Privacy Policy

Sulf is operated by [Official legal entity name] (registration number [Company registration number]), [Street address], [Postal code] [City], [Country]. We are the data controller for the personal data described in this policy.

For any privacy question or request, contact us at support@nzyre.studio.

• Account data: email address, username, display name, avatar and authentication details.
• Content: prompts, uploaded images, templates you submit, and the images and videos you generate.
• Billing data: plan, credit balance and purchase history. Payment card details are collected and held by Paddle, not by us.
• Support data: messages you send through the support chat or by email.
• Technical and security data: IP address, browser and device type, timestamps and actions such as sign-ins, generations and credit changes.

• To provide the Service — run your account, process generations and store your creations (performance of a contract).
• To handle purchases — grant credits and subscriptions and keep billing records (contract and legal obligation).
• To keep the platform secure — prevent fraud, abuse and credit misuse (legitimate interests).
• To support you — answer questions and resolve issues (contract and legitimate interests).
• To send product updates — only where you agreed, and you can opt out at any time (consent).

We do not sell your personal data, and we do not use it for third-party advertising.

We share data only with service providers that help us run the Service, under contracts that require them to protect it:

AI providers receive only the inputs needed to produce the output you requested. We may also disclose data when required by law or to protect our rights and users.

Some sub-processors are located outside the European Economic Area and the UK, including in the United States. Where this happens we rely on adequacy decisions or the European Commission's Standard Contractual Clauses (and the UK addendum) to protect your data.

• Account data and creations — kept while your account is active and deleted within 30 days after you delete your account.
• Security and anti-abuse activity logs — kept for 90 days, then deleted automatically, unless needed longer to investigate a specific security incident.
• Billing records — kept as long as tax and accounting laws require. Paddle keeps its own records as Merchant of Record.
• Support conversations — kept while your account is active so we can help you with follow-up questions.

We use strictly necessary cookies to keep you signed in and secure your session, and your browser's local storage to remember preferences such as light or dark mode. We do not use advertising or cross-site tracking cookies. Paddle may set its own cookies during checkout to process payments and prevent fraud.

If you are in the EEA or the UK, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Port your data to another service in a machine-readable format.
• Restrict or object to certain processing, including processing based on legitimate interests.
• Withdraw consent at any time, where processing is based on consent.

You can also lodge a complaint with your local data protection authority.

If you are a California resident, you have the right to:

• Know what personal information we collect, use and disclose.
• Request deletion or correction of your personal information.
• Opt out of the sale or sharing of personal information — we do not sell or share it for cross-context behavioural advertising.
• Not be discriminated against for exercising these rights.

We may need to verify your identity before acting on a request. We respond within one month (GDPR) or 45 days (CCPA), and will tell you if we need an extension allowed by law. Exercising your rights is free of charge.

We protect your data with encryption in transit (HTTPS), access controls, row-level security on our database and activity logging. No system is completely secure, but we work to protect your data and will notify you and the relevant authorities of a personal data breach where the law requires.

The Service is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy from time to time. We will post the new version here, update the "Last updated" date and, for significant changes, notify you by email or in the product. See also our Terms & Conditions.