal process, and we tell you unless we are legally barred from doing so.

Assets live with a cloud object-storage provider. Passwords are stored hashed, never in plain text. Traffic runs over TLS. Each upload carries a content hash computed in your browser; we store it with the asset and use it to recognise a file your studio already holds.

No system is perfectly secure. If a breach affects your data we will tell you and the relevant regulator within the time the law requires. Report a vulnerability to security@breatic.ai.

You can see and edit your account data in the product, and export your work at any time. Export is free on every tier, including the free one, and stays free if you stop paying. Ask us to correct anything wrong. Ask us to delete your account and its content. Ask for a copy of your data in a portable form. Object to a particular use, or withdraw a consent you gave.

Write to contact@breatic.ai and we answer within 30 days. These are the rights the GDPR and comparable laws give people; we extend the same handling to everyone regardless of where they live, because running two standards is how one of them rots.

Your work is kept, not aged out. Downgrading lowers your storage limit. While you are over the limit you cannot upload anything new and you cannot generate anything new, because a generation writes bytes too; nothing already stored is deleted or locked, and credits you have already bought stay in your balance. An account with no login for 24 consecutive months is frozen rather than erased. Freezing suspends the product's features and never touches your data; export stays free throughout. Reactivating a frozen account carries a charge, and we will tell you what it is before you commit to it.

Delete your account and we remove your content within 30 days, except what we must keep longer: billing records for the period tax law requires, and security logs for their retention window.

Product analytics events are kept for up to 2 years. Delete your account and we also ask our product analytics company to delete your events, which it does within 30 days. The cookie choice most recently recorded with your account is kept with your account, and deleted with it.

We are a US company and your data is processed in the United States and wherever our providers operate. Our product analytics company is certified under the EU-U.S. Data Privacy Framework; transfers to it rely on that certification, and on standard contractual clauses where it does not apply. Other transfers out of the EEA, the UK and Switzerland rely on the European Commission's standard contractual clauses.

We announce material changes in the product and by email before they take effect. The date at the top of this page is when it last changed. Privacy questions: contact@breatic.ai. Security reports: security@breatic.ai.