← Home

Privacy Policy

Last updated: 1 October 2026

§1. Data Controller

The controller of your personal data is Sparrowlabs sp. z o.o. (a Polish limited liability company), with its registered office in Warsaw, ul. Tadeusza Korzona 115/15, 03-571 Warsaw, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) kept by the District Court for the Capital City of Warsaw, 14th Commercial Division of the National Court Register, under KRS number 0001258379, NIP (tax identification number) 5243079518, REGON (statistical number) 545417991, share capital PLN 5,000.00 (hereinafter the "Controller" or the "Company"). Contact details of the Controller: aipixelfun@gmail.com.

§2. What Data We Collect

While using aipixel.fun, we may collect the following categories of data:

• Identification data: e-mail address and Google account identifier (sign-in via Google OAuth).
• User Content: prompts (text descriptions), image and video files uploaded to the Library, Assets, Video Studio, and as reference material for Generate.
• Generated Content: materials produced by AI based on User Content.
• Billing data: the history of purchased and used Credits, linked to payment transactions.
• Technical data: IP address, browser type, session identifier (managed by Supabase).

§3. Purpose and Legal Basis for Processing

• Providing the Service — maintaining the Account, storing User Content, generating and storing Generated Content. Legal basis: Article 6(1)(b) GDPR (performance of a contract).
• AI generation of materials — sending the prompt and reference files to a third-party AI provider (Siray) in order to generate the material requested by the User. Legal basis: Article 6(1)(b) GDPR (performance of a contract).
• Processing payments — handling the purchase of the Access Package and Top-ups via Stripe, issuing invoices. Legal basis: Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(c) GDPR (legal obligation — tax and accounting law). Stripe and the Service Provider may additionally process transaction data to prevent payment fraud and abuse — legal basis: Article 6(1)(f) GDPR (legitimate interest).
• Security and authentication — managing User sessions, protecting Accounts, detecting violations of §8 of the Terms of Service. Legal basis: Article 6(1)(f) GDPR (legitimate interest).

Providing an e-mail address (via Google sign-in) is a condition for entering into the agreement to provide the Service — without it, an Account cannot be created.

§4. User's Age

The Service is intended exclusively for persons who are at least 18 years old, in accordance with §3 of the Terms of Service. We do not knowingly process the data of persons under this age. If we learn that an Account has been created by a minor, we will promptly suspend it and delete the data associated with it.

§5. Recipients of Data

Your data may be shared with the following external entities, which process it on our behalf as processors:

• Supabase Inc. — provider of the database, authentication, and file storage. Servers located in the European Union. Privacy policy: supabase.com/privacy
• Vercel Inc. — provider of application hosting. Infrastructure in the EU and the USA (with appropriate data transfer safeguards). Privacy policy: vercel.com/legal/privacy-policy
• Siray — a third-party provider of image and video generation model APIs. Prompts and reference files uploaded by the User are sent to this provider solely to generate the requested material and only for tasks initiated by the User — they are never shared for any other purpose.
• Google LLC — the Google OAuth sign-in service (the only sign-in method). Data is processed in accordance with Google's privacy policy: policies.google.com/privacy
• Stripe Payments Europe, Ltd. (Ireland) and affiliated entities within the Stripe group — a payment services provider handling the purchase of the Access Package and Top-ups. Scope of data shared: data necessary to process payments and prevent fraud (including transaction identifier, amount, e-mail address); the User provides payment card details only to Stripe — the Service does not store them or have access to them. Privacy policy: stripe.com/privacy

We do not sell your personal data to third parties. Data is shared only to the extent necessary to provide the Service.

§6. Transfers of Data to Third Countries

Some of our subcontractors (including Siray, Vercel, and Stripe) may process data outside the European Economic Area (EEA). In such cases, the transfer takes place on the basis of an adequacy decision issued by the European Commission, standard contractual clauses (SCCs) approved by the European Commission, or other mechanisms compliant with the GDPR. In particular, Stripe may transfer data outside the EEA, including to the United States and India, on the basis of the European Commission's standard contractual clauses, and Stripe, LLC participates in the EU-U.S. Data Privacy Framework (in accordance with Stripe's privacy policy).

§7. Data Retention Period

• Account data (User Content, Generated Content, task history) — retained for as long as the Account exists, until it is deleted by the User or the Controller.
• Billing data (payment identifier, amount, date) — retained for 5 years from the end of the tax year in which the transaction took place, in accordance with tax and accounting law.
• Technical logs and session data — retained for 12 months from the date they are recorded.

After an Account is deleted, the remaining data is permanently erased from our systems promptly after the deletion is confirmed, subject to the periods indicated above.

§8. Your Rights

You have the following rights in connection with the processing of your personal data:

• The right of access — you may request a copy of the data we process about you.
• The right to rectification — you may correct inaccurate or incomplete data.
• The right to erasure ("the right to be forgotten") — you may request the deletion of your data in certain circumstances.
• The right to restriction of processing.
• The right to data portability.
• The right to object — you may object to the processing of your data carried out on the basis of a legitimate interest.

To exercise the above rights, please contact us at the address given in §1. You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych, UODO, the Polish data protection authority; ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

§9. Cookies and Local Data Storage

The Website uses only cookies that are necessary for the Service to function — session authentication (Supabase Auth). We do not use third-party tracking or advertising cookies.

We measure traffic on the Website without cookies and without storing anything on your device. Your IP address is used solely to compute, for a moment, an irreversible hash that changes every day, and it is not stored. We do store: the page visited, the entry source, an approximate location (country, region, city), the device type, the browser and the operating system, and for signed-in users also the link to the Account. We respect the “Do Not Track” (DNT) and Global Privacy Control (GPC) signals — when they are enabled we store nothing. We keep this data for up to 190 days. Legal basis: Article 6(1)(f) GDPR (the controller’s legitimate interest — analysing and developing the Website).

§10. Data Security

We apply appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS),
• Encryption of data at rest on the database side (Supabase),
• Row Level Security access-control policies within the database.

§11. Changes to This Privacy Policy

We reserve the right to amend this privacy policy. We will notify you of any material change at least 14 days in advance by e-mail to the address associated with your Account. The current version of this policy is always available at aipixel.fun/polityka-prywatnosci.

§12. Contact

If you have any questions about this privacy policy or the processing of your personal data, please contact us: aipixelfun@gmail.com.

Controller: Sparrowlabs sp. z o.o., ul. Tadeusza Korzona 115/15, 03-571 Warsaw, Poland, KRS 0001258379, NIP 5243079518.

← Terms of Service