How GenX.art collects, uses, shares, and protects personal data
2026/08/12
Last updated: August 12, 2026
This Privacy Policy describes how GenX.art (“GenX,” “we,” “us,” or “our”) handles personal data when you use our websites, accounts, generation workflows, billing features, support channels, and related services (the “Service”). It also explains choices and rights that may be available to you.
This Policy does not govern a third-party site or service that you visit independently. When GenX uses a third party to deliver a feature, that provider may also process data under its own terms and privacy notice.
We use data as reasonably necessary to:
We do not promise that your generation inputs remain solely within GenX: the necessary inputs are sent to the model and infrastructure providers required for the workflow you choose.
Where applicable law requires a legal basis, we rely on one or more of:
You may withdraw consent for future processing where consent is the basis, without affecting prior lawful processing.
We may disclose relevant data to:
Providers receive data relevant to their function. Their locations, subprocessors, retention, and model-input practices can differ. Do not upload sensitive or regulated data unless the workflow explicitly supports it and you have assessed the applicable provider terms.
We do not sell personal data for money. Some analytics or advertising disclosures, if enabled, may be treated as “sale,” “sharing,” or targeted advertising under certain laws; available consent or opt-out controls will apply in those regions.
We retain data for no longer than reasonably necessary for the purposes above, taking account of account status, user deletion choices, generation and storage needs, security investigations, provider behavior, contractual commitments, backup cycles, payment reconciliation, disputes, and legal obligations.
Different records therefore have different retention periods. Deleting an asset or account may remove it from the active product before it disappears from backups, provider systems, logs, or records that must be retained. We may retain de-identified or aggregated information where it no longer reasonably identifies you.
GenX and its providers may process data in countries other than your own. Where required, we use an available lawful transfer mechanism and appropriate contractual or organizational safeguards. No transfer mechanism eliminates all risk, and specific provider locations can change.
We use technical and organizational measures designed to protect data, such as access controls, authentication safeguards, transport encryption, logging, and least-privilege practices where appropriate. No online service or storage system is completely secure, so we cannot guarantee absolute security.
Protect your credentials, use a unique password, and contact us promptly if you suspect unauthorized access. Never send passwords, API keys, reset links, or full payment-card data through support.
Depending on your location and subject to legal exceptions, you may have rights to:
Use account settings for available self-service controls. For other requests, submit the contact form, select Privacy request, and describe the account and request. We may verify your identity and authority before responding. Response timing follows applicable law and may be extended where permitted.
Asset controls remove supported items from the active product. Account deletion can be initiated through Settings → Security where available and is irreversible after confirmation. Some limited data may remain for security, payment, dispute, backup, or legal reasons, and third-party providers may have separate retention obligations.
Generation inputs and outputs may contain personal data. Model providers need relevant inputs to perform your request. Whether a provider retains inputs or uses them for service improvement depends on the provider, configuration, contract, and applicable terms; GenX does not make a blanket “no storage” or “no training” representation for every provider.
Avoid uploading another person's face, voice, or personal data without the necessary notice, consent, and legal basis. Review synthetic media before publishing and disclose it where required.
The Service is not directed to children who cannot legally consent to the relevant data processing in their location. If you believe a child provided personal data without required authorization, submit a privacy request so we can investigate.
We may update this Policy as the Service, providers, or law changes. We will update the date above and provide additional notice when required. We encourage you to review this page periodically.
For privacy questions or rights requests, use the contact form and select Privacy request. Do not include secrets or unnecessary sensitive data. You may also contact the competent data-protection authority where that right applies.