Privacy policy
Last updated September 2026.
What we collect
Account information
Your name, email address and password (stored hashed, never in readable form). If you sign in with Google, we receive your name and email address from Google.
Store information
Whatever you put into your storefront: logo, colours, page copy, artwork, titles, descriptions, tags, prices and your domain name.
Generation data
The prompts you write, the model and settings you chose, the images produced, and the credits spent. Prompts are stored so you can find and reuse them.
Order data
Orders placed through your storefront, including your customers' names, email and delivery addresses. We process this on your behalf so that you can fulfil the order.
Technical data
IP address, browser type, referring page and pages visited. We use this for security, for diagnosing faults and for the visitor statistics shown in your dashboard.
Payment data
We do not store card numbers. Payments are handled by Stripe, which processes card details directly under its own privacy policy. We receive only confirmation of payment and the associated account reference.
Why we use it
- To run your account and your storefront.
- To generate images and to bill credits accurately.
- To process payments and deliver orders.
- To provide support when you contact us.
- To keep the service secure and detect abuse.
- To send service messages such as email confirmation and order notifications.
We do not sell your personal data, and we do not sell your customers' data.
Who we share it with
AI model providers
When you generate an image, your prompt and generation settings are sent to the provider whose model you selected — for example OpenAI, Google, Stability AI, Black Forest Labs, Midjourney via PiAPI, Ideogram, Replicate, fal.ai or xAI. Your name, email address and account details are not sent. Each provider handles that data under its own privacy policy, and some may retain prompts for abuse monitoring.
Payment processors
Stripe, for credit purchases and storefront checkout.
Email delivery
Our email provider, for account emails, order notifications and replies to contact form messages.
Hosting and infrastructure
Our hosting provider, which stores the data needed to run the service.
Legal
We may disclose data where required by law, or to protect the rights and safety of users and the public.
Cookies
We use cookies to keep you signed in, to remember shopping cart contents across pages, and to identify which storefront a visitor is browsing. These are necessary for the service to function. Blocking them will break sign-in and checkout.
How long we keep it
- Account and store data — while your account is open.
- Artwork and prompts — until you delete them or close your account.
- Order records — retained after account closure where tax or accounting rules require it.
- Technical logs — a limited period for security and diagnostics.
Ask us to close your account and we will delete your personal data other than what we are legally required to keep.
Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you.
- Correct data that is wrong.
- Request deletion of your data.
- Receive an export of your data.
- Object to or restrict certain processing.
- Complain to your local data protection authority.
To exercise any of these, email admin@artcart.ai. We will respond within the period the applicable law requires.
If you run a storefront
When your customers buy from you, you are the controller of their data and we process it on your behalf. That means you are responsible for your own privacy notice, for handling your customers' data requests, and for meeting the privacy obligations that apply where you and they are located.
Security
Passwords are hashed. Traffic is encrypted in transit. Provider API credentials are encrypted at rest and are never exposed to browsers. No system is perfectly secure, but we take reasonable measures and will notify affected users promptly if a breach occurs.
Children
The service is not intended for children. We do not knowingly collect data from anyone under the age at which they can consent in their own country.
International transfers
Our providers may process data in countries other than your own, including the United States. Where required, appropriate safeguards are in place.
Changes
We will update this policy as the service develops, and will notify material changes through the service or by email.
Contact
Privacy questions: admin@artcart.ai, or the contact form.
See also our terms of service.