Privacy Policy

Your privacy is important to us. This Privacy Policy explains what information Create Your Desire collects, how we use and share it, and your rights regarding your personal data. By using the Service, you consent to the data practices described in this Policy. If you do not agree, please do not use the Service.

1. Information We Collect

We collect various types of information in order to provide and improve our Service. This includes:

• Account Information: When you create an account, we collect your email address (required for login and communication). You may also choose to provide your first name, last name, or a display name, and an avatar image URL for your profile (these are optional). We store a hashed version of your password via our authentication provider (Supabase Auth) — we never store your raw password. We also assign you roles within the platform (such as platform_admin, operations_manager, ai_model_manager, or analyst) based on your account and organization. If you register on behalf of an organization (tenant), we link your account to an Organization ID and record your subscription tier (e.g. Starter, Pro, Enterprise).
• Self-Model Photos and Biometric Data: If you use our "Self Model" feature to create an AI persona of yourself, you will upload 3–5 photos of yourself. These photos may contain biometric identifiers (your facial image and characteristics). We temporarily process these photos to analyze features using computer vision (for example, via Google's Gemini Vision API) to create your AI model persona. Storage and Deletion: Source photos, selected reference images and derived appearance data need separate retention and removal decisions. Saving a persona or selecting a reference does not confirm that other uploaded copies have been removed. Automatic photo deletion and a complete retention schedule have not been verified. See Data Retention and Your Rights and Choices below for the current review process.
• AI-Generated Content: We generate text and images based on your inputs. The text prompts you provide to the AI (for generating captions, posts, DMs, story scripts, etc.) and any parameters or configurations for personas are collected. We also store the AI-generated outputs (text responses or images) that are created for you, so that you can view or reuse them. Access to content, reference retirement and removal of stored copies are separate actions. Export and deletion automation is currently paused, as described below. Note that AI-generated content itself may not always be considered personal data (it could be fictional), but if it is based on your personal information (like your persona), it could be related to you.
• Usage Data and Analytics: When you use the Service, we automatically collect certain information about your activity:
  • Session and Device Information: We assign a unique session ID for each user session (stored in your browser's local storage as analytics_session_id) to help us analyze usage patterns. We log information about your use of the Service, such as pages or screens viewed, features used, links clicked, and the time and duration of your activities. We also collect standard technical information sent by your browser or device: your IP address, browser type, operating system, device type, and referring URL (if you clicked a link to come to our site). We may also record your user agent string (which may include device and browser info).
  • Analytics Events: Our platform records custom analytics events (in an analytics_events database table) for actions taken in the app (for example, creating a model, generating content, etc.). These events may include a description of the action, timestamps, your user ID or organization ID, and context (e.g., which page in the app triggered the event). This is used to understand feature usage and improve the user experience. Most analytics are done in-house through our own systems.
  • Vercel Analytics & Speed Insights: We use Vercel Analytics and Speed Insights (provided by our hosting platform, Vercel) to understand site usage and monitor performance. These tools are privacy-focused: Vercel Analytics collects basic usage data (page views, referrers, device types) without cookies or personal identifiers, and Speed Insights measures page load performance (Core Web Vitals such as Largest Contentful Paint, First Input Delay, and Cumulative Layout Shift). This data is processed by Vercel solely for our site analytics and is not shared with third parties for advertising or tracking purposes. For more information, see Vercel's Privacy Policy.
• Cookies & Local Storage: We use cookies and local storage to keep you logged in and to track preferences (see our Cookie Policy for details). For instance, when you log in, our authentication system may set a secure session cookie or token. We also store a flag in local storage (cookie-consent-given) to remember if you've given consent for optional analytics tracking, and the analytics_session_id as mentioned above. These help run the site and gather usage data.
• Payment and Subscription Data: If you subscribe to a paid plan, we collect information related to your subscription and payments. We integrate with Stripe for payment processing. When you enter your credit/debit card information at checkout, that information is sent directly to Stripe; we do not see or store your full card details (though we may store a token or an identifier for your payment method provided by Stripe). Stripe shares with us limited information needed to manage your subscription, such as your Stripe customer ID, the last four digits of your card (for display/reference), card expiration date, and your subscription status (active, trial, canceled, etc.). We also receive payment transaction records (e.g., that a payment of $X on date Y succeeded or failed). Our database keeps track of your subscription tier, pricing, next billing date, and whether you are in a trial period. We may also retain records of your purchase history and any invoices or receipts issued. Note: All financial transactions are handled by Stripe on our behalf, and your use of payment info is also subject to Stripe's Privacy Policy.
• Support and Correspondence: If you contact us for support or communicate with us (via email or other channels), we will collect the information you provide in those interactions. This may include your contact information, the content of your messages, and any attachments or screenshots you send. We use this information to assist you and to improve the Service.
• Sensitive Personal Data: As noted, some data we handle could be considered sensitive (for example, biometric data from photos). We treat such data with extra care and only collect it when necessary (and with your consent, such as when you choose to use the Self Models feature). We do not collect any government-issued IDs, social security numbers, or financial account numbers. We also do not intentionally collect any information about your health, genetic or biometric identifiers for identification (our biometric use is only for creating your persona, not to identify/verify you), or precise geolocation. The Service is also not intended to collect any special categories of personal data under GDPR (like political opinions, religious beliefs, etc.) and you should refrain from providing those in the content you generate or upload.

2. How We Use Your Information

We use the collected information for the following purposes:

• To Provide and Operate the Service: We process your personal data to create your account, authenticate you at login (e.g., using your email and password), and enable core Service features. For example, we use your photos and prompts to generate AI content for you, use your account info to display your profile and manage your workspace, and use your payment info to manage subscriptions and access levels. Without this information, we cannot deliver the Service functionality you expect.
• Content Generation and Personalization: Your inputs (prompts, photos, persona settings) are used to generate the AI content you request. We may also use your past usage and content to personalize your experience – for instance, remembering your persona configurations or frequently used prompts.
• Content Moderation and Safety: We use automated tools and human review to monitor and moderate content as described in our Terms. This means we may process your prompts and AI outputs (which could contain personal data) through our moderation systems (like OpenAI's moderation API) to detect prohibited content. We also keep logs of moderation actions linked to user accounts to enforce our community standards and handle any appeals or reviews.
• Improvement and Analytics: Internal analytics data (usage logs, event data, session IDs) are used to understand how our users interact with the platform, which features are popular, and where issues may be occurring. This helps us improve the Service's functionality, UI/UX, and performance. For example, we might analyze that a certain feature is rarely used and decide to enhance or simplify it. We might also track error logs or crashes to debug and increase stability. Analytics are done in aggregate or pseudonymized form wherever possible. We do not use personal data for automated profiling or decision-making outside the scope of providing the Service (i.e., we're not evaluating you as a consumer, we're just analyzing how the product is used).
• Customer Support: Information you provide in support requests (like your email or problem description) is used to help solve your issue and communicate with you. We may also use support correspondence to improve our support processes or fix underlying problems.
• Communication: We may send you service and transactional emails. For example, email verification messages, password reset emails, billing receipts, subscription renewal notices, or important updates about your account or the Service (these are not promotional in nature, and you cannot opt out of such essential communications while you have an active account except by closing the account). We might also send you product updates, newsletters or promotional offers if you have opted in to such communications. You can unsubscribe from marketing emails at any time by following the link in those emails.
• Security and Fraud Prevention: We use data (like IP addresses, logs, and other usage info) to monitor for suspicious or fraudulent activity. This helps protect our platform and users from breaches, misuse, and other harmful activities. For instance, we may detect multiple failed login attempts or unusual generation activity and take steps to secure the account. We also verify Stripe webhooks (payment events) using signatures to ensure they are authentic, protecting against fraud in subscription handling.
• Legal Compliance: In certain cases, we may need to process personal data to comply with legal obligations. For example, retaining transaction records for financial regulations and audits, or responding to lawful requests by public authorities. We also process age confirmation records to demonstrate compliance with age restriction laws for adult content. If necessary, we may use or disclose information to enforce our Terms of Service, to meet our reporting obligations (e.g., in the event of certain security breaches, or content that requires reporting), or to protect our rights and the rights of others.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason and that reason is compatible with the original purpose. If we need to use your information for an unrelated purpose, we will notify you and seek any necessary consent or legal basis.

3. How We Share or Disclose Information

We value your privacy and do not sell your personal information to third parties. However, we do share information in the following circumstances to run our business:

• With Service Providers (Processors): We use trusted third-party companies to help us deliver the Service. These providers only receive the information necessary for them to perform their functions, and they are contractually obligated to protect it and use it only for our purposes, consistent with this Policy. Our key service providers include:
  • Supabase (Database, Authentication, Storage): Our platform is built on Supabase, which provides our PostgreSQL database, user authentication, and file storage. All of your account data, content, and images are stored in databases or storage buckets hosted by Supabase. Supabase acts as a data processor, storing and retrieving data as we instruct. They may have incidental access to data for maintenance or support, but they do not use your data for their own purposes. See Supabase's privacy policy for more on how they handle data.
  • Stripe (Payment Processing): When you enter payment details, that information goes directly to Stripe. Stripe processes your payments and stores your billing information (such as your card details, billing address, and payment history) on our behalf. We share with Stripe your email, and possibly name or organization name, to create a customer record, as well as information about your subscription plan and charges. Stripe is a PCI-DSS compliant payment processor. We do not have access to your full credit card number; Stripe provides us with a token or ID for the transaction and confirmation of payment. Stripe may also handle recurring billing and will notify us (via secure webhooks) of payment events. Please review Stripe's privacy policy for details on their practices.
  • OpenAI (AI Text Generation and Moderation): Portions of your data may be sent to OpenAI's API when you use text-generation features or when content moderation checks are performed on text. Specifically, your text prompts and any context necessary for the AI to generate a response are sent to OpenAI's GPT-based models to produce the output. Additionally, content (either your prompt or the AI's output) might be sent to OpenAI's Moderation API to check for disallowed content. OpenAI will process this data to return the AI results or moderation flags. According to OpenAI's policy, they may retain API data for a limited time (e.g., 30 days) for abuse monitoring, but they no longer use it to train their models by default. We do not allow OpenAI to use your data for model training. Nonetheless, any data sent to OpenAI is subject to OpenAI's terms and privacy commitments.
  • Replicate / Stability AI (AI Image Generation): When you request AI-generated images, we may use third-party AI model services such as Replicate (which hosts various AI models) or Stability AI's Stable Diffusion models. For example, if you create an AI persona image or other visual content, your text prompt (and possibly an embedding or representation of your self-model, if applicable) is sent to these image-generation services, and an image is returned. These providers process the data only to generate the image. They might log requests or outputs for a short period, but like OpenAI, they have policies regarding user data (we encourage you to check their privacy terms). We do not share your personal identity information with these services beyond what is in the prompt or image data necessary for generation.
  • Google Cloud (Photo Analysis via Gemini Vision API): If you upload photos for a self-model, those images are sent to Google's Vision AI (Gemini) for analysis (such as detecting facial features or generating an AI representation). Google will process the images to return analysis results (e.g., biometric embeddings or descriptions). We do not store the photo on Google's servers beyond the processing; the image is sent and the result is received, then the image is deleted per our retention policy. Google might retain some data for a short period or for improving their services, as per their privacy policy, but this usage is governed by our agreement with Google. No personal identification like your name is sent with the image — only the raw image data.
  • OnlyFansAPI (Third-Party Integration): Our platform offers an optional integration with OnlyFans via a third-party service (OnlyFansAPI.com) that allows you to publish AI-generated content or send messages to your OnlyFans account. This is entirely optional and disabled by default. If you choose to link your OnlyFans account, we will ask for your authorization and necessary credentials (such as an API token or login via the OnlyFansAPI service) to post content on your behalf. The data shared in this process will include the content you choose to publish (e.g., captions, images, messages) and possibly your OnlyFans account identifier or authentication token. We do not share other personal data with OnlyFans, only the content and necessary auth data you provide to facilitate the integration. Any content posted to OnlyFans is also subject to OnlyFans' own Privacy Policy and terms. We recommend reviewing their policies when you use that integration. We are not responsible for how OnlyFans handles data once it's published on their platform.
• Within a Multi-Tenant Organization: If your account is part of an organization (tenant) with multiple authorized users (for example, in an Enterprise tier where a team works together), certain data may be shared with other users in your organization. For instance, if you are an ai_model_manager in your company's workspace, other members of your organization (with appropriate roles) may see content generated or uploaded in that workspace. However, each organization's data is isolated from other organizations via strict access controls (row-level security in our database). Users from one tenant cannot access data from another tenant's workspace.
• Legal Requirements and Protection: We may disclose your information if required to do so by law or in the good-faith belief that such action is necessary to (a) comply with a legal obligation, such as a subpoena, court order, or other process; (b) protect and defend the rights or property of Create Your Desire; (c) act in urgent circumstances to protect the personal safety of users or the public; or (d) protect against legal liability. If we receive law enforcement requests for user data, we scrutinize them carefully and only comply if they are valid and required by applicable law.
• Business Transfers: If Create Your Desire is involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider, your information may be transferred as part of that transaction. We will ensure that any successor entity honors the commitments in this Privacy Policy or provides notice and obtains consent if required by law for any material changes in data handling.
• With Your Consent: In cases where you have given us explicit consent to share your information, we will do so in accordance with that consent. For example, if we ever want to use your testimonial or story on our website, we would ask for your permission. Or if you opt-in to a feature that involves sharing data with a third party not otherwise described (like a new integration), we will do so only with your knowledge.

We do not share or disclose your personal information to third parties for their own marketing or advertising purposes.

4. Cookies and Tracking Technologies

Our platform uses cookies and similar technologies sparingly and primarily for functionality. For detailed information, please review our separate Cookie Policy. In summary:

• We use an authentication cookie or token to keep you logged in (an essential cookie).
• We use local storage to remember your cookie consent choice (cookie-consent-given) and to store an analytics session identifier (analytics_session_id) for internal analytics.
• We do not use any third-party advertising or tracking cookies (no Google Analytics, no ad networks). All analytics are done through our own systems.
• We may use cookies to remember preferences or settings on the site (like if you dismiss a notification, we might set a flag so it doesn't show again).
• Because we use some third-party services, they might set their own cookies when those services are loaded. For example, Stripe might set cookies to remember your session during the checkout process or to prevent fraud, and the OnlyFans integration (if used) might set cookies for authentication. Those cookies are controlled by the third parties and are governed by their policies.
• You have choices to manage cookies: you can configure your web browser to refuse some or all cookies, or to alert you when cookies are being set. However, please note that if you block cookies, certain essential features (like staying logged in) may not work properly. On our site, we provide a cookie consent banner for any non-essential cookies; you can choose to opt out of analytics tracking and we will honor that choice by not setting the analytics local storage or events.

For more details or to change your preferences, see the Cookie Policy section below.

5. Data Storage and Security

Storage Locations: Your data is primarily stored in cloud data centers via our providers. Supabase (which hosts our Postgres database and file storage) may store data on servers in various regions. We aim to select server regions that are efficient for our user base; currently, our services are hosted in reliable data centers (the exact location may be subject to Supabase's infrastructure, but likely within regions that comply with strong security standards; for instance, Supabase uses AWS or Google Cloud under the hood). Stripe and other processors similarly store data on their secure servers. By using our Service, you acknowledge that your data may be transferred to and stored in servers located in countries different from your own.

Security Measures: We implement a variety of security measures to protect your personal information:

• All network communication with our Service is encrypted via TLS/SSL (HTTPS) to prevent eavesdropping.
• Passwords are hashed and salted using secure algorithms and never stored in plain text.
• Our database access is protected by row-level security, meaning each user and organization can only access their own data; requests are authenticated with JSON Web Tokens (JWTs) provided by Supabase Auth.
• Internally, we restrict access to personal data. Only authorized personnel (for example, a limited number of administrators or operations managers) have access to production databases or storage, and even then, they use it only for legitimate administrative purposes. Access logs are maintained.
• We utilize API keys and secret credentials for third-party integrations, which are stored securely and rotated as needed. For example, we verify Stripe webhooks with a signing secret to ensure they truly come from Stripe.
• We regularly update our software dependencies and apply security patches to address vulnerabilities. Our backend (NestJS on Node.js) and frontend (Next.js) frameworks are kept up-to-date.
• We use cloud security best practices (firewalls, limited network access, principle of least privilege for accounts).
• Files (such as user-uploaded images) in storage have access controls; only authenticated requests with proper tokens can retrieve them.
• We may conduct periodic security audits and/or employ tools to scan for security issues.

Despite our efforts, no system can be 100% secure. Therefore, we cannot guarantee absolute security of your data. You also play a role in security: protect your account credentials and notify us if you suspect any unauthorized access to your account.

6. Data Retention

Retention depends on the category of information, its current purpose and applicable obligations. Category-specific periods, preservation exceptions and the handling of supplier and backup copies are still being reviewed. No general automatic deletion or account-recovery period is confirmed by this policy.

• Account Data: Account access, closure, subscription changes and removal of personal information are assessed separately. Cancellation or a deletion request does not by itself establish that account data has been removed. We review the relevant purpose, scope and any necessary retained records before confirming an outcome.
• Analytics and Operational Logs: These records need their own retention and minimisation decisions. An automatic purge interval is not currently verified. The review includes whether identifiers or unnecessary detail can be removed separately from records still needed for a specific purpose.
• Source Photos and Reference Images: Original uploads, selected references, derived appearance data and other copies require separate handling. A reference used by an active persona can have a different purpose from an unused upload. Retirement, withdrawal or a deletion request requires review of those purposes and copies; a change to the persona does not establish complete erasure.
• Generated Content and Drafts: Prompts, drafts, delivered originals, reference copies and review records have different purposes and dependencies. Removing or hiding an item from a screen is not evidence that all stored copies have been removed. Automated disposition remains paused while the applicable retention and handling decisions are completed.
• Payment and Credit Records: We assess payment, subscription, generation-credit and outcome records separately from image files. Applicable accounting, dispute or audit requirements may require particular records to be retained. This does not establish a reason to keep every associated media file or personal identifier.
• Consent, Safety and Review Records: Consent and provenance records, safety findings, disputes and review history need their own purpose, permitted access and retention decisions. A preservation need is assessed separately from permission to access or use the underlying content; it is not a blanket reason to retain information indefinitely.
• Communications: Support messages and related notes are reviewed for their specific purpose and any applicable obligations. Their retention period is not automatically the lifetime of an account or a reactivation window.
• Suppliers, Caches and Backups: These copies can follow different processes from live account data. Their coverage, expiry and removal procedures have not yet been verified for complete account removal. We distinguish confirmed actions from retained exceptions, outstanding supplier actions and unknown backup outcomes. Backup expiry and restoration safeguards require verification before we confirm removal of those copies.
• Deletion Requests: You can contact us to request review of removal or restricted use of your information. The review considers the relevant account and copies, your authority, applicable rights, safety or preservation needs and any required retention. A request or saved status is not confirmation of erasure, supplier completion, recovery or cancellation of a subscription. Completed actions and remaining limitations must be confirmed separately.

Paused automation and unresolved periods do not permit indefinite retention. The review must address information that is no longer needed, any applicable retention requirements and what can be confirmed about each copy. Our current status screens show saved metadata, not proof of complete physical removal.

7. Your Rights and Choices

You can contact us about access, correction, export, withdrawal or deletion of your information. Applicable rights and exceptions depend on your circumstances and jurisdiction. Although automated export and deletion tools are paused, requests can still be made using the contact details below.

• Access and Portability: You can request access to information we hold about you. Self-service exports and archive downloads are currently paused. Contact us to describe the information you need; identity, authority, scope, other people's information and applicable requirements need review before the available information and delivery format can be confirmed. A historical export status does not establish that a complete archive is available.
• Rectification (Correction): If any of your personal information is inaccurate or outdated, you have the right to correct it. You can update most of your profile information directly in your account settings (e.g., change your name, avatar, email – note changing email may require re-verification). If you need to correct something you can't change (or if a self-model's data is somehow inaccurate), contact us and we will help correct it if possible.
• Deletion Requests: To request review of account closure or removal of personal information, contact us at info@createyourdesire.com.au with the account and scope of your request. Automated deletion and account recovery are paused. Identity, authority, applicable rights, preservation needs and retained exceptions require review. Access withdrawal, live-data removal and supplier or backup outcomes are separate matters; a request does not confirm completion of any of them. Ask about subscription cancellation separately and confirm its status; sending a data request does not itself change billing.
• Withdrawal of Consent: Where processing relies on consent, you can contact us to withdraw it and identify the feature, reference or information concerned. Withdrawal, restrictions on further use and retention of existing copies or consent/review records are assessed separately. We do not treat withdrawal as confirmation that photos, derived data, supplier copies or backups have already been erased. We will explain any resulting feature limits and the outcome of the review.
• Restriction of Processing: You have the right to request that we restrict processing of your data in certain circumstances (for example, if you contest the accuracy of data, or if the processing is unlawful but you don't want it erased). This is typically applicable while a concern is resolved. Practically, if such a case arises, contact us and we can pause certain processing (for example, stop using your data in some way) until resolved.
• Objection to Processing: You have the right to object to our processing of your data in some cases, particularly if we are processing it based on legitimate interests or for direct marketing. For example, you can object to receiving marketing emails – we will then cease marketing to you. You might also object to analytics tracking; in which case, we provide means to opt out as described. If you object to any processing necessary for the Service (like you don't want us to use your data for content moderation checks), we will explain if we cannot accommodate that (since such processing might be integral to providing a safe service).
• Not to be Subject to Automated Decisions: Our platform does not make any legally significant decisions about you solely by automated means. The AI outputs and moderation might be automated processes, but they do not determine your access to a contract or service without human review in important matters. If ever in future we implement something like automated account banning by AI, we would provide an avenue for human review. At this time, decisions to terminate accounts are made with human involvement.

These rights may be subject to certain exemptions or limitations under applicable law. For example, we cannot provide data that includes other individuals' personal information without redaction, and we might refuse requests that are excessively repetitive or manifestly unfounded. If you are in the European Economic Area (EEA), United Kingdom, or similar jurisdictions, the above correspond to your GDPR rights. If you are in California, you have similar rights under the CCPA/CPRA (see below). We will not discriminate against you for exercising your privacy rights.

How to Exercise Your Rights: The easiest way for many requests is to contact us at info@createyourdesire.com.au describing the account, information and action involved. Use your registered email where possible. Do not send passwords, payment details, identity documents or private images in an initial message. If further verification is needed, a suitable method must be agreed first. Applicable response requirements still need to be met while automation is paused. The outcome, available format, any retained information and outstanding supplier or backup limits require individual confirmation.

8. Biometric Information

Because our Service processes photos of individuals to create AI models (which may involve biometric data, such as facial recognition vectors or characteristics), we want to address how we handle this sensitive information in compliance with applicable laws (like biometric privacy laws in some U.S. states, if they apply):

• Consent: Permission for a photo-based persona's intended use and any required verification must be established separately. Accepting this policy or uploading an image alone does not establish identity, adulthood or permission to create adult AI content. Use the contact details below to ask about the process or withdraw consent.
• Limited Use: We will only use biometric data derived from your photos for the specific purpose of providing the Service to you – namely, generating AI content that resembles you and moderating that content as needed. We do not use your biometric data for any other purpose (such as identifying you in other images, or sharing with any third party for their own use, etc.). We do not sell or disclose your biometric identifiers to outside parties. The one exception is the processing by our service provider (Google's Vision API) as described, which is solely for generating the data for our use, under strict confidentiality.
• Storage and Deletion: Original uploaded photos, approved reference versions and derived appearance information need separate purpose and retention decisions. Account closure, reference retirement or a withdrawal request does not itself confirm their removal. The full category schedule and handling of supplier and backup copies remain under review; no automatic photo or biometric-data purge is confirmed here.
• Protection: Biometric data, being sensitive, is protected with high security. It resides in our database just like other personal data, with access controls, encryption in transit and at rest, etc. Only a very limited set of employees or processors (e.g., the AI generation service) have access to it.
• Notification and Destruction Policy: Any required feature-specific notice, consent and destruction schedule must be established for the relevant use. This migration notice does not establish that the complete process or schedule is approved. Contact us about access, withdrawal or removal; the pause in automation does not permit indefinite retention.

By using the Service's photo-based features, you acknowledge these practices. If you have questions or concerns about biometric data usage, please contact us.

9. International Data Transfers

Create Your Desire is an Australia-based service, but we operate online and work with providers in various countries (United States and others). This means your personal data may be transferred to, and processed in, countries other than your own. In particular, data may be stored on servers in the United States (since providers like Supabase, Stripe, OpenAI have infrastructure in the U.S.) or other jurisdictions. Australia, the US, and other countries may have different data protection laws than your country.

If you are located in the European Economic Area (EEA), UK, or Switzerland: whenever we transfer your personal data out of those regions, we take steps to ensure appropriate safeguards are in place to protect your information. This could include using specific contract clauses (Standard Contractual Clauses) approved by the European Commission, or transferring only to countries with adequate data protection levels, or other valid transfer mechanisms. Our major sub-processors like Stripe, Supabase, and Google have committed to compliance with GDPR transfer requirements (for example, Stripe and Google rely on SCCs for EU data transfer). By using our Service, you understand that your data may be transferred to our facilities and those third parties as described.

We will ensure that any international transfers are done in accordance with applicable privacy laws and that your data remains protected to the standards of your home jurisdiction. If such an arrangement is deemed inadequate, we will seek your consent for the transfer or cease the transfer.

10. Children's Privacy

As stated in our Terms, Create Your Desire is strictly 18+. We do not target or permit children to use our Service. We do not knowingly collect personal information from anyone under the age of 18. If you are under 18, you are not allowed to use the Service or provide any personal data to us. We explicitly require age confirmation during registration to enforce this.

If we become aware that we have inadvertently collected personal information from someone under 18, we will take steps to delete such information as soon as possible. If you are a parent or guardian and you believe we might have any information from or about a minor, please contact us immediately so that we can investigate and take appropriate action.

11. Additional Notices for California Residents (CCPA)

If you are a resident of California, you have specific privacy rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA. Many of these rights (access, deletion, etc.) are substantively the same as those described in Section 7 above. This section uses CCPA terminology to ensure compliance:

• Categories of Personal Information Collected: In the preceding 12 months, we have collected the following categories of personal information (as defined by CCPA):
  • Identifiers (real name, email address, IP address, account ID, etc.).
  • Customer Records (payment information via Stripe, billing history).
  • Characteristics of protected classifications (age — we collect confirmation that you are 18 or older).
  • Biometric Information (photos and facial data for those who use that feature).
  • Internet or other electronic network activity (usage data, analytics, log data, cookie identifiers).
  • Audio/visual data (photographs you upload, generated images which may depict you).
  • Inferences drawn from the above (e.g., preferences or persona traits you provide, or inferences for content personalization).
  We do not collect education, employment, or credit information, nor geolocation at a precise level.
• Business or Commercial Purpose for Collection: We collect and use this information for the business purposes outlined in Section 2 (to provide the service, maintain security, etc.), which align with the purposes specified in CCPA (such as performing services, advertising and marketing (though we don't do third-party advertising, only internal marketing if any), security detection, debugging/repair, and service improvements).
• Categories of Sources: We collect information directly from you (e.g., when you fill in forms, provide content, or from your device automatically through interactions) and from service providers (e.g., payment info from Stripe, or results from OpenAI/Google which originate from processing your input).
• Disclosure of Personal Info: We have disclosed the above categories of information to service providers or contractors for business purposes (as detailed in Section 3). For example, identifiers and financial info to Stripe (payment processor), internet activity and usage to our cloud hosts (Supabase) and analytics processing (our internal systems), etc.
• Sale or Sharing of Personal Info: Create Your Desire does not sell personal information as defined by the CCPA (i.e., we do not exchange your personal data for money or other valuable consideration with third parties for their own use). We also do not "share" your personal information for cross-context behavioral advertising purposes. We do not allow third-party advertisers to collect information from our site for targeted ads. Therefore, the opt-out of sale/sharing is not applicable. We do not have any actual knowledge of selling or sharing personal info of consumers under 16, either, because we do not allow under 18 at all.
• Your Rights (CCPA-specific): You have the right to request that we disclose what personal information we collect, use, disclose, and sell about you (a "Request to Know"), the right to request deletion of your personal information, the right to correct inaccurate personal information, and the right to opt-out of the sale or sharing of personal information (though as stated, we do not sell or share in that manner). You also have the right to non-discrimination for exercising your CCPA rights. To exercise any of these rights, you or your authorized agent may contact us (see Contact section). We will need to verify your identity (such as by verifying control of your email address or other information) for Requests to Know or Delete. For an authorized agent request, we may require proof of the agent's registration or your written permission.
• Sensitive Personal Information: We do collect what CCPA considers "sensitive personal information" (e.g., login credentials, biometric data in photos, etc.), but we only use it for necessary purposes (like authentication, providing the service) and not to infer characteristics about you. Therefore, under CPRA regulations, we treat it as required for service provision and do not offer a right to limit use of sensitive info beyond what is already described (since we're not using it for secondary purposes like marketing).
• Retention: We have described our retention practices in Section 6. Generally, we keep data as long as needed for the purpose, and certain info for legally required durations. We do not keep personal information indefinitely; criteria involve account status, legal requirements, and business needs.

This California section is intended to comply with CCPA/CPRA. If any terms differ between this and the rest of the Privacy Policy, the interpretation that is more protective of personal data will control, unless otherwise directed by law.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we update the policy, we will change the "Last Updated" date at the top. If changes are significant, we will provide a more prominent notice (such as by email notification to account holders or a notice on our website). We encourage you to review this Policy periodically to stay informed about how we are protecting your information.

Your continued use of Create Your Desire after any changes to this Privacy Policy constitutes your acceptance of the updated terms, to the extent permitted by law. If you do not agree with the changes, you should stop using the Service and may request deletion of your data.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: info@createyourdesire.com.au
• Address: 17 Phar Lap Parade, Karalee QLD 4306, Australia

Attn: Privacy Officer, Create Your Desire

We will do our best to respond to you in a timely and helpful manner. If you are in the EEA/UK and feel your issue was not resolved, you have the right to lodge a complaint with your supervisory authority for data protection. In Australia, if you have raised a concern with us and are not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC). We would, however, appreciate the chance to address your concerns first, so please reach out to us.

Thank you for trusting Create Your Desire with your personal information. We are committed to safeguarding your privacy as you enjoy our AI platform.