Privacy Policy

Imagine WOW (operated by DesignArtWow) is the Data Controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (where EU law applies), and the Data Protection Act 2018.

Contact: For any privacy request, question, or complaint, open a ticket from the in-app Support page and select the “billing / privacy” category. We treat these as Data Subject Access Requests and respond within one month.

We do not currently appoint a separate Data Protection Officer; the Support team acts as your privacy contact point.

Account data: name, email address, and authentication details when you register. Passwords are never stored in plain text.

Content you create: images, prompts, projects, characters, brand kits, collections, and reflections you save. Content you mark as public (community gallery / exhibition) is visible to other users.

Payment & billing data: processed by Stripe. We never receive or store your full card number. We retain billing records (amount, date, plan, invoice reference) for legal/accounting purposes.

Usage & technical data: feature usage, device/browser type, and IP address for security, abuse prevention, and service improvement, processed only with your consent where required.

Support data: the subject, message, and any attachments you submit in support tickets.

Event & booking data (where used): name, email, phone, and booking details for physical events and iris-photography sessions.

We process your data under the following UK/EU GDPR lawful bases:

• Performance of a contract (Art. 6(1)(b)) — providing your account, generation tools, and paid subscription.
• Legal obligation (Art. 6(1)(c)) — retaining billing/tax records and responding to lawful requests.
• Legitimate interests (Art. 6(1)(f)) — platform security, fraud and abuse prevention, and product improvement (balanced against your rights).
• Consent (Art. 6(1)(a)) — any non-essential analytics, and any optional marketing — you may withdraw consent at any time.

• Provide, operate, and improve the Platform and your creative tools
• Process payments and manage your subscription and credit balance
• Generate AI images and assist with prompts via our AI subprocessors
• Send service notifications (billing receipts, account alerts)
• Respond to support and privacy requests
• Monitor for abuse, fraud, and violations of our Terms
• Comply with legal obligations

We do not sell your personal data. Marketing communications, if any, require your explicit consent and can be opted out of at any time.

We share data only with the following subprocessors, under written agreements that require them to protect it to GDPR standards:

• Stripe — payment processing, subscriptions, invoices, and the billing portal. Card data never touches our servers.
• OpenAI, Anthropic & Google — AI image/text generation, prompt assistance, audio transcription, and document/PDF parsing.
• Base44 — our application platform: hosting, managed database, authentication, file storage, and analytics infrastructure.

We will update this list before adding any new subprocessor and, where relevant, notify you in advance. You may request a copy of this list at any time.

Some subprocessors process data outside the UK/EU (for example, OpenAI, Anthropic, and Google in the United States). We rely on the UK/EU–US Data Privacy Framework and Standard Contractual Clauses (SCCs) to ensure your data receives a comparable level of protection, and we keep these safeguards under review.

Your data is kept only as long as needed for the purposes above:

• Active account data: retained while your account is active; deleted when you delete your account (see §10).
• Generation jobs: completed or failed jobs are automatically deleted after 90 days.
• Support tickets: resolved or closed tickets are automatically deleted after 1 year.
• Billing records: retained for up to 7 years as required for tax/accounting law.

You have the following rights. To exercise any of them, open a ticket from the Support page and we will respond within one month (free of charge unless clearly unfounded or excessive).

• Access — a copy of the data we hold about you (also available via “Export My Data” in My Account)
• Rectification — correction of inaccurate data
• Erasure — deletion of your data (“right to be forgotten”)
• Restriction — limiting processing in certain circumstances
• Portability — receiving your data in a portable format
• Objection — objecting to processing based on legitimate interests or for direct marketing
• Withdraw consent — at any time, for processing based on consent
• Automated decisions — rights relating to solely automated decision-making (we do not make solely automated legal/significant decisions about you)

You can permanently delete your account and personal data at any time from My Account → Delete Account & Data. Deletion is irreversible and removes your artworks, projects, characters, credits, brand kits, collections, prompts, and support tickets. Subscription billing is separate — cancel via the Stripe Billing Portal first if you do not want to be charged for the next period.

You can also download a portable copy of your data using the Export & Migrate tool on the My Account page.

We use essential cookies for your login session and core preferences — these are always on and cannot be disabled.

We may use non-essential analytics to understand platform usage. These only run after you accept the consent banner shown on first visit. You can withdraw consent at any time by clearing the wow_cookie_consent entry in your browser storage.

We do not use advertising or cross-site tracking cookies.

We apply appropriate technical and organisational measures: encryption in transit (HTTPS) and at rest, strict per-user row-level access controls on the database, separation of admin privileges, and minimal data sharing with subprocessors. No system is 100% secure; if you believe your account is compromised, contact us immediately via Support.

The Platform is not intended for users under 16. We do not knowingly collect personal data from children. If we learn we hold data from a child under 16, we will delete it promptly.

We may update this policy from time to time; the “Last updated” date reflects the most recent revision. We will notify you of significant changes by email or in-app notification. Continued use after changes take effect constitutes acceptance.

If you are unhappy with how we handle your data, contact us first via Support. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk, or with your local EU data-protection authority.