1. Who is responsible
Andrii Skliaruk, an individual based in Kyiv, Ukraine, is responsible for your personal data on tinty.ai (the “controller”). Contact us about privacy at hello@tinty.ai.
Paddle.com is the Merchant of Record for our orders and is the controller of the payment data it collects at checkout; its privacy notice applies to that data.
2. Data we collect
Account: your email address, and your name, profile picture and the sign-in tokens Google gives us if you sign in with Google. Sign-in codes are stored only as a hash and expire after 5 minutes.
Photos and images: the room photos you upload, the previews and finished photos generated from them, the settings you chose and any notes you write for a render. Photos you email us for TINTY Studio are handled the same way as uploads: we store them and the staged results in our storage and show them on your private delivery link.
Plan and usage: your plan or Listing pack and when it expires, finished photos and previews used, and a record of renders and refunds of finished photos. For TINTY Studio: the delivery link, the name and email you gave us, when the link was opened and paid.
Purchases: Paddle shares with us your email address, customer, subscription and transaction IDs, the plan or pack you bought, billing period, amounts and taxes, and limited card information (card type, last four digits, expiry date and cardholder name). We never receive your full card number or security code.
Technical and usage data: your device type, a hashed version of your IP address and a record of what you do in the product, such as uploads, previews, renders and downloads. We use the hashed IP address to apply free-use limits. When analytics is on (see section 7), we also record the pages you visit, the referrer and campaign tags, and a random visitor ID stored in a cookie, and we use Google Analytics, which collects similar usage data together with your device and browser type and your approximate location derived from your IP address. When you sign in, we store your IP address and browser details with your session to keep your account secure. To limit sign-in attempts, we briefly keep your IP address and share it with Cloudflare Turnstile.
Messages: what you send us when you contact support.
3. How we use it and why
To provide TINTY (contract): sign you in, generate and store your images, show your projects and project links, apply plan and pack limits, process renders and refunds of finished photos.
To prevent abuse (legitimate interest): apply free-use limits per network and account, detect misuse and keep the service secure.
To improve TINTY (legitimate interest, or consent where the law requires it): understand how visitors use the site, for example which steps people complete, using our own analytics and Google Analytics. In the EEA, the UK, Switzerland and Quebec, and whenever your browser sends a Global Privacy Control signal, analytics runs only if you choose “Accept all”; elsewhere it runs unless you choose “Essential only”.
To communicate (contract or consent): send sign-in codes, service and billing messages, and product news if you agree to receive it.
To meet legal obligations: keep records required by law and respond to lawful requests.
4. How your photos are processed by AI
To create images, your content is sent to AI model providers that act on our behalf: Google's Gemini API analyzes each photo you upload to recognize room features, fal.ai generates previews, and the Gemini API renders finished photos from your original photo, the preview you chose and any notes you add.
We don't use your photos or the images generated from them to train AI models. Under their paid API terms, fal.ai doesn't use them to create, train or develop its products, and Google doesn't use them to improve its products; content Google logs for abuse monitoring is used only for policy enforcement, which can include training Google's abuse-detection systems. Both providers may keep your content for a limited time to run and secure their services: images fal.ai generates for us are set to expire from its storage after one day, fal.ai keeps records of our requests for up to 30 days, and Google keeps Gemini API inputs and outputs for up to 55 days to detect and prevent abuse and to meet legal obligations; authorized Google staff may review content flagged for abuse.
Photos you send us for TINTY Studio may go through the same AI providers when we stage them, under the same terms.
Don't upload photos that show identifiable people. TINTY is designed for empty rooms and interiors.
6. How long we keep data
Photos staged without an account: deleted with all their images by our daily cleanup once they are more than 72 hours old.
Projects in an account: until you delete the project or close your account. Deleting a project removes its original photo, previews and finished photos from our storage.
TINTY Studio deliveries: the photos and results on a delivery link are kept until we delete the delivery — write to us and we remove them, except the purchase records we must keep for accounting and tax.
Account data: kept while your account is open. When you ask us to close your account, we delete your account, projects, images and usage records within 30 days. We keep only the purchase records we must keep for accounting and tax, such as transaction IDs, amounts and dates, and payment event data from Paddle for up to 180 days.
Sign-in sessions: the IP address and browser details stored with a session are deleted when you sign out, or by our daily cleanup 30 days after the session expires.
Analytics and product events: up to 13 months, then deleted by our daily cleanup. Google Analytics keeps the data it collects for us for 14 months.
Support messages: as long as needed to answer you and to handle any follow-up, such as a refund, a complaint or a legal claim about the same issue.
Payment event data from Paddle: 180 days, after which we keep only the purchase records we need for accounting and tax.
Deleted data can remain in our database's restore history for up to 6 hours. Copies kept by our service providers, such as the AI providers described in section 4, are deleted when their own retention periods end.
8. Your rights
Depending on where you live, including under the GDPR, UK GDPR and California privacy law, you can ask us to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent at any time. We don't sell or share personal data for cross-context advertising.
Withdrawing your consent to analytics cookies is as easy as giving it: open “Cookie settings” and choose “Essential only”. Withdrawal doesn't affect what we did with your consent before.
We treat a Global Privacy Control signal from your browser as a request to keep analytics off unless you choose “Accept all”, wherever you are.
Write to hello@tinty.ai from the email address on your account. We reply within 30 days. You can also complain to your local data protection authority.
9. Security and children
To protect your data, we use encryption in transit, access controls, and signed links to image files that expire within 24 hours. No system is completely secure; we will tell you if a breach affects your data as the law requires.
TINTY is not for children under 18, and we don't knowingly collect their data.
10. Changes and contact
We may update this policy. For material changes we will notify you by email or in the app. The date at the top shows the latest version.
Andrii Skliaruk, Kyiv, Ukraine · hello@tinty.ai.