Privacy Policy
Effective date: October 14, 2026
This policy explains what personal data AiFika collects when you use aifika.com and the AiFika browser extension, why we use it, who receives it, how long we keep it and what rights you have. It goes together with our Terms of Service.
1. Who is responsible
AiFika is the controller of your personal data, which means we decide how and why it is used. For any privacy question or request, contact us at support@aifika.com. Our company details (legal name and registered address) are available on request at the same address.
2. What we collect
We collect only what the service needs:
- Account data: name, email address and a hashed password (for email sign-in), or your Google account identifier, name, email and profile picture (for Google sign-in); your referral code and who referred you; whether your email address is verified.
- Content you send and receive: prompts and messages, conversations and the models you chose, images and videos you generate, files you upload so a model can answer you, and the outputs of models and agents.
- Billing data: your plan, billing cycle, subscription status, credit balance and usage history, referral bonuses, and Stripe customer, subscription and payment identifiers. Card numbers go directly to Stripe and never reach us.
- Extension data: the extension tokens we issue (stored only as a hash), their scopes, when they were last used and the browser user agent.
- Guest purchase data: the email address you give for a one-time purchase, your query and its results.
- Technical data: IP address, browser and device information, request details and error logs, used for security, rate limiting and troubleshooting.
- Messages to us: what you write when you contact support.
Please do not put sensitive personal data (for example health data or other people’s personal data) in prompts or files unless you need to and are allowed to share it with AI providers.
3. Why we use it and our legal bases
Where the GDPR or similar laws apply, we rely on these legal bases:
- To provide the service (performance of a contract): creating and securing your account, signing you in, running your requests, storing your history and generations, managing credits, subscriptions and referral bonuses, and sending service emails such as verification links, guest result links and account notices.
- Legitimate interests: preventing fraud and abuse, enforcing our terms, keeping the service secure and reliable, fixing problems, and understanding aggregated usage so we can improve the service. We balance these interests against your rights.
- Legal obligations: keeping invoices and payment records for tax and accounting, and answering lawful requests from authorities.
- Consent: where we ask for it, for example for optional features; you can withdraw consent at any time.
We do not sell your personal data, we do not share it for cross-context behavioural advertising, and we do not use your content to train AI models. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. AI providers
To answer a request we send your prompt, the relevant conversation context and any files or images you attach to the provider that runs the model or agent you chose: OpenAI, Anthropic, Google, xAI, DeepSeek, Together, Replicate, Perplexity or Tavily. We do not send them your name, email address or payment details. Search agents send your query to their search providers.
These providers process the data under their own terms and privacy policies. Under their business or API terms they generally do not use API data to train their models, but they may keep it for a limited period for abuse monitoring. Some providers, such as DeepSeek, may process data in countries including China. If you do not want your data to go to a particular provider, do not choose its models.
5. Other service providers
We also use:
- Stripe for subscriptions and one-time purchases, including fraud prevention;
- Google for optional Google sign-in;
- Resend to send emails, such as verification messages and guest PDF links;
- Supabase (PostgreSQL database in the EU) to store account and application data;
- Vercel to host and serve the application;
- Upstash (when enabled) to count requests for rate limiting.
They receive only what they need for their task and act on our instructions or under their own privacy policies. We may also disclose data when the law requires it, to protect rights and safety, or to a successor if the service is sold or merged, in which case this policy continues to protect your data.
6. International transfers
Our database is hosted in the EU. Our AI, payment, email and hosting providers may process data in other countries, including the United States and, for some AI providers, China. When we transfer personal data out of the EU, EEA or UK, we rely on an adequacy decision (such as the EU–US Data Privacy Framework for certified providers) or on standard contractual clauses offered by the provider.
7. How long we keep data
- Account, conversations and generations: while your account is active, so you can use them. When you delete a conversation or message, it is hidden from you at once and removed from our systems in due course.
- After you close your account: we delete or anonymise your personal data within 30 days, except what we must keep by law.
- Billing records and invoices: as long as tax and accounting laws require, usually up to 10 years.
- Guest purchases: the result link works for 7 days; the purchase record is kept with our billing records.
- Extension tokens: until they expire or you revoke them.
- Security and server logs: for a limited period, usually no longer than 30 days, unless needed to investigate an incident.
Backups are overwritten on a rolling schedule, so deleted data may remain in them for a short time.
9. Your rights
Depending on where you live, you may have the right to:
- access your personal data and receive a copy in a portable format;
- correct inaccurate data;
- delete your data and close your account;
- restrict or object to some processing, including processing based on legitimate interests;
- withdraw consent at any time, without affecting earlier processing;
- complain to a data protection authority, for example in the EU country where you live or work.
To use these rights, write to support@aifika.com from the email address on your account. We may need to verify your identity and will reply within one month (or the time the law requires). We will not treat you differently for using your rights. Residents of California and other US states have similar rights to know, delete and correct their data and to opt out of sale or sharing; we do not sell or share personal data as defined by those laws.
10. Security
We use encrypted connections (HTTPS), hashed passwords and tokens, an ownership check on every record, strict access controls on our database, and rate limiting. No system is perfectly secure, so please use a strong, unique password and keep your tokens private. If a breach affects your personal data and puts you at risk, we will notify you and the authorities as the law requires.
11. Children
AiFika is only for people aged 18 or over, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy when the service or the law changes. We will update the effective date at the top and tell you by email or in the app about material changes before they take effect.
13. Contact
Privacy questions and data requests: support@aifika.com.