Privacy Policy

1. Controller Information

"WebSight Group" Ltd. operates Free AI Generator and acts as data controller for personal data processed through the Service.

Bulgaria, Sofia, Manastirski Livadi, 11 Boyan Petrov St

Company Number (EIK/UIC): 208723539

Contact: contact@free-ai-generator.com

2. Data We Process

2.1 Account Data (if you sign in)

• Name, email, and profile identifiers received from your authentication provider (for example Google)
• Latest sign-in IP address and derived country code associated with your account (used for account security, abuse prevention, and aggregate analytics)
• Account preferences and usage history linked to your account

2.2 Billing Data (for paid plans)

• Subscription status, Stripe customer ID, invoice IDs, and billing events
• Receipt and payment status metadata
• We do not store full payment card details; payment processing is handled by Stripe

2.3 Content and Tool Data

• Prompts you submit to AI tools
• Images you upload for processing
• Generated outputs and related job metadata needed to deliver the service

2.4 Technical and Security Data

• IP address, hashed IP, request logs, error logs, and anti-abuse signals
• Browser- or device-derived identifiers, including a fingerprint-based identifier used to help detect abuse, repeated guest free-use attempts, and suspicious usage patterns
• Device, browser, and usage analytics information
• Cookie-related identifiers (essential and analytics)
• Automatic client-side error reports: when a JavaScript error or unhandled exception occurs in your browser while using the Service, we automatically collect technical diagnostic data including the error message, stack trace, source file reference, page URL, IP address, and browser identifier. This data is used solely to detect and fix technical issues and improve service reliability.

3. Why We Process Data (Legal Bases)

• Contract performance: to provide the Service, process tool requests, manage accounts, and support billing operations
• Legitimate interests: to secure, monitor, and improve the Service, prevent abuse, and maintain reliability — including automated decisions about eligibility for free credits or promotional benefits based on abuse-risk signals such as IP address characteristics and browser/device-derived identifiers used for security and guest protection
• Legal obligations: to comply with accounting, recordkeeping, and lawful authority requirements
• Consent where required: for analytics and similar non-essential tracking technologies

We do not sell your personal data to third parties. We share data only with the processors listed in Section 4, strictly to operate the Service.

4. Third-Party Processors and Recipients

We work with specialized providers to operate the Service, including:

• AI processing providers (for generation, editing, and description tasks)
• Stripe (payments and billing infrastructure)
• Google OAuth (authentication) and Google Analytics (usage analytics)
• Bunny.net / BunnyCDN (storage and delivery of uploaded images, generated outputs, and related media files)
• CDN and hosting providers (asset delivery and infrastructure)
• IP geolocation provider (used transiently to derive a country code from your sign-in IP; only the resulting country code is stored)

These providers process data under their own terms and privacy policies. We only share what is necessary for service operation, security, and legal compliance.

5. International Data Transfers

Our primary production infrastructure is hosted in the United States. If you are located in the EEA, the UK, or another jurisdiction with data transfer restrictions, your personal data will be transferred to and processed in the US as part of normal service operation. Additional transfers occur via the third-party processors listed in Section 4 (such as AI processing, analytics, and payment providers).

Where such transfers are subject to data protection requirements, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, and equivalent mechanisms where required under UK law, as the applicable transfer safeguards.

6. Retention

• Prompts, uploaded images, generated outputs, and tool job metadata (signed-in users): retained for the lifetime of your account and deleted or anonymized when you delete your account, subject to lawful exceptions for legal claims, abuse prevention, enforcement, or other overriding obligations.
• Guest usage records: guest-submitted files and generated outputs are deleted after 30 days. Some associated metadata is retained for analytics, abuse prevention, and enforcement purposes.
• Fingerprint-based security records: browser/device-derived identifiers used for guest protection and abuse prevention may be stored in cookies on your device for up to 365 days and in related server-side cache or security records typically for up to 30 days after use, subject to refresh on renewed activity and longer retention where reasonably necessary for fraud prevention, incident investigation, or enforcement.
• Security and abuse-prevention logs: typically retained for at least 90 days and, where reasonably necessary, longer for fraud prevention, incident investigation, or enforcement.
• Billing and accounting records: retained for at least 10 years where required by tax, accounting, or legal recordkeeping rules.

We do not promise automatic deletion of stored content on a short schedule. Retention decisions depend on the nature of the data, the purpose for which it was collected, operational necessity, legal requirements, and your rights under applicable law.

Uploaded source images and generated outputs are stored and delivered through our third-party storage and CDN provider infrastructure where needed to operate the Service.

7. Cookies and Tracking

We use essential cookies for core functionality and security. We also use analytics technologies (including Google Analytics via Google Tag Manager) to understand service usage and improve performance. Analytics cookies are only set after you give consent via the cookie banner.

When you use guest-enabled tool workflows, we may also create a browser/device-derived identifier and store it in the guest_fingerprint cookie, together with related server-side security records, to help enforce guest-use limits, detect abuse, and protect the Service. We do not use this identifier for advertising personalization.

You can control or delete cookies through your browser settings. Blocking essential cookies may prevent parts of the Service from working correctly.

Change my cookie preferences

8. AI Data Handling

Prompts and uploaded content are sent to third-party AI providers when needed to complete your request. Uploaded images and generated outputs may also be stored and delivered through third-party storage/CDN providers used to operate the Service. We do not claim ownership over your generated content.

In accordance with applicable transparency requirements under the EU AI Act (Article 50), we apply machine-readable AI-generation labeling to image outputs where technically feasible, using embedded metadata such as EXIF fields or format-specific tags. Coverage varies by output format and processing pipeline.

You remain solely responsible for the legality and use of content submitted to and produced by the Service.

9. Security

We use reasonable technical and organizational safeguards, including encrypted transport (HTTPS), access controls, and operational monitoring. No online service can guarantee absolute security.

10. Children's Privacy

The Service is intended for users aged 18 and older. We do not knowingly collect or process personal data from anyone under 18. If you believe we have received data from a minor, contact us at contact@free-ai-generator.com and we will delete it promptly.

11. Your Rights

Depending on applicable law (including GDPR and UK GDPR), you may have rights to access, rectify, erase, restrict processing, object, and request portability of your personal data, as well as to withdraw consent where processing is based on consent.

Automated decisions: Where we make automated decisions that significantly affect you — such as restricting eligibility for free credits based on abuse-risk signals — you have the right to request human review of that decision, express your view, and contest the outcome. To do so, contact us at contact@free-ai-generator.com.

Where you request erasure, we will review the request and delete or anonymize data where required by applicable law, subject to lawful exceptions such as recordkeeping duties, security, fraud prevention, claims handling, or other overriding legal grounds.

To exercise any of your rights, contact us at contact@free-ai-generator.com. You may also lodge a complaint with your local supervisory authority:

• Bulgaria (lead authority): Commission for Personal Data Protection (CPDP) — www.cpdp.bg
• UK users: Information Commissioner's Office (ICO) — ico.org.uk
• Other EU users: the supervisory authority in your country of residence

12. Changes to This Policy

We may update this Privacy Policy periodically. Updated versions are posted on this page with a revised "Last Updated" date. Continued use of the Service after updates means you accept the revised policy.