Privacy Policy

1. Who We Are

Erosia is operated by The Erosia Team ("the Operator"). For privacy-related inquiries, contact us at noreply@erosia-ai.com.

2. Data We Collect

We collect the following personal data:

• Account data: email address, authentication provider (Google OAuth or email/password)
• Payment data: processed by Stripe — the Operator does not store card numbers; only your Stripe customer ID is stored
• Usage data: generated content (images/videos), credit transactions, subscription status
• Technical data: IP address, browser type, device type (collected automatically)

3. How We Use Your Data

The Operator uses your data to:

• Provide and operate the Erosia service
• Process payments and manage subscriptions
• Send transactional emails (account confirmation, purchase receipts)
• Comply with legal obligations
• Prevent fraud and abuse

4. Legal Basis (GDPR)

The Operator processes your data under the following legal bases:

• Contract performance: to provide the service you signed up for
• Legitimate interests: security, fraud prevention, service improvement
• Legal obligation: tax and financial record keeping
• Consent: for any optional communications

5. Data Storage and Transfers

Your data is stored in the European Union and processed through the following categories of third-party services:

• Authentication and database provider — stores account data and generated content (EU)
• AI compute provider — processes prompt text and uploaded images for generation purposes only; data is not retained after processing (US)
• Stripe — payment processing (US/EU) — governed by Stripe's Privacy Policy
• Web hosting provider — serves the application (US/EU edge network)
• Email delivery provider — sends transactional emails (US)

Where data is transferred outside the EU, the Operator relies on Standard Contractual Clauses (SCCs) or equivalent safeguards provided by each processor.

6. Data Retention

The Operator retains your account data for as long as your account is active. Generated content (images/videos) is stored in your account gallery. Credit transaction history is retained for tax and accounting purposes for a minimum of 5 years as required by European Union law. You may request deletion of your account and personal data at any time.

7. Your Rights (GDPR)

As an EU resident, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Restriction — request the Operator limits processing of your data

To exercise any of these rights, contact the Operator at noreply@erosia-ai.com. The Operator will respond within 30 days. You also have the right to lodge a complaint with the European Union Information Commissioner (IP EU) at https://commission.europa.eu/index_en.

8. Cookies

The Operator uses cookies for authentication and session management. For full details, see our Cookie Policy.

9. Children's Privacy

Erosia is not intended for users under 18. The Operator does not knowingly collect data from minors. If the Operator becomes aware that a minor has created an account, it will be deleted immediately.

10. Changes to This Policy

The Operator may update this Privacy Policy from time to time. Users will be notified of significant changes via email. Continued use of the Service after changes constitutes acceptance.