Privacy Policy

Effective 7 October 2026 · Version 2026-10-07-connected-accounts

Who we are

Design Factory is operated by Jomoj LTD, trading as Design Factory, at 56 Parkside Drive, Edgware, HA8 8JX, England. Contact support@designfactory.app or our support page for privacy questions or requests.

Information we process

We process your account email, authentication and account settings; optional name and age details you choose to save; prompts, ideas, uploaded images, styles and generated artwork; design credit balances and transaction records; subscription and payment identifiers; and information you choose to send to support. We also process technical information needed to operate and secure the app, such as request times, error information, IP addresses and browser information. Avoid including unnecessary personal or sensitive information in prompts or uploads.

Why we use it

We use this information to authenticate you, provide and save your designs, operate AI and image-processing features, deliver downloads, manage design credits and billing, answer support requests, prevent abuse and comply with legal obligations. Depending on the purpose, our legal basis is performing our contract with you, our legitimate interests in operating and securing the service, legal obligations, or consent where required. We do not sell your personal information.

AI processing and OpenAI

When you use an AI feature, we send OpenAI the prompts and relevant inputs needed for that request, which may include uploaded images, style instructions and related conversation content. We do not need to send your account password or payment card details to generate artwork. Design Factory does not use customer content to train AI models. OpenAI API data is not used for model training by default. OpenAI may retain information for abuse monitoring or according to the features and data controls in use; we do not promise zero retention. See OpenAI’s API data controls. Gemini is not part of our current customer workflows.

Service providers and access

Vercel hosts the application; Supabase provides authentication, the database and file storage; OpenAI provides AI processing; Stripe processes payments; Resend delivers account emails; and GoDaddy/Microsoft 365 provides the support inbox. These providers receive the information needed for their respective services. Stripe handles payment card details; we retain billing references and transaction information rather than full card numbers. Authorized administrators may access account and operational information when necessary to support customers, investigate failures or secure the service. Support diagnostics are optional in the contact flow; basic technical operational records are collected separately.

Cookies and browser storage

We use essential session cookies and browser storage for sign-in, security and application preferences. These are needed to provide the requested service. Optional tracking or marketing cookies, if introduced, require a separate assessment and appropriate choices; agreeing to our Terms is not consent to marketing.

Manual text ideas created while signed out are stored in your browser. After verified sign-in, you can retain that work in your account. We store your cookie preference in this browser. If you accept optional tracking, first-party analytics records page categories, signup and login activity, checkout activity and product actions using a random browser-session identifier. It does not collect your prompts, artwork, email address, payment details or URL query strings. These events are stored with our database provider, Supabase, and are not shared with an advertising provider. Optional analytics stays off after rejection or dismissal; you can withdraw consent in Cookie preferences. We keep these limited activity records for historical product reporting, with no automatic expiry. Withdrawing consent stops future optional collection; it does not erase previously recorded activity. You can contact support about existing records. You can reopen Cookie preferences from this page or Settings. Optional profile details are editable in Settings and do not determine account access or design credit entitlement.

Retention and deletion

We keep your saved artwork and related workspace information until you delete it or your account, subject to processing needed to complete deletion and limited legal, security or financial exceptions. Our retention policy is 30 days for routine diagnostic logs and 12 months for support correspondence, with longer retention only where necessary for an unresolved matter, security investigation or legal obligation. Accounting, payment and dispute records are retained for the applicable required period. Backup copies and provider records may remain until their retention periods expire; deletion from active systems does not instantly erase every backup. Contact support for the handling of a particular record.

International processing

Our providers may process information outside the UK, including in the United States and other countries where they operate. Where required, transfers rely on applicable adequacy arrangements or appropriate contractual safeguards. Contact us for information about the safeguards relevant to your data.

Your rights

Depending on applicable law, you may ask to access, correct, delete or receive a copy of your personal information; restrict or object to certain processing; and withdraw consent for processing that relies on consent. Contact support using your account email. We may verify your identity before releasing or changing account information. Some records must be retained for legal, security or financial reasons. You may complain to the UK Information Commissioner’s Office or your local supervisory authority.

Young people

If you are under 18, use of the service requires permission from a parent or guardian and must meet applicable minimum-age laws. We do not intentionally solicit children’s sensitive information. A parent or guardian can contact support to request removal of information submitted without appropriate permission.

Security and changes

We use access controls and safeguards appropriate to the service, but no internet service can guarantee absolute security. Protect your sign-in details and report suspected unauthorized access promptly. We may update this notice as our service or obligations change. We publish the effective date and provide additional notice where required.