Privacy Policy

1. Introduction

StarSmith ("we", "us", "our") is an AI content creation and operations assistant for creators. We provide inspiration planning, image and caption creation, and day-to-day creator management support delivered by Smith Agent.

This Privacy Policy explains how we collect, use, share, and protect your information when you use starsmith.ai and related services (the "Service").

We follow a data minimization principle: we collect only what is necessary to provide the Service.

2. Information We Collect

Depending on how you use the Service, we may process:

• Account information — your email address, the basic profile data a third-party provider such as Google shares with us when you sign in through it (for example name and avatar), login and session records, and account preferences.
• Images you upload — the selfies you upload of yourself, and reference material you have the rights to use.
• Creation content and records — the prompts and briefs you write, the images and captions generated for you, your creation history, project and draft data, and your check-in and task records.
• Subscription and billing information — plan type, credit balance and consumption records, order and transaction records, payment and subscription status. Full payment card details are handled directly by our third-party payment processors; we never receive or store them.
• Telegram information — if you choose to connect Telegram, we process your Telegram user ID, chat ID, and your conversations with Smith in order to deliver the Service through that channel.
• Technical, analytics, and security information — device and browser information, IP address, access and activity logs, feature usage statistics, and signals used to detect abuse.
• Cookies and similar technologies — used for authentication, session persistence, security, language preference, product functionality, and usage analytics.

We do not deliberately collect sensitive personal information that is unrelated to providing the Service.

3. How We Use Information

We use the information described above to:

• provide image generation, caption creation, inspiration planning, creation history, account, and subscription features;
• provide Smith Agent's creative suggestions, task reminders, and day-to-day operational support;
• authenticate you, maintain your session, and support account recovery and security verification;
• process orders, subscriptions, credits, and related customer support requests;
• maintain service stability and quality, diagnose faults, and improve the product experience;
• detect and prevent fraud, abuse, violating content, and other conduct that harms users or the security of the Service;
• comply with obligations under applicable law.

We will never use the images you upload, your prompts, or your generated results to train any AI model — neither our own models nor any third-party model we rely on. We do not sell your personal information, do not use it for advertising targeting, and do not use it for any purpose unrelated to this Policy.

4. The Face Images You Upload: How It Works and What We Commit To

Image generation requires you to upload a selfie of yourself. This is the most sensitive data we handle, so we describe our mechanics and commitments in full here.

4.1 Used only to generate images of you

Once you upload a selfie and authorize its use, that image is used only to generate images of you, and only when you actively start a generation request. We do not use it to create content you did not request, do not use it to generate images of anyone else, and do not use it for identity recognition, facial matching, demographic profiling, or any form of user profiling.

4.2 You may only upload your own likeness

You may only upload selfies of yourself, or material for which you have explicit and sufficient authorization from the rights holder. By uploading, you confirm that you hold the necessary rights.

The following are violations and are expressly prohibited:

• uploading another person's likeness for generation, whether or not that person is a public figure;
• uploading any likeness of a minor;
• impersonating another person, fabricating someone's identity, or producing misleading depictions of another person;
• any use that infringes another person's likeness rights, copyright, or other lawful interests;
• any pornographic, NSFW, or unlawful content.

We hold ourselves to the same standard: we will never misuse anyone's likeness. Where we identify violating content, we may remove it, restrict features, or terminate the account, and we will cooperate with lawful investigations where required.

4.3 Separate, isolated storage that only you can access

The images you upload are held in storage dedicated to user images and managed separately from other business data. Specific protections include:

• Per-account isolation — each user's images are stored under a path uniquely identified by that account and are never commingled with other users' images.
• Access bound to your account — your images are not public, cannot be browsed or discovered publicly, and any access requires verification of your signed-in account identity.
• Least privilege internally — our staff and partners do not browse your images. Access occurs only in narrow circumstances, such as handling a support request you initiated or an investigation we are legally required to support, is limited to authorized personnel acting within what is necessary, and is logged.
• Encryption in transit and at rest — images are transmitted over encrypted connections and stored in encrypted form at our service providers.

We do not share, publish, sell, or provide your images to any third party for their own purposes.

The only exception is completing the generation you requested. Image generation requires computation by an AI image model, so when you start a generation request the image is transmitted for processing to the model service we use for that purpose — currently ByteDance Seedream 5.0 Pro. We require by contract that it be processed solely to complete that generation, not retained beyond what that requires, and not used for any other purpose. This processing step is technically necessary to provide generation at all; beyond it, there is no outbound transfer of your images. As the Service evolves we may add, change, or replace the models and model service providers we use, and will update this Policy accordingly.

4.4 Never used for model training

We do not, and do not permit any third party to, use the images you upload to train, fine-tune, or improve AI models. Your images do not enter any training dataset and are not used to build facial models or feature databases. There is no exception to this, and you do not need to configure anything or opt out.

4.5 You can delete them at any time

You can delete uploaded selfies and generated results from your account. After deletion we remove them from production systems within a reasonable period, and backup copies are overwritten on our established backup cycle. When you close your account, your images are deleted along with it.

5. How Information Is Shared

We do not sell personal information and do not make it available for third parties' independent purposes. To operate the Service, we share the minimum information necessary for each provider to perform its function, in these categories:

• authentication and account services;
• payment, subscription, and billing processing;
• cloud storage, content hosting, and infrastructure;
• AI content generation and processing services;
• email delivery and notifications;
• messaging channel services such as Telegram;
• usage analytics, security monitoring, and abuse prevention;
• customer support tooling.

These providers may process information only as necessary to provide services to us, are bound by written contract, and are expressly prohibited from using the information for their own purposes or for model training.

We may also disclose information where required by law, judicial or regulatory process, or where necessary to protect our or our users' lawful interests and to investigate violations and security incidents. If we are involved in a merger, reorganization, or asset transfer, information may transfer as part of that transaction, and we will ensure the recipient continues to honor protections materially equivalent to this Policy.

6. International Transfers

We serve creators worldwide, and the providers described above may be located outside your country or region. This means your information may be transferred to, processed in, and stored in other jurisdictions. We take appropriate measures so that transferred information continues to receive protection comparable to this Policy.

7. Data Retention

We retain information based on operational, security, support, and legal needs:

• account information is retained for as long as your account exists;
• uploaded images, generated content, and creation history are retained until you delete them or close your account, so that we can provide your history;
• order and billing records are retained as required by applicable tax and accounting rules;
• logs and security records are retained for a limited period for troubleshooting and abuse prevention.

After you close your account, we delete or anonymize your personal information, except where retention is required for security, fraud prevention, tax, accounting, dispute resolution, or other legal compliance purposes.

8. Security

We apply technical and organizational measures proportionate to the risk, including encryption in transit (HTTPS), encryption at rest, per-account data boundaries, access controls, credential and key management, and monitoring for anomalous access. Please understand that no method of internet transmission or storage can be guaranteed absolutely secure.

9. Your Rights

Subject to applicable law, you may:

• access the personal information in your account or obtain a copy of it;
• correct inaccurate account information;
• delete the images you uploaded, your generated content, or your account;
• request an export of account-related information;
• object to or restrict certain processing, and withdraw consent you previously gave (withdrawal does not affect processing carried out before withdrawal);
• lodge a complaint about our processing activities.

You can do most of this from your account settings, or send us a request using the contact details in Section 12. We respond within the timeframes required by applicable law. Some information may need to be retained for security, fraud prevention, tax, accounting, dispute resolution, or other legal compliance purposes.

10. Age Requirement

The Service is intended for users aged 18 and over. We do not offer the Service to minors and do not knowingly collect personal information from minors. If we determine that an account was registered by someone under 18, we will terminate the account and delete the associated information. If you believe a minor has provided us with information, please contact us using the details in Section 12 and we will address it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised last-updated date. For material changes, we will provide additional notice, such as an in-product message or an email.

12. Contact Us

If you have questions, requests, or complaints about this Privacy Policy or our data practices, contact us at:

support@starsmith.ai

13. Legal Bases for Processing

If you are located in the European Economic Area, the United Kingdom, or a region with similar requirements, our legal bases for processing your information include: performance of our service agreement with you (providing generation, account, and subscription features); compliance with legal obligations; our legitimate interests in securing the Service and preventing abuse; and your consent where required — uploading a selfie of yourself for image generation is processed on the basis of your explicit consent, and you may withdraw that consent and delete the relevant images at any time.