Privacy Policy

It applies to visitors of our website, people who sign in, people who buy tokens, and people who generate content. If you do not agree with this Policy, please do not use the service.

Depending on how you use Cendroa, we may process:

• Account data from Google Sign-In: name, email address, profile photo URL, and a unique user ID.
• Service data: token balance, timezone of your device, generation history, prompts/descriptions you enter, selected size/format, and dates of activity.
• Content you upload: product photos and any avatar images you provide. These may include a person’s likeness if you upload one.
• Generated content: AI images and videos we create for you, and the public URLs used to store and display them.
• Payment data: email, token amount, price, currency, transaction/payment references, and payment status. Card numbers, CVV and full card details are collected and processed by our payment provider, not stored by us.
• Communications: emails we send you (including purchase receipts) and messages you send to support.
• Technical data: IP address and basic device information that our hosting, authentication or payment providers may log for security and fraud prevention.

We do not intentionally collect special category data (for example health or political opinions). Please do not upload such information.

We use personal data only as needed to run Cendroa:

• To provide the service (create your account, generate images/videos, show your library, keep your token balance): performance of a contract.
• To take payment and send receipts: performance of a contract and our legal duty to keep accounting records.
• To keep the service secure (abuse, fraud, unpaid chargebacks): legitimate interests.
• To reply to support requests: contract and legitimate interests.
• Cookies that remember dashboard layout: legitimate interests in a usable interface. See section 9 and our Cookies Policy.

We do not sell your personal data. We do not use your uploads to train public marketing profiles about you. Generated results exist so you can use them as described in our service.

Tokens are prepaid credits for generating images and videos. When you buy tokens, you are redirected to our payment provider (Secure Processor / checkout.secure-processor.com) to complete the card payment.

After a successful payment we add tokens to your account and email a receipt to the address on your account. The receipt includes purchase time, amount, tokens and our company details.

If a payment fails, is declined or is later reversed, we may refuse or reverse the related token credit to prevent fraud.

To create a result we send your image and text prompt to AI and storage providers. Your file is uploaded to our media host, a prompt may be produced with OpenAI, an image may be generated, and a video may be generated with Replicate. Outputs are stored and shown in your account (including My Ads).

You must only upload content you have the right to use. Do not upload images of other people unless you have a lawful basis and their permission where required. You are responsible for how you use generated content.

AI output can be imperfect or unexpected. We process this content to deliver the feature you requested, not to make automated legal or similarly significant decisions about you.

We share data with service providers who help us operate Cendroa, only as needed:

• Google / Firebase — account sign-in and database.
• ImageKit — storage and delivery of uploaded and generated media.
• OpenAI — prompt and image generation.
• Replicate — video generation.
• Secure Processor — card payments and checkout.
• Titan Email — sending no-reply receipts from Cendroa.
• Our hosting provider — running the website and APIs.

We may also disclose data if required by law, to protect our rights, or in connection with a company sale or reorganisation, under appropriate safeguards.

We are established in the United Kingdom. Some providers (including Google, OpenAI, Replicate and ImageKit) may process data in the United States or other countries outside the UK. Where we transfer personal data internationally, we use lawful mechanisms such as the UK International Data Transfer Addendum / Standard Contractual Clauses, plus the provider’s own transfer tools where they apply.

• Account data: while your account is open, then as long as needed to close it and handle disputes.
• Generated images/videos and uploads: until you delete them in the product or ask us to delete your account, unless we must keep a copy for security or legal reasons.
• Payment and invoice records: usually up to 6 years after the transaction, as required for UK tax and accounting rules.
• Support emails: for as long as needed to resolve the request and keep a reasonable record.

We use a small number of cookies and similar technologies:

• Strictly necessary — to sign you in with Google/Firebase and to complete checkout with the payment provider.
• Functional — a cookie named sidebar:state remembers whether the dashboard menu is open (stored for 7 days).

We do not currently run Google Analytics, advertising pixels or cross-site tracking cookies. If that changes, we will update this Policy. You can also control cookies in your browser settings; blocking necessary cookies may stop login or payment from working. Full details are in our Cookies Policy.

We use HTTPS, access-controlled cloud services, and signed-in accounts for generation and payment. No online service is completely secure. Keep your Google account protected. Generated media is stored with a URL; do not share those links if you want the file to stay private.

If UK GDPR applies to you, you may ask us to access, correct, delete or restrict your personal data, to object to certain processing, and to receive a copy of data you provided (portability). You can also delete generated items from My Ads where that feature is available.

To use these rights, email support@cendroa.com from the address on your account. We may need to verify it is you. You can complain to the UK Information Commissioner’s Office at ico.org.uk.

Cendroa is for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

We may update this Policy when the product, providers or the law changes. The “Last updated” date at the top will change. Continued use after an update means you accept the revised Policy.

For any questions about this Privacy Policy or Cendroa, contact us at support@cendroa.com.