Privacy Policy — Changelog

Privacy Policy changelog

Link to Privacy Policy changelog

This page tracks material changes to the Privacy Policy. Minor edits (typo fixes, link corrections, date refreshes) are reflected in the "Last modified" field on the main page and are not separately listed here.

v2.8 — 2026-09-30 — Parallel safety checks and withheld outputs

Link to v2.8 — 2026-09-30 — Parallel safety checks and withheld outputs

§3.4, §7 and §16 explain that automated moderation and safety classification can run alongside the generation provider, and that withholding an Output does not mean the provider did not receive the request. §8 describes private output retention during review. Generation charges and wallet credits are governed by Terms §6.1. The v2.7 clarification about processor agreements is retained.

v2.7 — 2026-09-27 — Withdrawing an unsupported statement about DPAs

Link to v2.7 — 2026-09-27 — Withdrawing an unsupported statement about DPAs

§6 said we maintain "signed Data Processing Agreements with every processor, executed before any user data is processed by that service". Our own processor register did not support that sentence for every processor — in particular it does not record an agreement on file for the AI inference routing partners — so the sentence is withdrawn rather than left standing.

§6 now says what the DPA column actually is: where it links a document, that is the provider's published data processing terms, not a statement that a separately signed copy exists. For the routing partners, and any processor without a linked DPA, we are confirming which written terms govern the processing. You can ask us which terms apply to a given processor, and supervisory authorities can still obtain copies of the agreements that apply on lawful request.

Nothing about what data we collect, who receives it, or where it goes has changed.

v2.6 — 2026-08-05 — Correcting how generation requests are actually routed

Link to v2.6 — 2026-08-05 — Correcting how generation requests are actually routed

§5.1 said Artifio "forwards to the provider you selected". That described a direct hop to the model provider, and it is not what happens. Most generations pass through an AI inference routing partner — a specialist infrastructure company that holds the commercial relationship with the model provider and relays the request on our behalf. The real path is:

you → Artifio → an inference routing partner → the model provider in §5.2

Those partners receive exactly what §5.1 already listed — prompt text, uploaded media by URL, generation settings and a request identifier — and nothing else. No email, no name, no IP, no payment details. What changed is our description of where that data goes, not what we send.

§6 now carries a matching processor-table row so the recipients appear where a reviewer looks for them.

On naming them. Our routing partners' identities are commercially confidential and we do not publish them. If you are a data subject exercising your rights, a customer carrying out due diligence, or a supervisory authority, write to privacy@artifio.ai and we will name them, with locations and transfer mechanism, within the §2 response times. We treat that as a request we must answer, not one we may decline.

§6 also used to say we were "expanding this list to name every inference provider individually". Given the above we are not, so the sentence is withdrawn rather than left standing as a promise we do not intend to keep.

v2.5 — 2026-08-05 — Stale placeholders replaced with the true position

Link to v2.5 — 2026-08-05 — Stale placeholders replaced with the true position

Four rows in the §2 contact table said the Data Protection Officer, the GDPR Art. 27 EU Representative, the UK Representative and the DSA EU Legal Representative were "to be appointed before launch". This policy took effect on 2026-05-27. The sentence had therefore been false for over two months, and nobody noticed, because a placeholder written during drafting reads exactly like ordinary prose once the document goes live.

Those rows now say plainly that none of the four has been appointed, and give the address that reaches a human today. No right described in this policy changed — every request is exercisable at the same addresses on the same response times. A missing representative is our compliance gap, not a reduction in what you can ask for.

§5.4 had two similar entries: xAI (Grok) and Midjourney were listed with "confirm current stance" — an internal to-do published as if it were an answer. Both now state that we have not confirmed a no-training default for those providers, so you should assume inputs may be retained and used. That is the conservative reading and it is the one you can act on.

A build guard (scripts/check-legal-appointments.mjs) now fails the build if any placeholder phrase survives past a policy's effective date, or if the text ever claims an appointment that has not actually been made.

v2.4 — 2026-07-13 — Controller identification: brand-forward, entity on request

Link to v2.4 — 2026-07-13 — Controller identification: brand-forward, entity on request

The data controller is still fully identifiable, as GDPR/CCPA require — the change is only how the controller is presented. §1 and the §2 contact table now identify the controller as Artifio.ai, a Texas company, with full legal-entity details available on request at privacy@artifio.ai. The prior text named the parent entity's registered name inline; that detail moves to on-request disclosure. No processors, data categories, retention periods, or user rights changed.

v2.3 — 2026-06-23 — Upload-agreement audit log disclosed

Link to v2.3 — 2026-06-23 — Upload-agreement audit log disclosed

Discloses a new category of proof-of-consent data we now collect: the just-in-time "Media upload agreement" captured the first time a user uploads media for a generation (and on any version bump). §3.4 documents the affirmation and what we record (version, truncated IP, user-agent, approximate region); the §8 retention table adds the "Upload-agreement audit log" row (7-year retention, append-only, deleted with the account).

No new processors and no behavioural change to existing consent prompts.

v2.2 — 2026-05-17 — PostHog autocapture named explicitly (post-merge audit)

Link to v2.2 — 2026-05-17 — PostHog autocapture named explicitly (post-merge audit)

Post-merge audit (2026-05-17) of the v2.1 changes called out that the §3.2 row covering usage events did not name PostHog's autocapture SDK feature, which captures clicks + form submits + scroll depth + rage/dead clicks automatically once consent is granted. The data classes were already disclosed in aggregate ("Usage events: pages viewed, clicks, scroll depth, rage/dead clicks"), but naming the specific SDK feature is the gold-standard disclosure pattern under GDPR Art. 13 (right to know how data is collected).

Change: §3.2 row now reads "captured via PostHog's autocapture feature on the post-consent client" with form submits added to the visible-event list.

No new data classes, no new processors, no behavioural change to consent prompts.

v2.1 — 2026-05-17 — Lead attribution + Vercel observability disclosures

Link to v2.1 — 2026-05-17 — Lead attribution + Vercel observability disclosures

Two new categories of automatic data collection shipped in May 2026 and are now explicitly disclosed:

• §3.2 — Lead-source attribution. UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the first landing-page path, and the HTTP referrer are now captured at first touch to attribute the user-acquisition channel. Captured ONCE per user (never overwritten); requires consent in EU/UK/Brazil, legitimate- interest basis for US visitors. Server-derived first-touch country (from the IP) and first-touch device-type (from the user agent) are likewise enumerated.
• §3.2 + §6 — Vercel Analytics and Vercel Speed Insights. Two new sub-processors added to the processor table, both consent-gated. Vercel Analytics receives anonymous page-view + custom-event data; Vercel Speed Insights receives Core Web Vitals (LCP/FID/CLS/INP/TTFB) sampled per page-load. Both fire ONLY after a user accepts the analytics category in the cookie banner.
• §11 — Cookie list updated. _vercel_* cookies added to the Analytics row; the row's purpose now enumerates all three Core Web Vitals sinks (Sentry, PostHog, Vercel Speed Insights) and clarifies Vercel Analytics captures page views + custom events.

No behavioural changes to consent prompts, no rights changes, no processor removals.

v2.0 — Pre-launch rewrite

Link to v2.0 — Pre-launch rewrite

Comprehensive update to the Privacy Policy for the Artifio.ai launch. This version is a full rewrite of v1.0 (December 2024) and addresses every gap identified in the April-2026 compliance audit:

• Dollar-denominated wallet model. The previous "credits" terminology has been replaced throughout with Balance / Top-Up / Platform Fee language that matches the live product.
• Global compliance. GDPR, UK GDPR (as amended by the Data (Use and Access) Act 2025), LGPD (Brazil), CCPA / CPRA (California), TDPSA (Texas), and the analogous state privacy laws of 17 additional US states.
• EU AI Act Article 50. Transparency disclosure about AI generation, provenance marks (including C2PA), and the deepfake-disclosure duty that rests with the user.
• TAKE IT DOWN Act. Notice-and-takedown process for non-consensual intimate imagery, with a 48-hour removal commitment.
• DSA notice-and-action. Statement-of-reasons, appeal, and out-of-court-dispute-settlement rights for EU users.
• Global Privacy Control (GPC). Explicit recognition as a legally-binding opt-out for California, Colorado, Connecticut, Texas, Oregon, Montana, New Jersey, Delaware, New Hampshire, Maryland, Minnesota, and Nebraska residents.
• Complete processor list. Every third-party service that processes user data — Clerk, Neon, Upstash, Cloudflare R2 + CDN, Vercel, Dodo Payments, Stripe, Resend, PostHog, Sentry — named with data-sharing, location, and transfer-mechanism details.
• Full third-party AI provider list with data-training-opt-out status per provider.
• Automated decision-making disclosure per GDPR Article 22, UK GDPR, and LGPD Article 20.
• Data breach notification with jurisdiction-specific timelines (72h GDPR/UK, 3 working days LGPD, per-state US).
• Contact matrix. Nine dedicated email aliases (privacy@, copyright@, abuse@, dsa@, appeal@, billing@, security@, legal@, hello@) with published response times.

v1.0 — Initial version (December 2024)

Link to v1.0 — Initial version (December 2024)

Original Privacy Policy published with the Artifio.ai private beta. Superseded by v2.0.