Privacy Policy

1. Data we process

• Account data: email, display name, role, language, theme, team configuration, and sign-in security information.
• Creative data: projects, canvas nodes, Briefs, prompts, reference relationships, uploaded media, generated results, and version history.
• Usage and transaction data: model parameters, job status, Credits reservations, charges, refunds, administrative actions, and errors.
• Payment data: purchased package, amount, currency, Stripe Checkout and payment transaction identifiers, payment status, and refund status. Full card numbers, CVCs, and other payment credentials are collected directly by Stripe and are not stored by SKAND.
• Product analytics data: limited events such as visits to key pages including pricing and account center, and user-initiated generation cancellation. Analytics events do not store prompts, media content, or form text.
• Security and consent data: sessions, audit records, accepted policy versions, acceptance time, IP address, and browser identifier.

2. Why we process data

• To provide accounts, canvas, storage, generation, collaboration, billing, and support.
• To verify permissions, prevent fraud and abuse, troubleshoot issues, and secure the service.
• To provide the service under our agreements, retain transaction and consent records, and comply with applicable law.

3. Model providers and processors

For AI jobs, required prompts, parameters, and explicitly referenced materials may be sent to team-configured providers such as Kimi, APIMart, fal.ai, Agnes, MiniMax, or their underlying model providers. Stripe acts as payment processor and directly handles payment methods, billing details, fraud detection, and transaction records. Hosting, database, media storage, security, and operations providers may also process data as needed to perform their services. Provider-specific processing and retention terms may apply.

4. Access, sharing, and transfers

Members cannot access other members' private projects and media. SKAND shares necessary data only to provide the service, follow your instructions, administer the organization, protect legitimate interests, or comply with law. Upstream or infrastructure providers may operate in different countries, so data may be processed across borders.

5. Retention and deletion

• When a project is deleted, related uploads, generated files, previews, and job records are removed through the current product process.
• Account, transaction, consent, and security records are retained as needed for contract performance, disputes, fraud prevention, and legal obligations.
• Raw product events used for commercial analytics are retained for 90 days by default and then deleted; longer-term trends are calculated from aggregated business data.
• Backups, provider caches, or legally retained data may remain for a limited period after primary data is deleted.

6. Security

SKAND uses member- and project-level access checks, server-side sessions, controlled administrative permissions, and operational auditing. No system can guarantee absolute security; avoid submitting sensitive information that a job does not require.

7. Your choices and rights

You can download a structured copy of your data, submit an account deletion request, and track its status in the Account Center. You may also ask your team admin to correct information or help you exercise applicable rights of access, deletion, restriction, and objection. Identity and ownership of team data are verified before account closure.

8. Children

SKAND is not directed to children below the age at which they can independently consent to digital services in their location.

9. Changes and contact

We communicate material changes through a new version and ask you to accept it in the product. For privacy questions or data requests, contact your team admin so they can coordinate with Skand Studio.