Privacy Policy

For the purposes of applicable privacy law, the data controller is Easy Content Studio Ltd, Sofia, Bulgaria. In this policy, “we,” “us,” and “our” refer to Easy Content Studio and the company that operates it.

If you have privacy questions, requests, or complaints, you can contact us at [email protected]. If your request relates to general legal or commercial matters, you may also contact [email protected].

Depending on how you use the service, we may collect the following categories of data:

• Account data: name, email address, password credentials or third-party sign-in identifiers, billing profile details, and account preferences.
• Subscription and billing data: plan selection, billing country, invoice details, VAT or tax-related information where required, and payment status details supplied by our payment provider.
• Usage data: projects, folders, generation history, image limit events, feature usage, support requests, and account activity needed to operate the service.
• Technical data: IP address, device and browser information, approximate geolocation derived from network information, log files, first-party visitor security identifiers, and security signals used to detect misuse, including browser, device, network, and anti-bot verification signals collected on sensitive forms.
• Communication data: messages you send to us, replies from our team, transactional email interactions, and records of consent choices such as cookie preferences.

When you upload product images to Easy Content Studio, we process those files so we can generate improved product images for your account. Uploaded images, generated outputs, and related metadata such as file size, resolution, timestamps, or generation settings may be stored as part of providing the service.

You should avoid uploading personal data that is not necessary for your use case. If an uploaded image contains a person, embedded metadata, labels, or other personal information, that information may also be processed as part of the image workflow.

We do not use your uploaded or generated images to train general-purpose AI models for third parties. We use them only to run, maintain, secure, troubleshoot, and improve the service for your account and our platform operations.

We use personal data to operate and improve the service, including to:

• create and administer user accounts;
• process uploads, run AI image generation, and deliver generated outputs;
• manage subscriptions, billing events, invoices, taxes, and fraud prevention;
• provide customer support, account notifications, and service communications;
• measure service performance, monitor reliability, and improve product quality;
• protect the platform, run security verification and abuse-prevention checks on sensitive forms, enforce our terms, investigate abuse, and comply with legal obligations.

Where required by law, we rely on one or more legal bases such as contract performance, legitimate interests, consent, compliance with legal obligations, and, where applicable, the establishment, exercise, or defense of legal claims.

Our service relies on third-party AI and infrastructure providers to process requests and return results. This includes providers used to run image generation or related workflows, such as Google services used in connection with the Gemini image pipeline.

These providers process data on our behalf or under their own applicable service terms to the extent needed to deliver the feature. We limit the data we send to what is reasonably necessary for the request, and we select providers that offer contractual or technical safeguards appropriate for commercial use.

Images generated through the service are produced using AI. For information about AI transparency and your disclosure responsibilities when publishing, see our Terms of Service.

Payments for paid subscriptions may be processed by third-party payment providers such as Stripe. We do not store full payment card numbers on our own systems.

We may receive limited billing information from our payment providers, such as payment status, billing name, country, tax-related invoice details, subscription identifiers, and the last four digits of a card where relevant for support or records.

We may send service-related messages by email, such as account verification or confirmation, password reset, billing confirmations, renewal notices, invoice delivery, administrative messages, account or security notifications, and important policy updates.

If we send optional product or marketing communications, we will do so only where permitted by law and, where required, with your consent or another valid legal basis. You can opt out of non-essential marketing emails through the unsubscribe link or by contacting us.

We use a mix of necessary cookies and non-cookie browser storage to operate the public website and the authenticated application. This includes our CookieConsent preference cookie, the sidebar:state cookie used in the app interface, a secure HttpOnly session cookie used for authenticated access when cookie auth is enabled, a first-party HttpOnly visitor security cookie used to detect repeated trial abuse, local storage items used for non-sensitive hints and preferences such as ecs_session_hint and language selection, and necessary security verification technologies such as Cloudflare Turnstile on certain sign-in, sign-up, and password reset request forms.

We use Google Analytics 4 only after you consent to the optional analytics category. Its purpose is to understand website and application usage, performance, navigation, and feature adoption. Refusing consent does not prevent use of the core service, and you can withdraw it at any time through Cookie Settings or Cookie Preferences in the app.

Analytics may process page visits, consented product events, device and browser information, approximate geographic information, referrer information, consent state, and pseudonymous online identifiers. We do not intentionally send names, email addresses, prompts, image content, filenames, image URLs, storage keys, authentication credentials, or verification and reset tokens to Analytics.

The legal basis for this optional processing is consent. The service provider under the current Bulgarian standard Analytics terms is Google Ireland Limited. Google and its subprocessors may process data outside the EEA under the applicable Google data-processing terms and transfer safeguards, including Standard Contractual Clauses where required. The exact contracting terms and safeguards applicable to our GA4 account must be confirmed by the account owner and reviewed periodically.

GA4 user-level and event-level data is intended to be retained for 14 months. This statement depends on the production property being configured accordingly before collection begins. See our Cookie Policy for cookie durations and preference controls.

We share data with trusted service providers only when necessary to run the service. Depending on your usage, this may include providers for hosting, storage, authentication, email delivery, analytics, payment processing, security monitoring and abuse prevention, including Cloudflare Turnstile, and AI-powered image generation.

We do not sell your personal data in the ordinary meaning of that term. If privacy law in your jurisdiction treats certain analytics or advertising disclosures differently, we will honor applicable opt-out or consent requirements.

Because we use global service providers, your personal data may be processed outside your home jurisdiction, including outside the European Economic Area, the United Kingdom, the United States, or Canada.

Where required, we use recognized safeguards for cross-border transfers, such as contractual protections, Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful transfer mechanisms recognized by applicable privacy law.

We keep personal data for as long as necessary to provide the service, maintain your account, comply with legal obligations, resolve disputes, enforce agreements, and protect the platform.

In general:

• account and project data are retained while your account remains active;
• uploaded and generated images are retained until you delete them, your account is deleted, or operational retention windows expire;
• billing and tax records may be retained longer where required by accounting or tax law;
• security, abuse-prevention, and backup records may persist for a limited period after deletion.
• GA4 user-level and event-level data is retained for 14 months when the production property is configured as intended.

When you request account deletion, we aim to delete or anonymize the relevant personal data within a reasonable operational period, typically within 30 days, unless a longer retention period is required by law or necessary for security, fraud prevention, or legal claims.

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal data, and to receive a portable copy of certain data. You may also have the right to withdraw consent where we rely on consent.

If you are located in the EU or UK, these rights may include GDPR-style rights of access, rectification, erasure, restriction, portability, and objection. If you are located in certain US states or in Canada, you may also have rights under local law to request access to or correction of personal data, or to challenge certain uses.

To exercise your rights, contact [email protected]. We may need to verify your identity before fulfilling the request. If you are unhappy with our response, you may contact the competent supervisory authority, including the Bulgarian Commission for Personal Data Protection where applicable.

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, disclosure, or alteration. These measures may include access controls, encrypted transport, audit logging, provider security controls, rate limiting, abuse-prevention checks, hashed IP and visitor-security signals, and internal permission restrictions.

On sensitive forms such as sign-up, sign-in, and password reset requests, we may use Cloudflare Turnstile to process signals such as IP address, user-agent data, sitekey and origin context, and browser, device, or TLS-related anti-bot signals in order to distinguish legitimate users from automated abuse. In our current setup, the widget is used with server-side token validation rather than Cloudflare pre-clearance cookies by default. You can read more in Cloudflare's Turnstile Privacy Addendum.

No service is completely secure, and we cannot guarantee absolute security. You are also responsible for maintaining the confidentiality of your account credentials and notifying us promptly if you suspect unauthorized access.

Easy Content Studio is a business tool intended for sellers, merchants and other commercial users. The service is not directed at children and we do not knowingly collect personal data from children.

You must be at least 18 years old, or the age of majority in your country, to create an account and use the service.

If you belive a child has provided us with personal data, please contact us at [email protected] and we will take reasonable steps to delete it.

We may update this Privacy Policy from time to time to reflect changes to the service, our providers, applicable law, or our data practices. When we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice through the website, the application, or email.

Easy Content Studio Ltd, Sofia, Bulgaria

• Legal questions: [email protected]
• Privacy questions: [email protected]
• Anything else: [email protected]