Privacy Policy

This policy explains what Aycdi collects, why, how we use and protect it, and what rights you have over your own data.

The data controller is KURIL TECHNOLOGY PTE. LTD., registered at 138 Cecil Street, #13-02, Cecil Court, Singapore 069538. This policy is written under Singapore’s Personal Data Protection Act 2012 (PDPA). For visitors in the EEA and the UK we also honour the rights granted by the GDPR.

1. What we collect

• Account data: email, display name and a salted hash of your password. If you sign in with Google, also the account identifier, email and avatar URL Google returns.
• Creative content: the prompts you write and the text generated from them, so they can appear in your library.
• Transaction data: order id, amount, currency, product and payment status.
• Technical data: session identifier, IP address and browser user agent, to keep you signed in and to prevent abuse.

2. What we do not collect

We never see your card details. Card numbers, expiry dates and security codes are collected and processed by Stripe directly. Our servers neither store, transmit nor can read them.

3. How we use it

• to run generation, your library, credits and subscriptions;
• to take payment, grant credits and keep a transaction record;
• to send transactional email — verification, password reset, payment confirmation;
• to moderate content and act against abuse;
• to produce aggregate, de-identified statistics about how the service is used.

We do not sell your personal information, and we do not use it for marketing unrelated to the purposes above.

4. Third parties

• DeepSeek receives your prompts in order to generate text. Do not put identity numbers, bank details or similar sensitive data in a prompt.
• Stripe processes payments and subscriptions and receives your email and the amount charged.
• Resend delivers transactional email and receives your email address.
• Vercel and our database provider host the application and store its data.

5. Cookies

We use only the session cookie required to keep you signed in. There are no third-party advertising or tracking cookies. Blocking it means you cannot stay signed in.

6. Retention

• Account data and creative content are kept while the account exists.
• Transaction records are kept as long as tax and audit rules require, normally at least five years.
• Session records are cleared once they expire.
• When you close your account we erase or anonymise your personal information within 30 days, except where the law requires us to keep it.

7. Your rights

You may ask us to confirm whether we hold your personal data and to give you a copy of it, to correct it, to withdraw your consent to our collecting, using or disclosing it, to delete it where we no longer need it for a lawful or business purpose, and to close your account. Access and correction requests are handled under the PDPA.

Most of this is self-service: Account settings lets you edit your profile, download everything the account holds as a JSON file, and close the account. For anything else write to [email protected] and we will respond within 15 working days.

8. Security

• All traffic is encrypted in transit over HTTPS.
• Passwords are stored as salted hashes; we cannot recover your original password.
• Third-party service keys are encrypted at rest in the database with AES-GCM.
• Administrative endpoints check both identity and privilege, and key actions are written to an audit log.

9. Children

The service is not directed at children under 14. If we learn that we have collected a child’s personal information we will delete it promptly. Guardians can contact us at the address below.

10. Changes

Updates are published on this page with a revision date. We will tell you about significant changes by email or in the application.

11. Jurisdiction and contact

This policy is governed by the laws of the Republic of Singapore. Disputes about the handling of personal information fall under the exclusive jurisdiction of the courts of Singapore.

Privacy questions, and requests to our data protection contact, go to [email protected], or through the Contact page. If we cannot resolve a concern you may also complain to Singapore’s Personal Data Protection Commission (PDPC).

Last updated：2026 年 11 月 12 日This policy is published in English, Japanese and Chinese. Where versions differ, the English text governs, as the operating company is registered in Singapore.