Data processed
Account data: the name and email address received when signing in with Google. On accounts created without an email, no name or email is collected; the record consists only of an identifier generated by the system.
Usage data: the record of the generations you run, the prompt text you send, the model and size you select, the credits spent, and the status and time of the generation.
Payment data: the amount and currency of the top-up, the payment status, the order id we generate, and the checkout address and expiry time returned by the payment partner. Records of payments made through earlier payment methods keep the details recorded at the time. Card and wallet details are entered on the pages of the payment partner or of the payment provider you choose there; the card number, the expiry date, the security code and wallet keys never reach us, and documents submitted for an identity check go to them, not to us.
Technical data: request ids and error logs. These are kept in order to monitor the operation of the service.
Signup source: when an account is created, the path of the page on this site you entered through (for example /pricing); where you arrived from another site, that site's domain name; and where the link included them, its campaign tags (utm_source, utm_medium, utm_campaign). The full address, the rest of the query string and the full referring URL are not recorded, nothing is stored on your device for this, and the record is not updated after the account is created.
Signup gift eligibility: to stop the signup gift credits from being claimed again and again, when an account that may still receive the gift opens the site, we check whether the request comes from a hosting, data-centre or VPN network and, in desktop browsers only (not on phones or tablets), your browser computes a one-way summary (hash) of some of its characteristics, such as screen size, time zone, languages and the way it draws graphics. Nothing is stored on your device for this. We keep only a one-way code derived from that summary with a secret key, not linked to your account, for 365 days, and use it solely to decide whether the gift has already been given on that device; the network type is checked at that moment and not stored.
Notification data: if you turn on notifications in Studio, we store the push subscription your browser creates (the address of your browser's push service and its encryption keys), linked to your account, solely to tell you when your own generations finish or fail. The notification is sent encrypted through your browser's push service. The subscription is deleted when you turn notifications off, sign out of Studio or delete your account.
Purposes of processing
Providing the service, running generations and delivering their results to you.
Maintaining your credit balance and payment records, and building your billing history.
Seeing which pages of this site lead to accounts, so that what is written is measured rather than guessed. This is not used to build a profile of you or to target advertising.
Preventing abuse and the generation of prohibited content.
Meeting legal obligations.
Retention periods
Generated files are deleted after 7 days, uploaded images after 48 hours. An uploaded image is kept longer only while a generation that uses it is still running or was started within that period, while the account is suspended, or when it is held as evidence of a suspected child-safety violation. This includes the copies we store of images you use as reference images by URL, which are kept so that the image that was checked is the one used; such a copy is deleted at once if the image is refused or the check is unavailable.
Chat: conversations in Studio are kept for 7 days and then deleted. Chat requests sent through the API are not stored; only their token counts and charges are recorded. Images added to a chat are uploads and follow the upload retention above.
Generation and payment records are kept for the duration of legal retention obligations.
When an account is closed the account data is deleted; billing records are kept for the period prescribed by law.
Administrator access
The administrator operating the service can access generation records, submitted prompts and generated outputs for the purpose of monitoring abuse.
This access is used only to identify and block prohibited content — sexual depiction of persons who are not of age, non-consensual content involving real people and the other content the Terms of Use prohibit — and to resolve account and payment issues.
Generated content and prompts may also be reviewed by our staff to handle moderation and removal requests, and by our payment partner's compliance reviewers through a read-only account, solely for compliance review.
Credit, account and content removal actions performed by an administrator are recorded.
Security
API keys are stored only as a hash; they cannot be viewed again after creation.
Connections are encrypted end to end. Even so, no system can promise absolute security.
- hello@monaystudio.com