Privacy Policy

1.Introduction & Data Controller

This Privacy Notice explains how ArtFusion (operating as a Sole Proprietorship under Indian law, trading as “ArtFusion”, hereinafter “we”, “us”, or “our”) collects, stores, processes, transfers, and protects personal data when you use our generative studio platform, APIs, and associated web services.

For users located in India, this policy is published pursuant to the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules). For users in the European Economic Area (EEA) and United Kingdom, ArtFusion operates as a Data Controller under the General Data Protection Regulation (GDPR).

2.Information We Collect & Process

We process the following categories of data strictly to deliver and secure our generative AI platform:

3.Third-Party Subprocessors & Data Transfers

To render high-fidelity generative outputs and maintain global availability, we transmit essential execution data to vetted technical subprocessors under strict confidentiality agreements:

4.Data Retention & Deletion Schedule

We retain personal data only for as long as necessary to provide the platform services and fulfill statutory compliance obligations:

• Active Account Data: Retained for the duration of your active account. If you request account deletion, your profile, authentication tokens, and private workspace projects are permanently deleted or pseudonymized within thirty (30) days.
• Uploaded & Generated Media (Cloudflare R2): Generation stream runs (images, videos, Character Maker candidate outputs) and unattached generation files are retained for a rolling period of thirty (30) days from generation, after which they are automatically purged. Saved library characters, uploaded assets, and active project assets are retained in your workspace until manually deleted by you or upon account closure.
• Security & Transaction Audit Logs: Maintained securely for a rolling period of 180 days in compliance with the Indian CERT-In Directions and Rule 3(1)(h) of the IT Intermediary Guidelines.
• Financial Records: Invoicing and transaction metadata are retained for statutory tax audit periods as required by applicable commercial accounting laws.

5.Your Rights & Choices

Depending on your jurisdiction, you possess specific statutory rights regarding your personal data:

To exercise any of these rights, email us at [email protected] or submit a request through our Grievance Portal. We respond to verified data subject requests within statutory timelines.

6.Children's Privacy (Strict 18+ Policy)

ArtFusion is strictly intended for individuals aged 18 and older. We do not knowingly collect, solicit, or process personal data from minors under 18 years of age. If we become aware that a child under 18 has created an account or provided personal information, we will take immediate steps to terminate the account and permanently delete all associated data from our servers.

7.Security Safeguards & Breach Response

We implement industry-standard administrative, physical, and technical safeguards, including:

• End-to-end TLS 1.3 encryption for all data in transit;
• AES-256 encryption at rest for media assets stored in Cloudflare R2;
• Bcrypt adaptive hashing for passwords;
• Role-based access controls and rate-limiting across all internal APIs.

In the unlikely event of a security breach affecting personal data, we will notify impacted users and statutory authorities (including the Data Protection Board of India and CERT-In) in accordance with mandatory legal notice requirements.

8.Designated Grievance Officer & Contact

If you have any questions, privacy concerns, or grievances regarding this Privacy Notice or our data handling practices, please contact our designated Grievance Officer: