Privacy Policy

The controller of your personal data is SIDEK GROUP DIGITAL LLC, a limited liability company registered in Wyoming, USA, 5830 E 2nd St, Ste 7000, Casper, WY 82609, USA. For any privacy question or request, write to privacy@example.com.

[TO CONFIRM: We will name our representative in the EU and in the UK here before we sell to customers there.]

This policy covers the MegaScenes website and app. You must be at least 18 to use MegaScenes; it is not meant for children and we do not knowingly collect data from anyone under 18. If you believe a minor has given us data, write to us and we will delete it.

• Account data: your name and email address, and your password stored only as a hash (never in plain text). If you sign in with Google, we receive your name, email address and profile picture from Google instead of a password.
• Content: the prompts you write, the files you upload as references, the settings you choose and the outputs the models generate for you.
• Usage data: the generations you run (model, settings, status and price), your credit history, technical logs, your IP address, your browser and device (user agent) and the country we derive from it.
• Payment data: payments are handled by Whop. We receive the payment status, the amounts, the payment and order identifiers and the country of your card. To allow one discounted first week per card, we also receive a card fingerprint from Whop: a code that tells two payments with the same card apart from others without revealing the card number. We never receive or store your full card number.
• Marketing attribution, only with your consent to analytics cookies: how you first reached us, which means UTM parameters, Google and Meta click IDs (gclid, fbclid), the referring website, the page you landed on and any referral code. When you sign up, we save this on your account.
• Messages: what you write when you contact us.

• To provide the service (contract): create and run your account, send your requests to the models, store and show your outputs, keep your credit balance, process purchases and answer support requests.
• To keep the service safe (legitimate interests): prevent fraud and abuse, moderate content as described in our Acceptable Use Policy, secure accounts and fix errors.
• To meet legal duties (legal obligation): keep accounting and tax records, answer lawful requests from authorities, and report child sexual abuse material where the law requires it.
• To measure our marketing and improve the product (consent): understand which channels bring visitors and sign-ups, and which pages and steps people use, with the analytics cookies, the attribution data above and PostHog. When you are signed in, PostHog links these events to your account number, never to your email. You can withdraw consent at any time.

We send you emails about your account, such as the address confirmation and password resets. You can download the receipt of every payment from your billing page. We do not send marketing emails. If we start, we will ask for your consent first and every email will have an unsubscribe link.

We do not use your prompts, uploads or outputs to train AI models. We do not sell your personal information. We do not send your personal data, click identifiers or conversions to advertising platforms such as Google Ads or Meta.

We use these providers to run MegaScenes. They process data on our behalf unless noted otherwise.

What happens to your prompts and files at the inference providers

To generate an output, we send your prompt, your reference files and your settings to an inference provider, which runs the model you picked. Here is what fal.ai’s published terms say:

• fal’s API Services Terms say that fal will not use the content we send it to create, train or develop its products or services. This does not apply to models that fal marks as “Pending Enterprise Ready”; none of the models we offer through fal carried that label when we last checked, on October 22, 2026.
• For all our models except the image upscaler, fal passes the request to the model’s maker through the maker’s own API. In that case your content is transferred to that company, which processes it under its own terms.
• fal’s Terms of Service let fal use anonymised or aggregated usage data, which may be derived from inputs, to run and improve its services and models.
• fal’s Data Processing Addendum says fal keeps the personal data we send it until our agreement with fal ends, unless agreed otherwise, and deletes it after that if we ask.

Runware processes requests under its own terms. Its terms say it takes no licence in the outputs and does not use them, and that it does not keep outputs long term: the copies it creates are deleted after 7 days by default. Its terms do not say whether the prompts and files we send it may be used to improve its services.

Whop

Whop collects your payment details at checkout and decides how to process them as an independent controller, under its own Privacy Policy. It shares with us only what we need to record your purchase, as listed above.

Other disclosures

We disclose data to authorities when the law requires it, for example reports of child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC). If our business is sold or merged, your data may pass to the new owner, who must respect this policy; we will tell you before that happens.

We are based in the United States and our main providers process data there. If you live in the EU, the EEA, the UK or Switzerland, your data is transferred to the United States. Railway, PostHog, Resend and Google are certified under the EU-U.S. Data Privacy Framework and its UK Extension. With fal.ai and with Tigris, Railway’s storage provider, the transfer relies on the European Commission’s Standard Contractual Clauses and the UK transfer addendum in their data processing agreements. Whop collects your payment data directly, as an independent controller, under its own privacy policy. You can ask us for a copy of the safeguards that apply.

• Account data: as long as your account exists.
• Uploads and outputs: until you delete them in the library or close your account. We keep no backup copies of files, so once deleted they cannot be restored. Database backups, which can contain your prompts and account records, are deleted automatically within 30 days.
• Technical logs, including IP address and browser details: 90 days. The IP address used to sign up and to pay: as long as your account exists, to prevent fraud; if you close the account within a day of a payment, the address of that payment is kept until a day has passed since the payment.
• Payment and credit records: 7 years after the year of the transaction, as US tax law may require.
• Deleted accounts: we keep a one-way hash of the email address, so that the address cannot get the discounted first week again on a new account, for as long as we keep the payment records.
• Attribution data: as long as your account exists. If you withdraw consent, we also delete the attribution data saved on your account.
• Records of serious abuse, such as reports to authorities: as long as the law requires.

We use a small number of first-party cookies. Essential cookies are needed for the site to work. Analytics cookies are set only if you accept them, and you can change your choice at any time with “Cookie settings” at the bottom of every page. If you withdraw consent, the analytics cookies are deleted on your next visit. With your consent, PostHog also keeps the same visitor and session ID in your browser’s local storage.

If we add other cookies, we will update this list and ask for your consent where the law requires it.

If you are in the EU, the EEA or the UK

Under the GDPR and the UK GDPR you can ask to access your data, correct it, delete it, restrict or object to its use, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time; this does not affect what we did before. You can also complain to the data protection authority where you live or work.

If you are in California or another US state with a privacy law

Under the CCPA/CPRA and similar laws you can ask to know what personal information we collect, use and disclose, to delete it and to correct it. We do not sell your personal information. You can use an authorised agent, and we will not treat you differently for exercising your rights.

How to make a request

Write to support@example.com from the email address on your account. We may ask you to confirm your identity. We answer within one month under the GDPR and within 45 days under the CCPA, and tell you if we need more time as the law allows. You can download your outputs from your account at any time.

We encrypt data in transit with HTTPS, store passwords only as hashes and limit access to personal data to the people who need it to run the service. No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.

We will update this policy when our practices or the law change, and change the date at the top. If a change matters to you, we will tell you by email or in the app before it takes effect.

SIDEK GROUP DIGITAL LLC, 5830 E 2nd St, Ste 7000, Casper, WY 82609, USA. Email: support@example.com.