Privacy Policy

Last Updated: September 10, 2026

Cantikit respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how Cantikit (“Cantikit,” “we,” “us,” or “our”) collects, uses, stores, shares, transfers, and protects personal data when you access or use our websites, applications, AI generation and editing tools, templates, community features, APIs, subscriptions, Credits, payment features, and related services (collectively, the “Services”). Cantikit means the legal entity that provides the applicable Service to you, as identified in the relevant app-store listing, checkout flow, invoice, or other product notice.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Services.

1. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed through the Services. It should be read together with Cantikit’s Terms of Service, Usage Policy, Paid Terms, API Documentation, and any product- or region-specific notices that may apply.

This Privacy Policy does not govern third-party websites, applications, platforms, payment channels, or services that you choose to access or connect to through the Services. Those third parties process information under their own terms and privacy policies.

For purposes of applicable data-protection law, the relevant Cantikit entity is the controller, business, or equivalent organization responsible for the personal data described in this Privacy Policy, unless a product- or region-specific notice identifies another entity or role.

2. Personal Data We Collect

2.1 Information You Provide

Account and contact information. When you register, sign in, contact us, subscribe to updates, or use account features, we may collect your email address, name, profile picture, account ID, login credentials, telephone number if you choose to provide it for support or verification, and other information you choose to provide.

Payment and transaction information. When you purchase subscriptions, Credits, membership benefits, or other paid services, we may collect order records, recharge records, balance and usage information, payment status, billing details, receipts, and transaction confirmations. Payment card information may be collected and processed directly by Stripe, app stores, or other payment providers under their own privacy policies.

Inputs, Outputs, and uploaded materials. We may process prompts, text, images, videos, audio, files, URLs, reference materials, negative prompts, parameters, templates, project files, settings, and other materials you submit (“Inputs”), as well as images, videos, text, files, task results, and other content generated or edited through the Services (“Outputs”). Inputs and Outputs are collectively referred to as “Content.”

Support, feedback, and verification information. If you contact support, report an issue, rate an Output, participate in a survey, dispute a transaction, or verify your identity, age, account ownership, or authorization, we may collect your contact details, messages, screenshots, task IDs, order information, verification materials, and related technical or account information.

2.2 Information Collected Automatically

When you use the Services, we may automatically collect:

  • Device and connection information, such as device type, operating system, browser, app version, IP address, approximate location derived from IP, mobile network, internet service provider, language, time zone, device identifiers, advertising identifiers, and other online identifiers.
  • Usage information, such as access times, pages and features used, clicks, interactions, generation history, task status, Credits usage, downloads, sharing activity, searches, template usage, API usage, and project or workflow activity.
  • Log and diagnostic information, such as crash reports, error messages, performance data, request parameters, task failure information, security events, and information needed to identify and repair errors.
  • Cookie and similar technology data collected through cookies, scripts, SDKs, pixels, local storage, and related technologies used to operate the Services, keep you signed in, remember preferences, analyze performance, prevent abuse, personalize experiences, and measure advertising effectiveness.

You can manage cookies and certain identifiers through your browser, device, or consent settings. Disabling them may affect some features of the Services.

2.3 Information From Third Parties

We may receive information from app stores, payment processors, login providers, analytics and attribution providers, advertising partners, security providers, social platforms, or integrations you choose to use. The information received depends on the relevant service, your settings, and the permissions you grant.

3. AI Content and Face-Related Processing

When you use Cantikit’s AI generation, editing, enhancement, template, or related features, we may process your prompts, uploaded media, reference materials, settings, Outputs, task records, and interaction data to complete the requested task and operate the Services.

Cantikit will not use data you upload to train or optimize AI models without your explicit consent. We may still process Content where reasonably necessary to provide the requested feature, maintain security, detect abuse or policy violations, conduct safety review, troubleshoot technical issues, resolve disputes, or comply with law.

Some features may analyze faces in uploaded images to provide stylized portraits, expression effects, face-based templates, or similar creative functions. For those features:

  • We may analyze facial feature points, such as the position of eyes, nose, and mouth, only as needed to provide the requested effect.
  • Selected images may be transmitted to our servers in encrypted form for processing.
  • We do not use face data to identify you or associate face analysis data with your identity for biometric identification.
  • We do not share face data with third parties for their independent use.
  • Face analysis data is deleted after processing unless temporary retention is reasonably necessary for security, legal compliance, troubleshooting, or dispute resolution.

Uploaded media and generated results may be temporarily stored to complete tasks, provide downloads, maintain task history, support users, and comply with applicable retention requirements.

4. How We Use Personal Data

We may use personal data to:

  • Provide, maintain, operate, and improve the Services.
  • Create, authenticate, administer, and secure accounts.
  • Process Inputs, generate or edit Outputs, complete tasks, provide downloads, and enable sharing or publishing features.
  • Process subscriptions, Credits, payments, billing, invoices, refunds, and transaction history.
  • Personalize the product experience, remember preferences, recommend features, and improve usability.
  • Provide support, investigate failed tasks, troubleshoot errors, and respond to requests.
  • Send service, billing, security, product, policy, and support communications.
  • Detect, prevent, and investigate fraud, abuse, spam, unauthorized access, payment or Credits misuse, security incidents, and violations of our rules.
  • Enforce our Terms of Service, Usage Policy, Paid Terms, and other applicable agreements.
  • Comply with law, legal process, regulatory obligations, and lawful requests.
  • Analyze aggregated or de-identified trends and improve product performance, safety, and quality.

Where required by law, we process personal data based on one or more valid legal grounds, including performance of a contract, legitimate interests, consent, and compliance with legal obligations.

Where consent is required for personalized advertising, non-essential tracking, marketing, face-related processing, or another specific use, we will request that consent separately. You may withdraw consent through available settings or by contacting us, without affecting processing that was lawful before withdrawal.

5. How We Share Personal Data

Cantikit does not sell your personal information.

We may share personal data with:

  • Service providers and business partners that support cloud hosting, storage, media processing, content delivery, payments, security, anti-abuse, analytics, attribution, customer support, communications, app distribution, and technical infrastructure.
  • Affiliates and related entities where necessary to operate, secure, improve, or support the Services.
  • Third-party services you choose, including integrations, payment channels, app stores, social platforms, community services, or other services you connect to or direct us to use.
  • Legal authorities or other parties where we reasonably believe disclosure is necessary to comply with law or legal process; prevent serious harm; detect or address fraud, abuse, security risks, payment misuse, or illegal activity; enforce our agreements; or protect the rights, property, and safety of Cantikit, our users, or others.
  • Parties to a corporate transaction in connection with a merger, acquisition, financing, reorganization, division, bankruptcy, sale of assets, or similar transaction, subject to applicable law.
  • Other recipients with your consent or direction, including when you publish Content, share Outputs, connect an integration, or use a public or community feature.

Service providers may process personal data only as needed to provide services to Cantikit or as otherwise permitted by applicable law and their agreements with us.

We require service providers that process personal data on our behalf to protect it, maintain appropriate confidentiality and security, and use it only for the contracted purposes, subject to applicable law.

If a corporate transaction results in a material change in ownership or in how personal data is used, we will provide notice and any legally required choices through reasonable means, such as email or a prominent notice in the Services.

6. Public Sharing and Community Features

If you publish, post, share, like, bookmark, comment on, remix, or otherwise make Content available through Cantikit’s community, gallery, template, sharing, or public features, that Content and associated profile information may be visible to other users or the public.

Do not publish private, sensitive, confidential, or third-party personal information unless you have the right to do so. Information made public may be copied, saved, or redistributed by others beyond Cantikit’s control.

7. Advertising, Analytics, and Similar Technologies

We may work with advertising networks, analytics providers, attribution providers, and measurement partners to operate, understand, promote, and improve the Services. Depending on your region, platform, device, product version, and consent choices, these parties may collect or receive device information, identifiers, interaction information, approximate location, and usage information under their own privacy policies.

Providers may include, where applicable:

You may manage certain advertising, analytics, cookie, or tracking choices through device settings, browser settings, consent tools, or third-party opt-out mechanisms where available.

Some privacy laws use broad definitions of “sale,” “sharing,” or “targeted advertising.” Although Cantikit does not sell personal information for money, certain advertising or measurement disclosures may be treated as a sale or sharing under those laws. Where applicable, we will provide a method to opt out and will honor legally recognized browser- or device-based preference signals as required by law.

8. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Services, maintaining accounts, processing payments, preserving task history, supporting users, complying with law, resolving disputes, preventing fraud, enforcing our agreements, and maintaining security.

Account registration data may be retained while your account is active and for up to 12 months after it becomes inactive, unless a longer period is required or permitted for legal, accounting, tax, security, fraud-prevention, or dispute-resolution purposes.

If you request deletion or withdraw consent where applicable, we will process the request under applicable law. We may retain limited records where necessary to document and honor your request, prevent fraud, resolve disputes, comply with legal obligations, or enforce our agreements. When data is no longer needed, we will delete, erase, anonymize, or de-identify it as permitted or required by law.

9. International Data Transfers

Personal data may be stored or processed by Cantikit and its service providers, including Google Cloud, in countries or regions outside your place of residence. Privacy laws in those locations may differ from those in your jurisdiction.

Where required, we use appropriate safeguards for cross-border transfers, such as contractual protections, data processing agreements, standard contractual clauses, adequacy mechanisms, or other lawful transfer methods.

10. Data Security

We use reasonable technical and organizational measures designed to protect personal data against loss, misuse, unauthorized access, disclosure, alteration, or destruction. These measures may include encryption, access controls, account protections, backups, monitoring, data classification, security policies, and incident-response procedures.

No internet service, transmission method, or storage system is completely secure. You are responsible for safeguarding your account, password, device, network, API keys, tokens, and other credentials. If a personal data incident occurs, we will notify affected users and regulators where required by law.

11. Your Rights and Choices

Depending on your location and applicable law, you may have the right to:

  • Know what personal data we process and how it is used.
  • Access or receive a copy of your personal data.
  • Correct inaccurate or incomplete personal data.
  • Delete personal data.
  • Object to or restrict certain processing.
  • Withdraw consent where processing is based on consent.
  • Receive personal data in a portable format where applicable.
  • Opt out of certain marketing communications or targeted advertising.
  • Request information about certain disclosures of personal data.
  • Request review or explanation of certain automated decisions where applicable.
  • Lodge a complaint with a competent data-protection authority.

These rights may be limited by applicable law, technical feasibility, security requirements, legal obligations, fraud prevention, dispute resolution, or the rights and freedoms of others.

To exercise your rights, contact us at cantikit.app@gmail.com. We may need to verify your identity before responding. We will respond within the period required by applicable law or, where no period is specified, make reasonable efforts to respond within 15 working days after identity verification.

You may also be able to access or update certain profile, account, consent, advertising, and notification information directly through the settings available in the Services.

12. Account and Content Deletion

You may request deletion of your account or certain Content through product settings, where available, or by contacting us. Account deletion may remove associated media, project materials, generated Content, and other account data, subject to legitimate retention needs and applicable law.

Limited information may remain for a period in backups, logs, security records, billing records, legal records, or de-identified form where permitted or required by law.

13. Automated Decision-Making

The Services may use automated systems, algorithms, or AI models to provide recommendations, generate Content, detect abuse, moderate Content, prevent fraud, improve safety, and operate product features.

Cantikit does not intend to make decisions based solely on automated processing that produce legal or similarly significant effects, unless permitted by law and accompanied by appropriate safeguards. Where applicable law provides a right to explanation, human review, or remedy, you may contact us using the details below.

14. Aggregated and De-Identified Data

We may use aggregated, anonymized, or de-identified data to analyze usage, improve product performance, conduct research, enhance safety, prevent abuse, and understand user behavior. We will maintain de-identified data in de-identified form and will not attempt to re-identify it except where permitted by law, such as for security, compliance, or enforcement purposes.

15. Children and Minors

Cantikit is not directed to anyone under 18, and the Services may not be used by anyone under 18. We do not knowingly collect personal data from children under 18.

If you are under 18, do not create an account, use the Services, or submit personal data to Cantikit. If you are a parent or legal guardian and believe that a person under 18 has provided personal data to Cantikit, contact us at cantikit.app@gmail.com. We will investigate and, where appropriate, delete the relevant data and close the account, subject to applicable law.

16. Communications and Marketing Choices

We may send service notices, billing notices, security alerts, policy updates, product updates, and support messages. Where permitted by law, we may also send marketing communications.

You may opt out of marketing emails by using the unsubscribe link or changing available notification settings. You may still receive non-marketing communications concerning account security, billing, legal notices, or service operation.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our products, legal requirements, security needs, data practices, or operations. If we make material changes, we will provide notice through reasonable means, such as an in-product notice, website notice, push notification, or email.

The updated Privacy Policy takes effect when posted or otherwise made available, unless a different effective date is stated or required by law.

18. Contact Us

If you have questions, complaints, suggestions, or requests regarding this Privacy Policy or our privacy practices, contact us at:

cantikit.app@gmail.com

Please include your account email and a clear description of your request, together with relevant order or task information and screenshots where available.