Privacy Notice

This Privacy Notice explains how Oblicuo ("Oblicuo", "we", "us", or "our") collects, uses, and shares personal data when you use our website, applications, and services (the "Service"). Oblicuo is the data controller for the personal data described here.

1. Personal data we collect

• Account data: name, email address, hashed password or authentication provider identifier (e.g., Google sign-in).
• Profile and workspace data: display name, organization, preferences, and profile settings you provide.
• Project data: projects, designs, materials, plans, uploaded reference images, prompts, and AI-generated outputs you create in the Service.
• Support communications: messages you send to us, including via email or in-app forms.
• Usage and telemetry data: device and browser information, IP address, event logs (such as sign-ins, feature usage, AI job status), and error diagnostics.
• Billing metadata: subscription plan, credit balance, and payment status. Card and bank details are collected and processed directly by Paddle and are not stored on our systems.
• Cookies and similar technologies: essential cookies and local storage used for authentication and session state, plus limited analytics data (see section 8).

2. How we use personal data

• To provide the Service — create and manage your account, run AI renders and plans, save projects, and enforce plan and credit limits.
• To operate billing — link your subscription to your account and reflect entitlement changes from Paddle.
• To secure the Service — detect and prevent abuse, fraud, and security incidents.
• To improve the Service — analyze aggregate usage, debug errors, and improve model prompts and features.
• To provide support — respond to your questions and requests.
• To send service and, where permitted, marketing communications — you can opt out of marketing messages at any time.

3. Legal bases

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — providing the Service and processing your subscription.
• Legitimate interests — securing the Service, preventing fraud, improving features, and analyzing usage in an aggregated way.
• Consent — for optional analytics or marketing cookies, and for other processing where consent is required. You can withdraw consent at any time.
• Legal obligation — to comply with applicable laws, tax obligations, and lawful requests.

4. How we share personal data

We share personal data with the following categories of recipients:

• Service providers and subprocessors — hosting, database, storage, analytics, error monitoring, email, and support tooling providers acting on our instructions.
• Merchant of Record — Paddle — Paddle is the Merchant of Record for our sales and receives the data necessary to sell subscriptions and one-off purchases, manage subscriptions, take payments, calculate and remit taxes, issue invoices, and handle refunds.
• AI model and infrastructure providers — Inputs (prompts, images, project data) needed to generate Outputs are sent to model providers that process them on our behalf.
• Professional advisers — legal, accounting, and audit advisers, under confidentiality.
• Authorities — when required by law, court order, or to protect rights, property, or safety.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality.

We do not sell personal data.

5. International transfers

Some of our providers may process personal data outside the country where you live, including outside the UK or EEA. Where we transfer personal data internationally, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

6. Retention

• Account and profile data: kept for as long as your account is active and for a reasonable period after deletion for legal, tax, and fraud-prevention purposes.
• Project data: kept while your account exists, then deleted or anonymized after account deletion (typical window: 30 days), subject to backups that cycle out.
• Billing metadata: retained for the period required by applicable tax and accounting law.
• Security and event logs: retained for a limited period sufficient to investigate incidents.

Where personal data is no longer needed, we delete or anonymize it.

7. Your rights

Depending on where you live, you may have rights over your personal data, including the right to access, rectify, erase, restrict, or object to processing, the right to data portability, and the right to withdraw consent. Where GDPR or UK GDPR applies, you also have the right to lodge a complaint with your local supervisory authority. We aim to respond to verified requests within one month.

You can exercise your rights by emailing privacy@oblicuo.ai.

8. Cookies

• Essential: required for authentication, session state, and security. These cannot be disabled without breaking core functionality.
• Analytics: used in aggregate to understand feature usage and improve the Service.
• Payment provider cookies: Paddle may set cookies on checkout pages to operate the payment flow securely.

You can manage cookies through your browser settings.

9. Security

We use appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls, and least-privilege administration of production systems. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.

10. Children

The Service is not directed to children under the age of 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

11. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be reflected here with a new "Last updated" date and, where appropriate, additional notice.

12. Contact

For questions about this notice or your personal data, contact us at privacy@oblicuo.ai.