Petopia (hereinafter referred to as "we," "us," "our," or "Petopia") is a generative AI product offered to users worldwide. We take privacy protection seriously and are committed to complying with major global data protection laws, including but not limited to the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), the Personal Information Protection Law of the People's Republic of China (PIPL), Brazil's LGPD, Singapore's PDPA, the Australian Privacy Act, and other applicable data protection laws, while also addressing transparency and accountability requirements relevant to generative artificial intelligence (including principles under the EU AI Act).
This Privacy Policy explains in detail how we collect, use, store, share, transfer, and protect your personal information, as well as the rights you have under applicable law. By using our Service, you acknowledge that you have read, understood, and agree to this Policy. If you do not agree, please stop using the Service immediately.
1. Definitions and Scope
Personal Information / Personal Data: Any information that, alone or in combination with other information, can identify a specific natural person, including but not limited to name, email address, IP address, device identifiers, and user input content.
User Content: The prompts, text, images, files, audio, video, or other materials you submit to the Service, as well as the outputs generated from them.
Processing: Any operation performed on personal information, including collection, storage, use, transmission, deletion, and similar activities.
This Policy applies to all personal information processing activities arising from your use of the Petopia Service via our website, applications, API, or other means. This Policy does not apply to data we process on behalf of enterprise customers (such processing is governed by a separate Data Processing Agreement).
2. Categories of Information We Collect
2.1 Information You Provide Directly
- Account registration and management information: Email address, username, password (stored in encrypted form), and profile information (such as avatar or display name, if you choose to provide it).
- User Content (input data): Prompts, uploaded files, images, audio, video, or other materials you submit for AI content generation.
- Payment and transaction information (if applicable): Payment-related information processed through third-party payment service providers (we generally do not store full payment card details ourselves).
- Communication and feedback information: Content you provide when contacting us via customer support, email ([email protected]), feedback forms, surveys, or social media.
- Marketing preferences: Your choices regarding receiving or declining marketing communications.
2.2 Information Collected Automatically
- Device and technical information: Device type, operating system version, browser type and version, device identifiers, IP address, network information, screen resolution, and language settings.
- Usage and log data: Access times and dates, page views, feature usage, number and type of generation requests, session duration, error logs, and crash reports.
- Location information: Approximate geographic location based on IP address (we do not collect precise GPS location unless you explicitly authorize it).
- Cookies and similar technologies: See Section 10.
2.3 Generated Content and Derived Data
- Outputs generated by the AI based on your inputs, generation history, and related metadata (such as generation time, model version, and parameter settings).
- Temporary analytical data created for security and abuse-detection purposes.
2.4 Information We Do Not Intentionally Collect
We do not intentionally collect sensitive personal information (including racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life, or sexual orientation), unless you voluntarily include such information in your inputs. Please use the Service carefully and avoid entering sensitive information or other people's personal data in your prompts.
3. How We Use Information and Legal Bases
We process your personal information only when we have a valid legal basis for doing so. The main purposes for which we use your information, and the corresponding legal bases, are as follows:
We process your personal information to provide the core AI generation service, including receiving and processing your inputs (prompts and related content) and generating outputs. This processing is necessary for the performance of the contract between you and us.
We use account and related information for account management, identity verification, and customer support. This is necessary for the performance of our contract with you and, in certain cases, based on our legitimate interests in ensuring the proper operation of the Service.
We process information for security protection, fraud prevention, abuse detection, and handling of prohibited content. This is based on our legitimate interests in protecting the Service, our users, and the public, as well as our legal obligations where applicable.
We may use aggregated or de-identified data for service improvement, performance analysis, and product optimization. This processing is based on our legitimate interests in enhancing user experience and the quality of the Service.
We process information as necessary to comply with applicable laws, regulations, court orders, or lawful government requests. This is based on our legal obligations.
We may send you service-related notices and important updates. This is necessary for the performance of our contract with you or based on our legitimate interests in providing essential service communications.
We may send you marketing communications only if you have given your consent. You may withdraw this consent at any time.
Special disclosure regarding artificial intelligence processing (important):
- Our Service uses artificial intelligence models (which may include our own models and/or third-party model providers) to generate content. Your User Content (prompts and related inputs) is sent to the relevant AI models for real-time inference processing.
- By default, we do not use your personal User Content to train, fine-tune, or improve our foundation AI models. If we introduce a voluntary option to participate in model improvement in the future, we will clearly notify you in advance and obtain your consent or provide an opt-out mechanism.
- Third-party model providers process data under Data Processing Agreements (DPAs) with us and generally commit not to use customer data for their own model training (subject to each provider's latest policies).
- In limited security and abuse-detection scenarios, a small amount of data may be subject to limited human review (restricted to necessary security personnel under strict access controls and logging).
- Generated content may be temporarily stored to support your access to generation history, service continuity, and security review.
4. Sharing, Disclosure, and Third Parties
We do not sell your personal information. We may share information only in the following limited circumstances:
- Service providers and processors: Cloud infrastructure providers, analytics services, customer support tools, payment processors, and AI model providers. We share information only to the extent necessary and require them to enter into Data Processing Agreements and comply with confidentiality and security obligations.
- Legal and compliance requirements: To comply with applicable laws, regulations, court orders, government investigations, or to protect the rights, property, and safety of us, our users, or the public.
- Business transfers: In the event of a merger, acquisition, asset sale, reorganization, or bankruptcy, personal information may be transferred as part of the business assets (subject to this Policy and, where feasible, with prior notice).
- Other situations with your explicit consent.
We maintain and periodically update a list of sub-processors (available upon request where applicable). We require all third parties to implement security measures no less protective than those required under this Policy.
5. Data Retention and Deletion
We follow the principles of data minimization and storage limitation and retain personal information only for as long as necessary to fulfill the purposes for which it was collected:
- Account information: For the duration of the account and a reasonable period after account deletion (typically 30–90 days after deletion to handle outstanding matters or legal requirements).
- User Content and generation history: You may delete this at any time through account settings or by contacting us. After a deletion request is processed, we will remove the data from active systems within a reasonable period (typically within 30 days). Backup systems may retain data for a longer period but will overwrite or destroy it according to established policies.
- Logs and security data: Generally retained for a shorter period (for example, 3–12 months) for security auditing and compliance purposes.
- Legal holds: Retention may be extended if there is pending litigation, an investigation, or a legal obligation.
Once deleted, data is generally unrecoverable. De-identified or fully anonymized data may be retained indefinitely for statistical and research purposes.
6. Your Rights and How to Exercise Them
Depending on the laws applicable in your region, you may have the following rights (we will make reasonable efforts to respond):
General rights (under GDPR, PIPL, and similar laws):
- Right to be informed and right of access: To know what data we process about you and to obtain a copy.
- Right to rectification: To request correction of inaccurate or incomplete information.
- Right to erasure (right to be forgotten): To request deletion under certain conditions.
- Right to restriction of processing.
- Right to object to processing (especially where based on legitimate interests or for direct marketing).
- Right to data portability.
- Right to withdraw consent (without affecting the lawfulness of processing based on consent before its withdrawal).
- Right not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects (where applicable).
Additional rights for California residents (CCPA/CPRA):
- Right to know, right to delete, and right to correct.
- Right to opt out of the "sale" or "sharing" of personal information (we do not sell personal information).
- Right to limit the use and disclosure of sensitive personal information.
- Right not to be discriminated against for exercising your rights.
- Right to designate an authorized agent to exercise rights on your behalf.
Other regions:
We will provide corresponding rights in accordance with local laws (such as the right to confirm the existence of processing under Brazil's LGPD, or access and correction rights under Singapore's PDPA).
How to exercise your rights:
Please send an email to [email protected] and include:
- The type of request you are making;
- Sufficient information to verify your identity (we may request additional verification to protect your data security);
- Relevant account information.
We will respond within the timeframes required by applicable law (typically within 30 days of receiving a verifiable request; complex cases may be extended with notice to you). We will not discriminate against you for exercising your rights.
If you believe our processing has infringed your rights, you also have the right to lodge a complaint with your local data protection supervisory authority.
7. International Data Transfers
Your personal information may be transferred to, stored in, or processed in countries or regions other than your own (which may include the United States, the European Union, the Asia-Pacific region, or elsewhere). We implement the following safeguards:
- European Union Standard Contractual Clauses (SCCs) or other approved transfer mechanisms;
- Adequacy decisions (where applicable);
- Other appropriate safeguards that meet the requirements of applicable law.
We ensure that recipients provide a level of protection comparable to that of the original jurisdiction.
8. Data Security Measures
We implement reasonable and appropriate technical and organizational measures to protect your personal information, including but not limited to:
- Encryption in transit (such as TLS/SSL);
- Encryption at rest;
- Access controls and the principle of least privilege;
- Multi-factor authentication;
- Regular security assessments, vulnerability scanning, and penetration testing;
- Employee privacy and security training;
- A security incident response plan.
Although we strive to protect data, no system is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authorities and affected individuals as required by applicable law.
9. Children's Privacy
The Service is not directed to children under the age of 13 (or the higher age required by local law, such as 16 in certain EU countries). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected information from a child, we will delete it as soon as possible. Parents or guardians who believe we may hold information about a child should contact us immediately.
10. Cookies, Tracking Technologies, and Do Not Track
We use cookies, pixel tags, local storage, and similar technologies:
- Necessary cookies: To maintain login sessions, security, and basic functionality.
- Analytics/performance cookies: To understand how the Service is used so we can improve it.
- Functional cookies: To remember your preference settings.
You can manage or delete cookies through your browser settings. Refusing certain cookies may affect some functionality. We currently do not respond in a special way to "Do Not Track" browser signals, but you can control tracking preferences through the methods described above.
11. Third-Party Links and Integrations
The Service may contain links to or integrations with third-party websites or services. These third parties have their own independent privacy policies, and we are not responsible for their content or practices. We encourage you to review their policies before providing any information.
12. Marketing Communications and Preference Management
We may send you service-related notices or (with your consent) marketing communications. You may manage your preferences or unsubscribe at any time via the unsubscribe link in emails, through account settings, or by contacting [email protected]. Unsubscribing does not affect necessary service communications.
13. Changes to This Policy
We may update this Policy from time to time to reflect changes in our Service, legal requirements, or practices. Material changes will be notified through a prominent notice on our website, by email, or by other appropriate means, and the "Last Updated" date will be revised. Continued use of the Service after such changes constitutes acceptance of the updated Policy. We encourage you to review this Policy periodically.
14. Contact Us
If you have any questions, comments, requests, or complaints regarding this Privacy Policy, our data processing practices, or wish to exercise your rights, please contact us at:
Email: [email protected]
We will respond within a reasonable time. For complex requests, we may need additional time and will inform you accordingly.