Privacy Policy

1. Scope

This Privacy Policy explains how MossImage ("MossImage", "we", "us") handles personal information when you use the MossImage website and hosted image generation service (the "Service"). It applies to the website, the generator, account pages, billing pages, support conversations, and the crawler files we publish.

The Service is operated from the domain getmossimage.com. If you have a question about this policy or want to exercise a privacy right, contact support@getmossimage.com.

2. Information we collect

We collect the following categories of information.

1. Account information. Your email address, display name, account identifier, authentication provider, password hash if you use email sign-in, email verification status, locale, and account timestamps.
2. Prompts and generation inputs. The text prompts, JSON layouts, negative prompts, aspect ratio, quality tier, seed, reference images, and other inputs you submit to the generator.
3. Generated images and task data. The images produced for you, task status, credit cost, failure reasons, timestamps, and the technical parameters used for the render.
4. Payment and billing data. When you buy credits or a subscription, Waffo processes the payment. We receive a transaction identifier, order status, amount, currency, plan or credit pack, and limited billing details such as a masked card reference or country. We do not store full card numbers or security codes on our servers.
5. Usage and device data. IP address, browser and operating system, device type, pages viewed, request timestamps, error logs, and security signals such as rate-limit events.
6. Support and communications. Messages you send to support, including any attachments, and the reply history.
7. Cookies and local storage. Authentication cookies, locale and theme preferences, cookie-consent choice, and short-lived browser storage used to carry a prompt from the prompt library into the generator.

We do not ask for government identifiers, precise location, health data, or other special-category data. Please do not put sensitive personal information into a prompt or a reference image.

3. How we use information

We use the information above to:

• create and secure your account, and sign you in;
• run the model, deliver images, and show task history;
• meter free daily drafts, credits, and subscriptions;
• process payments, receipts, refunds, and fraud checks through Waffo;
• provide support and respond to reports of abuse;
• detect, prevent, and investigate misuse, including attempts to bypass safety systems or rate limits;
• maintain and improve reliability, latency, safety, and product design using aggregated or de-identified data;
• comply with legal obligations and enforce our Terms of Service.

We do not sell personal information. We do not use your private prompts or generated images to train a public model. If we ever offer an opt-in public gallery or model-improvement program, it will require your separate consent.

4. Legal bases (EEA and UK)

Where the GDPR or UK GDPR applies, we rely on:

• contract — to provide the Service you asked for, including generation, credits, and subscriptions;
• legitimate interests — to secure the Service, prevent abuse, debug failures, and improve the product, balanced against your rights;
• legal obligation — to keep tax, accounting, and fraud-prevention records;
• consent — for optional analytics or marketing cookies, where consent is required. You can withdraw consent at any time.

5. Cookies and similar technologies

We use:

• Strictly necessary cookies for authentication, session security, and CSRF protection.
• Preference storage for theme, locale, and cookie-consent choice.
• Session storage for short-lived UI state, such as a prompt you chose to try from the prompt library.
• Optional analytics, only when enabled and, where required, only after you accept the cookie banner.

You can clear cookies and local storage in your browser. Clearing strictly necessary cookies signs you out and may reset preferences. Blocking all cookies can prevent sign-in and generation from working.

6. AI processing and third-party processors

We use service providers to run the Service. They process data only for the purposes we specify.

• fal.ai — model inference. Prompts, layout JSON, generation parameters, and any reference images you submit are sent to fal.ai to produce the requested image. Output files are returned to us and stored for your account.
• Waffo — payment processing, subscriptions, receipts, refunds, and fraud checks. Payment card data is handled by Waffo and its payment partners.
• Cloudflare — hosting, CDN, security, and database infrastructure. Request logs and stored data pass through Cloudflare infrastructure.
• Email delivery providers — transactional email such as verification, password reset, and receipts.
• Support and monitoring tools — only where configured, to answer tickets and diagnose errors.

These providers may process data in other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses. We do not control a provider's independent legal obligations, and their own privacy policies also apply.

7. Retention

We keep data only as long as we need it for the purposes above.

• Account data — while your account is active, then for a short wind-down period before deletion.
• Prompts, generated images, and task history — until you delete them or delete your account, unless a shorter retention period applies. Deleted items may remain in backups for up to 30 days.
• Payment and tax records — for the period required by applicable tax and accounting law, which may be several years.
• Security and request logs — typically 30 to 90 days, unless needed to investigate an incident.
• Support messages — for up to 24 months after the ticket closes, unless a longer period is needed for a legal claim.

Aggregated statistics that cannot reasonably identify you may be kept longer.

8. Deletion and your rights

Depending on where you live, you may have the right to access, correct, export, delete, restrict, or object to the processing of your personal information, and to withdraw consent. You can:

• delete individual creations from your account;
• delete your account from the account settings page;
• email support@getmossimage.com to request access, correction, export, or deletion.

We will verify your request before acting. Deleting your account removes your profile and active content, but we may retain records that law requires us to keep, such as payment and tax records, and limited logs needed for security or legal claims. If you are in the EEA or UK, you also have the right to complain to your local data protection authority.

9. Security

We use HTTPS in transit, access controls, hashed passwords, short-lived sessions, rate limits, and provider-side safeguards. No service is completely secure. If we become aware of a breach that affects your personal information, we will notify you and the relevant authorities as required by law.

10. International transfers

The Service and its providers may process data in the United States, the European Union, and other countries. Where personal data leaves your region, we use appropriate transfer mechanisms and require providers to protect it.

11. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you are under the age of majority in your jurisdiction, you may use the Service only with the involvement of a parent or guardian. If you believe a child has provided personal information, contact us and we will delete it.

12. AI content disclaimer

Generative models can produce inaccurate, biased, or unexpected output, including text that looks plausible but is wrong. An image is not a factual record. Check names, prices, dates, labels, and any regulated claims before you publish or rely on an output. MossImage does not guarantee that generated text will be spelled correctly or that an image will be free of third-party rights.

13. Changes to this policy

We may update this policy when the Service or the law changes. We will change the "Last updated" date at the top and, for material changes, provide a notice in the product or by email where appropriate. Continued use after the effective date means you accept the updated policy.

14. Contact

Privacy questions, access requests, and deletion requests: support@getmossimage.com.

This document describes our product practices. It is not legal advice. Before relying on it for a regulated use case, consult qualified counsel in your jurisdiction.