Privacy Policy

1. Who We Are

Slayed AI is owned and operated by Sandlabs, with a principal address at Melbourne, Australia. Sandlabs owns the Slayed AI brand and intellectual property.

We are the APP entity (Australian Privacy Principles entity) for your personal information. That means we decide how and why your data is processed.

Contact: hello@sandlabs.com.au

2. What We Collect

We collect the minimum data needed to run the service. Here's exactly what:

Account data

• Email address (from email code sign-in)
• User ID (generated automatically)
• Your locale and market (for pricing and language)

Photos you upload

• The images you choose to upload for AI generation
• Stored in our cloud storage (Supabase)

AI-generated outputs

• The images our AI creates from your uploads
• Stored in our cloud storage alongside your originals

Generation metadata

• Which template you used, the AI model, prompts, timestamps, and status
• Used to deliver results and improve the service

Payment data

• Managed entirely by Stripe (our payment processor). We store your Stripe customer ID, subscription status, and invoice references.
• We never see or store your full card number - Stripe handles that

Usage and security

• Rate-limiting data via Upstash Redis (to protect the service from abuse)
• Basic server logs for security and debugging

3. Why We Process Your Data

We need a lawful basis for each type of processing. Here are ours:

Contract performance

• Account creation and management
• Processing your subscription and payments
• Managing your credits
• Delivering AI-generated content

Consent

Processing of facial images is based on your explicit consent, given when you choose to upload a photo. When you upload a photo containing your face, you explicitly consent to us sending it to our AI provider for processing. Facial images may be considered sensitive information under privacy law in some jurisdictions. We do not perform biometric identification or facial recognition - your photo is used solely to generate the creative output you requested.

Legitimate interest

• Fraud prevention and security
• Rate limiting to protect the service

Legal obligation

• Retaining payment records for tax and accounting purposes

4. Who We Share Your Data With

We use the following third-party services to run Slayed AI. Each acts as a service provider on our behalf:

We do not sell your data to anyone. Ever.

5. AI-Specific Disclosure

Here's exactly what happens when you generate an image:

1. You upload a photo and pick a template (or write a prompt)
2. Your photo is sent to xAI's API for AI processing
3. xAI generates the output and sends it back
4. We download the output and store it in our own storage (Supabase)
5. xAI retains API inputs and outputs for up to 30 days for abuse auditing, then deletes them

Important:

• We do not use your uploaded images to train AI models
• xAI does not use your images to train their models without your explicit permission
• Your photos are sent to xAI solely to generate the output you requested
• AI-generated content is produced by artificial intelligence and may not be perfectly accurate

6. How Long We Keep Your Data

Your images (uploads and outputs)

• Stored while your account is active, until you delete them or request account deletion

Account data

• Kept until you delete your account or request deletion

Payment records

• Kept as required by Australian tax and legal obligations (even after account deletion)

7. Overseas Disclosure

We are an Australian company and most of our third-party service providers are based in the United States. When your data is transferred overseas, we take reasonable steps to ensure it is handled in a way consistent with the Australian Privacy Principles, including through contractual protections with our service providers.

8. Your Rights

Under the Privacy Act 1988 (Cth) and Australian Privacy Principles, you have the right to:

• Access your personal information - know what we have
• Correct inaccurate information - ask us to fix it
• Delete your data - ask us to delete it, or request account deletion by email
• Complain to us if you believe we have mishandled your information

If you are in the EU or UK, you may also have additional rights under GDPR, including the right to data portability, restriction of processing, and objection to processing based on legitimate interests.

How to exercise your rights:

• Request account deletion: email hello@sandlabs.com.au
• For all other requests: email hello@sandlabs.com.au. We'll respond within 30 days.

Right to complain: You can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. If you are in the EU or UK, you may also complain to your local data protection authority.

9. Cookies

Slayed AI uses essential session cookies and authentication tokens to keep you signed in. These are strictly necessary for the service to work.

We do not use marketing cookies, advertising pixels, or third-party analytics trackers on our marketing pages or inside the app.

10. Children's Privacy

Slayed AI is intended for users aged 18 and older. We do not knowingly collect personal information from anyone under 18.

Some countries set a higher minimum age for data processing consent. If you are below the minimum age in your country, you may not use Slayed AI.

If we discover that we have collected data from anyone under 18, we will delete their account and all associated data immediately.

11. Data Security

We take reasonable measures to protect your data:

• All data is encrypted in transit (TLS/HTTPS)
• Images are accessed via signed URLs with short expiry times
• API endpoints are rate-limited to prevent abuse
• Database access is restricted and monitored

No system is 100% secure. If you discover a vulnerability, please report it to hello@sandlabs.com.au.

12. Data Breach Notification

In the event of a data breach that is likely to result in serious harm to you, we will:

• Notify the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme
• Notify you directly as soon as practicable
• Document the breach and the steps taken to address it

13. Changes to This Policy

We may update this policy from time to time. If we make material changes, we'll notify you by email or through an in-app notice.

Continued use of Slayed AI after changes means you accept the updated policy. If you disagree, you can request account deletion at any time.

14. Contact Us

Sandlabs
Melbourne, Australia
Email: hello@sandlabs.com.au

For data protection inquiries, email us with the subject line "Data Protection Request."