Privacy Policy

Business use only. AIST is intended for companies, agencies, freelancers, creators and other users acting for business, trade, craft or professional purposes.

Who we are

This Privacy Policy explains how AI STORYTELLING LIMITED ("AIST", "we", "us" or "our") collects and processes personal data in connection with AIST, including https://aistlabs.ai, the AIST web application, APIs, agent interfaces, Community and related services that link to this Policy (collectively, the "Service").

AI STORYTELLING LIMITED is a company incorporated in the Republic of Cyprus with registration number HE 467978, VAT number 60112489B and registered office at 25 Martiou, 27, D. Michael Tower, Flat/Office 105A, Egkomi, 2408, Nicosia, Cyprus. For personal data for which AIST determines the purposes and means of processing, AIST is the data controller. Contact us at support@aistlabs.ai.

Scope and business customers

The Service is designed for business and professional use. This Policy applies to visitors, account holders, Workspace members, freelancers, social media managers, representatives of customer organisations, people who communicate with us and individuals whose personal data is included in content processed through the Service.

For account, billing, security, analytics and direct customer-relationship data, AIST generally acts as controller. Where a business customer submits personal data in Customer Content and determines why and how that data is processed, the customer is the controller and AIST acts as its processor. In that situation, requests concerning Customer Content should normally be directed to the relevant customer, and a Data Processing Agreement may apply.

Personal data we collect

Account and Workspace data

We collect names, email addresses, login and authentication information, account identifiers, organisation and brand names, roles, permissions, Workspace membership, settings, billing contacts and any profile information you provide.

Brand, product and creative content

We process prompts, instructions, URLs, websites, brand information, Brand Brain data, logos, trademarks, product information, documents, images, videos, audio, music, voices, references, scripts, concepts, feedback, generated Outputs and related metadata. This content may contain personal data about you or other people.

Public-source information

At your direction, the Service may collect or analyse publicly available information from brand websites, social media pages, public advertisements and other URLs you provide or approve. This may include business contact details, brand names, usernames, public images and public posts. Public availability does not remove your responsibility to have a lawful purpose for using the information.

Payment and transaction data

We collect plan, purchase, invoice, tax, currency, payment status, transaction identifier, Credit allocation and usage information. Payments are processed by payment providers such as Stripe. AIST does not receive or store full payment-card numbers or card security codes.

Usage, device and technical data

We collect IP address, device and browser type, operating system, approximate location derived from IP, language, referral URL, pages and features used, clicks, session events, timestamps, generation identifiers, model selection, performance, errors, logs, API requests, agent activity, cookie identifiers and security events.

Communications

We collect information contained in support requests, emails, surveys, interviews, feedback and other communications, including attachments and contact details.

How we obtain personal data

We receive personal data:

• directly from you when you register, subscribe, upload content, create a Brand Brain, generate content, publish to Community or contact us;

• from your employer, client, Workspace owner or administrator when they invite or manage you;

• from public sources and URLs that you direct or authorise us to analyse;

• from payment, authentication, analytics, security and other service providers; and

• automatically through the Service, cookies, logs, APIs and connected tools.

Why we process personal data

Providing the Service

We use account information, Customer Content, Brand Brain data, prompts, Outputs, usage information and transaction data to create and manage accounts, maintain Workspaces, analyse brands and products, generate content, provide APIs and agents, allocate Credits, deliver requested features and store or export results. The legal basis is performance of our contract with you or steps taken at your request before entering into a contract.

Billing, tax and administration

We use billing, transaction and account information to process payments, issue invoices, administer Subscriptions and Credits, prevent duplicate charges, manage refunds, keep accounting records and comply with tax and financial obligations. The legal bases are contract, legal obligation and our legitimate interests in administering our business.

Security, integrity and abuse prevention

We use account, content, device, usage and log data to authenticate users, protect credentials, detect fraud and abuse, enforce our Terms, moderate prohibited content, investigate incidents and protect AIST, customers, providers and the public. The legal bases are legitimate interests, contract and legal obligation where applicable.

Support and communications

We use contact, account, content and technical information to answer requests, troubleshoot generations, restore Credits, provide service notices and communicate about the account. The legal bases are contract and legitimate interests.

Analytics and product improvement

We analyse usage, performance, errors and aggregated or de-identified information to understand how the Service is used, improve workflows, develop features, measure reliability and plan capacity. Depending on the data and jurisdiction, the legal basis is legitimate interests or consent.

Legal compliance and corporate transactions

We process data to respond to lawful requests, exercise or defend legal claims, comply with sanctions and other legal obligations, and evaluate or complete a financing, merger, acquisition, reorganisation or sale of assets. The legal bases are legal obligation and legitimate interests.

AI processing and model training

To provide requested creative features, AIST sends relevant Inputs and instructions to selected AI model and infrastructure providers. Depending on the feature, those Inputs may include text, images, video, audio, voices, brand information and technical parameters. Providers process the material to return the requested result, operate security and abuse controls and provide technical support.

AIST does not use Private Customer Content to train general-purpose generative AI models without a separate affirmative opt-in. We require AI service providers processing Private Customer Content for AIST to use it to provide and secure the contracted service, not to train general-purpose models. Providers may retain limited data where necessary for security, abuse prevention or legal compliance under the applicable business or API terms.

Using content at inference time to generate an Output, indexing or analysing it within your Workspace, creating a personalised Brand Brain, detecting policy violations, troubleshooting an error, or creating aggregated and de-identified technical metrics is not treated as training a general-purpose model.

Community, showcase pages and public information

Projects and Outputs are private by default. When you or an authorised Workspace user selects "Publish to Community", enables an auto-publish setting or takes a comparable publication action, AIST makes the selected content public and may automatically create a search-engine-indexable showcase page without a separate preview.

A public page may contain the Output, brand or account name, logo, website link, category, product details, tone of voice, creative objective, project description and a statement that the work was created with AIST. We may prepare contextual copy from information submitted to the Workspace and publicly available brand information.

Public information can be accessed, indexed, copied, saved, reposted or archived by other people, social platforms and search engines. Unpublishing removes the content from active Community display and triggers reasonable efforts to remove it from marketing channels under our control within 30 days, but it may remain in third-party copies, search caches, archives, completed campaigns and legally required records.

We process Public Content to fulfil the publication request, operate and moderate Community, promote AIST under the licence in the Terms of Service and pursue our legitimate interests in demonstrating and improving the Service. Where applicable law requires consent for a particular use, we rely on your affirmative publication action or a separate consent.

Google Analytics and cookies

The Service uses cookies and similar technologies. Strictly necessary technologies support authentication, security, fraud prevention, network management, payment processing and user preferences. These technologies are required for the Service to function.

We also use Google Analytics to measure visits, acquisition sources, navigation, feature use and technical performance. Google Analytics may process cookie identifiers, IP-derived location, device and browser information, referral information and interaction events. We use analytics cookies only after consent where consent is legally required, including in the European Economic Area and the United Kingdom.

You can accept, reject or change analytics-cookie choices through the cookie controls made available on the Service and can also use browser settings. Rejecting analytics cookies does not prevent access to core Service functions. We do not use Customer Content or Brand Brain material as Google Analytics event values.

How we share personal data

We may disclose personal data to the following recipients only as reasonably necessary for the purposes described in this Policy:

• AI model, generation and content-processing providers used to produce requested Outputs;

• cloud hosting, storage, content-delivery, database and infrastructure providers;

• authentication, email, communications, customer-support, monitoring and security providers;

• payment processors, including Stripe, and accounting, tax and invoicing providers;

• analytics providers, including Google Analytics, subject to applicable consent requirements;

• professional advisers, auditors, insurers, investors and transaction counterparties under appropriate confidentiality obligations;

• regulators, courts, law-enforcement bodies and other parties where disclosure is required by law or reasonably necessary to protect rights and safety; and

• the public, social networks, advertising platforms and distribution services when you publish Public Content or otherwise authorise public promotional use.

Workspace owners and administrators may access personal data, content and activity associated with their Workspace. If you join a customer Workspace, that customer's privacy practices also apply to its use of your information.

No sale of personal data

AIST does not sell personal data for money. We do not share Private Customer Content for third parties' independent cross-context behavioural advertising. Some privacy laws may define certain analytics or advertising-cookie disclosures as a "sale" or "sharing" even where no money changes hands. Where those laws apply, you may use our cookie controls or contact us to exercise an opt-out right. We will honour legally recognised browser-based opt-out signals where required.

International data transfers

AIST is established in Cyprus, but we and our providers may process personal data in other countries, including countries outside the European Economic Area. Where required, we use an adequacy decision, approved standard contractual clauses, the EU-US Data Privacy Framework where applicable, or another lawful transfer mechanism, together with supplementary safeguards appropriate to the transfer.

Data retention

We retain personal data for as long as reasonably necessary to provide the Service, maintain the account, fulfil the purposes described in this Policy, comply with law and resolve disputes.

Following a valid account-deletion request, personal data and Customer Content are scheduled for deletion from active systems within 30 days and may remain in routine backups for up to 90 days. Backup copies are isolated from ordinary use and are deleted or overwritten through normal backup cycles.

We may retain billing, invoice, tax, transaction, fraud-prevention, security and dispute records for longer periods required or permitted by law. We may retain de-identified information that cannot reasonably be linked back to a person. Public Content is subject to the unpublishing and third-party-copy limitations described above.

Security

We use reasonable technical and organisational measures designed to protect personal data, including access controls, tenant and Workspace separation, encryption in transit, monitoring, backups and restrictions on service-provider access. No system is completely secure, and we cannot guarantee absolute security. You are responsible for protecting account credentials, choosing appropriate Workspace permissions and avoiding unnecessary sensitive personal data in prompts and uploads.

Your privacy rights

Depending on your location and the circumstances, you may have the right to:

• request access to and a copy of personal data about you;

• request correction of inaccurate or incomplete data;

• request deletion or restriction of processing;

• object to processing based on legitimate interests or to direct marketing;

• receive certain data in a portable format;

• withdraw consent at any time, without affecting earlier lawful processing;

• opt out of certain sales, sharing or targeted advertising where applicable; and

• complain to a data protection authority.

To exercise a right, contact support@aistlabs.ai. We may ask for information reasonably necessary to verify identity, authority and the relevant account. An authorised agent may submit a request where permitted by law, subject to verification. We will not unlawfully discriminate against you for exercising a privacy right.

If AIST processes your data solely on behalf of a business customer, we may refer the request to that customer or assist it in responding. Individuals in the EEA may complain to their local supervisory authority or to the Office of the Commissioner for Personal Data Protection in Cyprus.

Automated processing

The Service uses automated systems to generate content, recommend creative options, moderate requests and detect technical or security issues. AIST does not use personal data to make solely automated decisions that produce legal or similarly significant effects about individuals, unless we provide a specific notice and a lawful basis for doing so.

Marketing communications

We may send service-related messages necessary for the account or Subscription. We may send product news or marketing communications where permitted by law. You can opt out of marketing email through the unsubscribe link or by contacting us, but you will continue to receive essential account, billing, security and legal notices.

Children

The Service is not intended for anyone under 18. We do not knowingly collect personal data directly from children as account users. Business customers must not permit minors to create accounts. If Customer Content depicts or concerns a minor, the customer is responsible for having a lawful basis, appropriate permissions and safeguards. Contact us if you believe a child has created an account or provided personal data directly to AIST without appropriate authority.

Third-party sites and services

The Service may link to or interoperate with third-party sites and services. Their independent processing is governed by their own privacy notices. This Policy does not apply to a third party acting for its own purposes, including a social network on which Public Content is posted.

Changes to this Policy

We may update this Policy as the Service, providers or law changes. We will post the updated version and revise the date above. If a change materially affects how we use personal data, we will provide additional notice or seek consent where required.

Contact

AI STORYTELLING LIMITED
Registration number: HE 467978
VAT number: 60112489B
Registered office: 25 Martiou, 27, D. Michael Tower, Flat/Office 105A, Egkomi, 2408, Nicosia, Cyprus
Email: support@aistlabs.ai
Website: https://aistlabs.ai