Privacy notice

Version 1.1 · 13 November 2026

This explains what personal data EditPlug AI Studio collects, why, who it is shared with, how long it is kept, and your rights.

Who is responsible for your data

The controller is Praise Olu, a sole trader trading as EditPlug, of Door 71, William Murdoch, Aston Street, Birmingham, B4 7EH. For anything about your data, email editplugteam@gmail.com or use the contact page.

What we collect and why

Account details: name, email address and a securely hashed password (we cannot see your password). Used to create and run your account.
Sign-in and security records: session identifiers, IP address, browser type and, for admin accounts, two-step sign-in settings. Used to keep accounts secure and prevent abuse.
Your content: prompts, settings, uploaded reference images and generated results. Used to provide the service.
Billing records: plan, purchases, credit history, refund requests, payment references and your confirmation about the 14-day right to cancel. Card details are collected by Stripe and never reach us.
Safety records: when a prompt is blocked we keep the category and a one-way fingerprint of the prompt, not the prompt itself. We keep content reports and the outcome of reviews.
Support messages: what you send us and your email address.
Visit counts: daily totals of page views and referring websites. These contain no personal data.

We do not sell personal data. We do not use your content to train AI models.

Our legal bases

Contract: your account, content, generations and purchases, because we need them to provide the service you signed up for.
Legitimate interests: security, preventing fraud and abuse, safety checks, and improving the service using visit counts. We have balanced these against your rights; you can object (see “Your rights”).
Legal obligation: keeping tax and accounting records, and reporting illegal content where the law requires it.
Consent: optional analytics and advertising cookies, only if you choose Accept. You can withdraw consent at any time.

Who we share data with

We only share what each provider needs to do its job for us, under contracts that require them to protect it.

fal.ai (model provider, United States): your prompt, settings and any reference image, to create your result.
Stripe (payments, United Kingdom, Ireland and United States): your email address, purchases and payment details.
Oracle Cloud (hosting and database, United Kingdom region): everything the service stores runs on their servers.
Cloudflare (file storage and network, worldwide): your uploaded and generated files.
Resend (email delivery, United States): your email address and the emails we send you, such as sign-in links and receipts.
PostHog and Meta (analytics and advertising): only if you accept optional cookies. See “Cookies” below.
Authorities: where the law requires us to, for example to report child sexual abuse material.

Where a provider processes data outside the United Kingdom, we rely on the UK’s adequacy regulations (including the UK–US data bridge for certified companies) or on the UK International Data Transfer Agreement or Addendum to protect it.

How long we keep it

Your content: until you delete it or your account.
When you delete a generation, its file and prompt are deleted. A record of the credits used is kept.
When you delete your account, your files, prompts, sessions and sign-in details are deleted. Purchase and credit records are kept for 6 years from the end of the tax year they relate to, as UK tax law requires, and are no longer linked to your name or email.
Backups are kept for up to 30 days, then overwritten.
Support messages and refund requests: 2 years. Safety records and content reports: 2 years, or longer if needed for a legal claim or report.
fal.ai keeps inputs and results only as long as needed to run each request, under its own terms.

Your rights

Under UK data protection law you can ask to see, correct, delete or receive a copy of your data, object to some uses, ask us to restrict how we use it, and withdraw consent. Email editplugteam@gmail.com. We will reply within one month. You can delete your content and account yourself at any time from Settings. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk).

Cookies

Always on (strictly necessary): a sign-in cookie that keeps you signed in and protects your account, and a note in your browser that remembers your cookie choice. These cannot be switched off because the site does not work without them.

Visit counting without cookies: we count how many times each page is viewed and which site sent visitors to us, as daily totals. This uses no cookies and stores no IP address or anything that identifies you.

Optional, only if you accept: analytics cookies from PostHog (to understand how people use the studio, for example which steps they find confusing) and advertising cookies from Meta (to measure whether our ads on Instagram and Facebook work, and to show ads to people who visited). Nothing optional is used unless you choose Accept on the cookie banner.

You can change your mind at any time with Cookie settings at the bottom of every page.

Changes

We will update this notice when what we do changes, and email you about significant changes.