Privacy Policy

1. Who we are

PicX Studio (“PicX Studio”, “we”, “us”) is an AI image and video generation platform operated by TypeThink AI. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

It applies to picxstudio.com, the PicX Studio web application, our public API at api.picxstudio.com, our Model Context Protocol (MCP) connector at mcp.picxstudio.com, and our plugins and integrations for AI assistants such as ChatGPT, Codex and Claude.

For the purposes of the EU/UK General Data Protection Regulation (GDPR), TypeThink AI is the data controller for the personal data described here. You can reach us about any privacy matter at [email protected].

2. Information we collect

2.1 Account information

When you create an account we collect your email address, your display name, and a provider identifier from your sign-in method. We support Google Sign-In and email sign-in through our identity provider. We never receive or store your Google password. We do not store passwords for email sign-in either — authentication is delegated to our identity provider.

2.2 Prompts, uploads and generated content

To produce a generation we process the prompt text you write, any reference image, video or audio file you upload, the model and settings you choose, and the resulting output. Generated output is stored on our content delivery network so you can access it from your media library.

2.3 Billing information

Payments are processed by our payment providers: Freemius for card payments (Freemius acts as the reseller and merchant of record) and OxaPay for crypto payments. Subscriptions bought earlier through Dodo Payments continue to be processed by Dodo Payments. We receive a transaction record, the plan or credit pack purchased, the amount, and the status of the payment. We do not collect or store your full card number, CVV, or bank credentials — those are handled entirely by the payment provider.

2.4 Usage and technical data

• API and application request logs: endpoint called, model used, credits charged, response status, latency, and timestamp.
• Device and connection data: IP address, browser and operating system, referring URL, and pages viewed.
• Credential metadata for API keys and connector grants: the key prefix, scopes, creation and last-used time. We store only a cryptographic hash of an API key, never the key itself.

2.5 Support communications

If you contact support, we keep your message and our reply so we can resolve the issue and maintain a service history.

3. Why we process your data, and our legal basis

4. Using PicX Studio through ChatGPT and other AI assistants

PicX Studio can be connected to ChatGPT, Codex, Claude and other MCP-compatible assistants. This section describes exactly what happens to your data in that setup, because the data path differs from using our website directly.

4.1 How the connection is authorised

Connecting PicX to an assistant uses OAuth 2.1 with PKCE. You are taken to a PicX consent screen that names, in plain language, exactly what the assistant is asking permission to do — for example generating images, editing images, generating video, or uploading files. A connection is only created after you approve it. The assistant never receives your PicX password, and it never receives one of your long-lived PicX API keys. It receives a short-lived access token limited to the permissions you approved.

4.2 What we receive from the assistant

We receive only the parameters of the specific tool call the assistant makes — for example the prompt text, a model choice, a resolution, or the URL of an image to edit. We do not receive your chat history, and we do not receive any part of your conversation that is not passed into a PicX tool call. We have no access to your ChatGPT account, your other connectors, or your files outside what you pass to PicX.

4.3 What we send back

We return the result of the tool call: generated media URLs, generation status, model name, credit cost, and where relevant your credit balance or plan limits. Tool responses are deliberately scoped to what the request needs. We do not place authentication secrets, internal system identifiers, debugging payloads, or other users’ data into tool responses.

4.4 Credits and spending controls

Generations started from an assistant consume credits from your existing PicX balance, exactly as they would on our website. A connector grant carries a per-session credit ceiling, and higher-cost requests require explicit confirmation before any credits are spent.

4.5 Disconnecting

You can revoke a connection at any time from the assistant, or by contacting us. Revoking a connector grant immediately invalidates the credential behind it and does not affect API keys you created yourself. Once revoked, the assistant can no longer act on your account.

Your use of ChatGPT or any other assistant is also governed by that provider’s own privacy policy, which we do not control.

5. AI model providers and other processors

We do not run generative models on our own hardware. To fulfil a generation we transmit your prompt and any reference files to the model provider you selected, or to the default provider for that generation type. We share personal data only with providers that are necessary to run the service, under contractual data protection terms.

Each model provider processes your content under its own terms. Where a provider offers a no-training or zero-retention configuration for API traffic, we prefer it. We cannot, however, guarantee the internal retention practices of a third-party provider, so please do not submit sensitive personal data, health data, financial account data, or government identification in a prompt or upload.

We may also disclose data where we are legally required to, to enforce our terms, to protect our rights or the safety of others, or to a successor entity in a merger or acquisition (in which case we will notify you).

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

6. Your content, and model training

You keep ownership of what you create. See our Terms of Service for the licence terms that apply to generated content.

PicX Studio does not use your prompts, uploads, or generated content to train any AI model. We do not sell your content, and we do not publish it. Content you explicitly choose to make public — for example by sharing a generation or submitting it to a public gallery — is visible to others until you make it private again or delete it.

7. How long we keep data

• Account data — for as long as your account is open, then deleted within 30 days of a verified deletion request.
• Generated media and generation history — until you delete it, or until your account is deleted.
• Request and usage logs — retained on a rolling basis for security, abuse prevention and billing accuracy, then deleted or aggregated so they no longer identify you.
• Billing and tax records — retained for the period required by applicable tax and accounting law, which can extend beyond account closure.
• Revoked API keys and connector grants — the hashed record is retained for audit purposes; the credential itself stops working immediately.

8. Security

We protect data in transit with TLS and data at rest with AES-256 encryption. Access to production systems is role-restricted and logged. API keys are stored only as cryptographic hashes. Connector credentials are scoped, expiring, and rotated on each new grant. We operate an incident response process and, in the event of a confirmed breach affecting personal data, will notify affected users and regulators as required by law. Full detail is in our Security Policy.

To report a vulnerability, email [email protected]. We aim to acknowledge reports within 48 hours.

No method of transmission or storage is completely secure. You are responsible for keeping your account credentials and API keys confidential.

9. International data transfers

We operate globally and our providers are located in several countries, including the United States, the European Union and India. Where personal data is transferred out of the EEA, the UK or Switzerland, we rely on an appropriate transfer mechanism, such as the European Commission’s Standard Contractual Clauses or a finding of adequacy, together with additional safeguards where required.

10. Your rights

Depending on where you live, you may have the right to access a copy of your data, correct inaccurate data, delete your data, restrict or object to processing, withdraw consent, receive your data in a portable format, and not be discriminated against for exercising these rights.

How to exercise them: email [email protected] from the address on your account, stating what you would like to do. We will verify the request and respond within 30 days. If we need longer for a complex request, we will tell you why. There is no charge for a reasonable request.

Deleting your account: email [email protected] with the subject line “Delete my account”. We will confirm your identity, then permanently delete your account, generated media, generation history and personal data within 30 days, except records we must keep for tax or legal reasons. Deletion is irreversible, so download anything you want to keep first. Unused credits are forfeited on deletion and are not refundable.

California residents: the rights above cover the CCPA/CPRA rights to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of, but you may still submit a request. You may use an authorised agent.

EEA and UK residents: you may lodge a complaint with your local supervisory authority. We would appreciate the chance to resolve it with you first.

11. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the service, and understand how the product is used. Generating anything on PicX Studio requires a PicX account, and generation limits and credits are tied to that account.

You can block or delete cookies in your browser settings. Blocking strictly necessary cookies will prevent you from signing in and using the service.

12. Children’s privacy

PicX Studio is not intended for children. You must be at least 13 years old to use the service, and at least 18 to purchase credits or manage billing. We do not knowingly collect personal data from children under 13. If you believe a child has provided us personal data, email [email protected] and we will delete it.

13. Third-party links

Our service links to sites and services we do not operate. We are not responsible for their content or privacy practices, and we recommend reading the privacy policy of any site you visit.

14. Changes to this policy

We may update this Privacy Policy as the product and the law change. We will update the “Last updated” date at the top of this page, and for material changes we will give additional notice — by email or an in-product notice — before the change takes effect. Continuing to use PicX Studio after a change takes effect means you accept the updated policy.

15. Contact us

TypeThink AI — operator of PicX Studio
Privacy and data requests: [email protected]
Security reports: [email protected]
Web: picxstudio.com