Privacy Policy
Last updated: [Date you publish this]
This policy explains what personal data Muselight collects, why, who we share it with and your rights. Muselight is run by [Your full legal name], a sole trader in the United Kingdom, who is the data controller for the personal data described here. Contact: [email protected], [Your business address].
1. What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account details | Email address, password (stored only as a secure hash), and the name and profile picture from Google, X or Telegram if you sign in with them | You, or the sign-in service you choose |
| Purchase records | The amount, date, country, currency and transaction number of each top-up | Paddle, our payment provider |
| Your content | Prompts, settings, files you upload and the results generated | You, and the AI models you use |
| Usage and balance | Which models you run, what each run cost, your balance and run history | The Service |
| Technical data | IP address, browser and device type, and logs of requests, used for security and to fix problems | Your device |
| Support messages | Anything you send us by email | You |
We don't collect your full card details: Paddle handles payment and only shares the purchase records above with us.
2. Why we use it, and our lawful basis
- To provide the Service (create your account, run models, keep your balance and history): necessary for our contract with you.
- To keep Muselight secure (preventing fraud, abuse and misuse of payment cards, and enforcing our Acceptable Use Policy): our legitimate interests in protecting you, us and other users.
- To keep records we must keep by law (such as tax records): legal obligation.
- To answer you and improve the Service: our legitimate interests.
- To send product news or offers: only if you've opted in, and you can opt out at any time.
3. Who we share it with
We only share personal data with companies that help us run Muselight, under contracts that require them to protect it, or where the law requires us to.
| Who | What for |
|---|---|
| AI model providers (for example fal, Atlas Cloud, Kling, Google, ByteDance) | Your prompt, settings and uploaded files are sent to the provider that runs the model you choose, so it can generate your result. They process them under their own terms and data policies. |
| Paddle | Payment processing. Paddle is the merchant of record for your purchases and is an independent controller of the data you give it at checkout. |
| Supabase | Account sign-in and authentication. |
| Railway and Cloudflare | Hosting the Service and website, and protecting them from attacks. |
| Google, X and Telegram | Only if you choose to sign in with them. |
| Authorities | Where the law requires it, for example to report child sexual abuse material. |
We don't sell your personal data, and we don't use your content to train AI models.
4. International transfers
Some of these companies store or process data outside the UK, including in the United States and the European Union. Where they do, we rely on adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
5. How long we keep it
- Account details, balance and run history: while your account is open, and for up to 12 months after you close it, then deleted.
- Purchase records: 6 years, as UK tax law requires.
- Security logs: up to 90 days.
- Generated results are stored as links by the model providers; we stop showing them when you delete them or close your account.
6. Your rights
Under UK data protection law you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; and give you your data in a portable format. You can also withdraw consent you've given at any time. Email [email protected]; we'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, though we'd appreciate the chance to put it right first.
7. Security
Connections are encrypted, passwords are stored only as secure hashes by our sign-in provider, and access to data is limited to what's needed to run the Service. No system is perfectly secure, so please use a strong, unique password.
8. Children
Muselight is for people aged 18 and over. We don't knowingly collect data from children. If you think a child has created an account, please tell us and we'll delete it.
9. Cookies
We only use cookies and similar storage that the Service needs to work. See our Cookie Policy.
10. Changes
We'll update this policy if what we do changes, and tell you about significant changes by email or in the app.