Logo
Aiphoria
Legal

Privacy Policy

How Brightsides Creations collects, uses, shares and protects your information when you use Aiphoria, an AI photo, video and virtual try-on service.

Last updated: November 13, 2026

This Privacy Policy explains what personal data Brightsides Creations ("we," "us") collects when you use Aiphoria at aiphoria.io, its subdomains, mobile apps and AI-assistant connectors, why we collect it, who we share it with, and the choices you have.

Questions: privacy@aiphoria.io.

1. Who Is Responsible

Brightsides Creations is the data controller:

Brightsides Creations 1417 N Vista St, Ste 308 Los Angeles, CA 90046, USA

2. What We Collect

a) Information you give us

  • Account details: email, name, password (stored hashed), language, profile picture.
  • Sign-in data: if you sign in with Google, Apple or another provider, we receive your name, email and profile picture from them.
  • Agreement records: when you accepted the Terms (date, time and version) and your confirmation that you are 18 or older. When you create an AI Twin, the time you confirmed the photos are of you or that you have permission.
  • Photos and videos: the face and full-body photos you upload to create an AI Twin, extra model-card photos, reference images and videos you upload for try-on, templates, face swaps and campaigns, and product photos.
  • Prompts and settings: text you write, styles and templates you choose.
  • Outputs: images and videos the Service creates for you.
  • Payment information: payments are processed by Stripe (web) and by Apple or Google through RevenueCat (mobile). We receive your plan, transaction status and limited billing details (such as country and postcode). We never receive your full card number.
  • Support messages you send us.
  • Partner program data: if you join, the details needed to track referrals and pay you (through Trackdesk).

b) Information collected automatically

  • Device and technical data: IP address, browser, operating system, device identifiers, language, time zone, referring page.
  • Usage data: pages visited, features used, generations run, errors.
  • Session recordings: our analytics tool (PostHog) may record how you move through pages (clicks, scrolls). Text you type in form fields is masked.
  • Cookies, pixels and similar technologies: see Section 7 and our Cookie Notice.

c) Information from others

  • Sign-in providers, payment processors, app stores and our partner platform (as above).
  • Advertising platforms (Meta, TikTok, Pinterest) may tell us about the ad that brought you to us.

We do not buy personal data from data brokers.

3. Your Photos and Face Data

  • What we do with them: your photos are used only to create the content you ask for. To set up an AI Twin, an AI model (Anthropic's Claude) looks at your face and full-body photos and writes a text description of visible appearance, such as age range, face shape, skin tone, hair, eye color, body type and clothing size. Some of these descriptions (for example, how someone's ethnicity or gender appears) may be considered sensitive. We use them only to make your images look like you, and never to make decisions about you.
  • No face recognition. We do not create face templates or faceprints, and we do not use your photos to identify, verify or recognise anyone.
  • No training. We do not use your photos, prompts or outputs to train AI models.
  • Photos of other people: you may upload photos of other people only if they are 18 or older and have given you permission (see the Terms). If someone asks us to remove content showing them, we will review it and remove it when it breaks our Terms.

4. Why We Use Your Data (Legal Bases)

| Purpose | Examples | Legal basis (GDPR / UK GDPR) | |---|---|---| | Provide the Service | Create AI Twins, run generations, store your creations | Contract | | Appearance descriptions from your photos | Building your AI Twin description | Your explicit consent (given by uploading and confirming), and contract | | Account and security | Sign-in, preventing abuse and fraud, enforcing the Terms | Contract / legitimate interests | | Payments | Subscriptions, credits, refunds | Contract / legal obligation | | Support | Answering you, fixing problems | Contract / legitimate interests | | Product analytics | Understanding which features work | Legitimate interests / consent where required | | Advertising and measurement | Measuring which ads bring sign-ups and purchases | Consent where required, otherwise legitimate interests | | Emails about offers | Discounts, unfinished checkouts | Legitimate interests (you can opt out anytime) / consent where required | | Legal compliance | Tax records, lawful requests | Legal obligation |

You can withdraw consent anytime. That does not affect processing done before.

5. Who We Share Data With

We share personal data only as needed:

  • Service providers that work for us under contract (Section 6).
  • AI model providers that create your outputs. Your photos, videos and prompts are sent to them for each request.
  • Advertising and analytics partners (Section 7).
  • Authorities, when required by law or to protect people, the public or our rights.
  • A buyer or successor if Brightsides is involved in a merger, acquisition or asset sale. They must respect this Policy.

We do not sell your personal data for money. Some use of advertising pixels may count as "sharing" for cross-context behavioural advertising under California law; see Section 10 to opt out.

6. Service Providers (Subprocessors)

| Provider | What they do | Data involved | |---|---|---| | Vercel (USA) | Hosting | All data passing through the site | | Neon (USA) | Database | Account, usage and agreement records | | Cloudflare R2 (global) | File storage | Uploaded photos, videos and outputs | | Anthropic (USA) | AI analysis of AI Twin photos, campaign planning | Photos, prompts | | kie.ai, fal.ai, Replicate | Running image and video AI models (including models by ByteDance, Kuaishou and Google) | Photos, videos, prompts | | Stripe (USA) | Web payments | Billing details | | RevenueCat, Apple, Google | Mobile purchases | Purchase records | | Resend (USA) | Email delivery | Email address, email content | | PostHog (USA) | Product analytics and session recordings | Usage data, email and name for signed-in users | | Meta, TikTok, Pinterest | Ad measurement | See Section 7 | | Trackdesk | Partner program | Partner and referral data |

AI model providers process your inputs to return results and may keep them for a limited time under their own policies (for example for abuse monitoring). Some underlying models are developed by companies based in China; your data is sent to the providers listed above, not to us in China.

7. Cookies, Pixels and Advertising

We use the Meta Pixel, TikTok Pixel and Pinterest Tag on our website, and PostHog analytics. When you sign up or buy, we may also send the advertising platform a hashed (scrambled) version of your email and an account ID, so they can measure which ads work. These tools may set cookies and collect device and browsing data.

You can block these cookies in your browser, use "Global Privacy Control," or email privacy@aiphoria.io to opt out. Where the law requires your consent before these tools run, we will ask for it. Details are in the Cookie Notice.

8. International Transfers

We are based in the USA and our providers process data in the USA and other countries. When we transfer data from the EEA, UK or Switzerland, we rely on Standard Contractual Clauses or other approved safeguards.

9. How Long We Keep Data

  • Account data: while your account is open, then deleted or anonymised within 90 days after you delete it, except what we must keep by law.
  • Photos, videos and outputs: on the free plan (no active paid plan), 30 days from when each file was created, then they are deleted automatically; on a paid plan, while your account is open, and again 30 days after the plan ends. When you remove a model or creation, it disappears from your account; we may keep a copy for up to 30 days to handle abuse reports and accidental deletion. After you delete your account, we delete them within 30 days.
  • Agreement records (Terms acceptance and photo consent): for as long as your account exists and up to 6 years after, to defend legal claims.
  • Payment records: as long as tax law requires (usually 7 years).
  • Support messages: 24 months.
  • Backups: deleted data leaves our backups within 35 days.
  • Abuse: we may keep content linked to a reported violation for as long as needed for that case or for the authorities.

10. Your Rights

Depending on where you live (for example GDPR, UK GDPR, California CCPA/CPRA, Brazil LGPD, and US state privacy laws), you may have the right to:

  • access your personal data and get a copy;
  • correct it;
  • delete it, including your account (in Settings, or by email);
  • restrict or object to processing, including direct marketing;
  • portability: receive your data in a common format;
  • withdraw consent anytime;
  • opt out of "sharing" for targeted advertising and of "sale" (we do not sell for money), including through Global Privacy Control;
  • not be treated differently for using these rights;
  • complain to your data-protection authority.

Email privacy@aiphoria.io from your account email. We reply within 30 days (or sooner where the law requires) and may need to confirm your identity first.

Biometric privacy laws (for example Illinois, Texas and Washington): we do not collect biometric identifiers such as faceprints (Section 3). If you believe your data was processed in a way that breaks these laws, contact us and we will delete it.

11. Age Limit

Aiphoria is only for people 18 and older. We do not knowingly collect data from anyone under 18. If we learn we have, we delete it. Contact privacy@aiphoria.io if you believe a minor has used Aiphoria or appears in content on it.

12. Security

We use HTTPS for data in transit, provider encryption for stored data, hashed passwords, access controls and limited staff access. Files you upload and create are stored at long, random web addresses that are not listed publicly; anyone who has the exact link can open the file, so do not share links you want to keep private. No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as required by law.

13. Automated Systems

We and our AI model providers use automated filters to block unsafe or infringing requests, and automated checks for photo quality and fraud. These do not produce legal or similarly significant effects on you. If an automated decision limits your account, email support@aiphoria.io to ask for a human review.

14. Emails

We send account and service emails (sign-in links, receipts, "your video is ready" when you ask for it). We may also send emails about offers, such as a discount or a reminder about an unfinished checkout. You can opt out of offer emails anytime by replying "unsubscribe" or emailing support@aiphoria.io.

15. Changes

We may update this Policy. For material changes we will notify you by email or in the app at least 14 days before they take effect.

16. Contact

Brightsides Creations 1417 N Vista St, Ste 308 Los Angeles, CA 90046, USA Privacy: privacy@aiphoria.io Support: support@aiphoria.io