Privacy policy
Last updated 3 October 2026
This policy explains what personal data [Legal name of your business] collects when you use Fresko, why, and the choices you have. We are the data controller (“data fiduciary” under India's Digital Personal Data Protection Act, 2023).
What we collect
- Account data: your email address and login records.
- Your files: images you upload, the prompts and options you choose, and the renders, videos and 3D models you create.
- Billing data: your plan, credit balance and purchase history, plus the payment and subscription IDs our payment providers send us. We never see or store your full card or bank details.
- Technical data: IP address, approximate country (to show prices in the right currency), browser type and basic logs needed to keep the Service secure.
Why we use it
- To run the Service: log you in, process your images, store your results and keep your credit balance (performing our contract with you).
- To take payments and meet tax and accounting duties (legal obligation).
- To prevent abuse and fix problems (legitimate interests).
- To send you service emails, such as login links and receipts. We will only send marketing emails if you agree, and you can unsubscribe any time.
We do not sell your personal data, and we do not use your files to train AI models.
Who we share it with
We use trusted service providers who process data for us under contract:
- Supabase — login, database and file storage.
- fal.ai — runs the AI models; receives the image and prompt for each job you start.
- Razorpay — payments in India.
- Paddle.com — payments outside India. Paddle is the merchant of record for those orders and handles your payment data under its own privacy policy.
- Vercel — website hosting.
- [Email delivery provider, if different from Supabase]
We may also disclose data if the law requires it, or to protect our users and the Service.
International transfers
We are based in India and our providers may process data in India, the United States, the European Union and other countries. Where the law requires it, we rely on safeguards such as standard contractual clauses.
How long we keep it
- Account data and files: while your account is open. When you delete your account, we delete your files within [30] days.
- Billing records: as long as tax law requires (in India, generally 8 years).
- Logs: up to [90] days.
Cookies
We only use cookies the Service needs: one to keep you logged in, and one to remember your chosen currency. We do not use advertising cookies. Our payment providers set their own cookies on their checkout pages.
Your rights
Depending on where you live (including under the GDPR, UK GDPR, India's DPDP Act and US state laws), you can ask to access, correct, delete or export your personal data, object to or restrict some uses, and withdraw consent. Email us at [support@yourdomain.com] and we will reply within 30 days. You can also complain to your local data protection authority, or in India to our grievance officer: [name, [support@yourdomain.com]].
Security
Your files are kept in private storage and are only shared through short-lived links. Payments are handled by PCI-DSS compliant providers. No system is perfectly secure, but we take reasonable steps to protect your data and will tell you about a breach where the law requires it.
Children
The Service is for professionals and is not meant for anyone under 18.
Changes
We will post any changes here and, if they are significant, tell you by email before they apply.
Contact
[Legal name of your business], [Registered address], Mumbai, Maharashtra, India. Email: [support@yourdomain.com]