Privacy Policy

PikPook ("we," "our," or "us") operates the PikPook platform accessible at pikpook.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

By using PikPook, you agree to the collection and use of information in accordance with this Policy. If you disagree with any part of this Policy, please discontinue use of our Service.

We are committed to GDPR compliance (for EU/EEA users), the Information Technology Act 2000 (for Indian users), and applicable data protection laws in all jurisdictions we serve.

Account Information: When you create an account, we collect your name, email address, and password (stored as a secure hash). If you sign in via Google or GitHub OAuth, we receive your name, email, and profile picture from those providers.

Payment Information: When you purchase token packs, payment is processed by Stripe or Razorpay. We receive a transaction confirmation and your billing country but never store your full card number, CVV, or bank account details.

Usage Data: We log API requests, generation history (prompts, model used, settings, output metadata), token balance changes, and feature interactions. This data is used to operate the Service, detect abuse, and improve quality.

Generation Content: Prompts you submit and AI outputs generated are temporarily stored to enable your gallery and download features. You control deletion of your generated content.

Technical Data: IP address, browser type, operating system, device identifiers, page views, session duration, and referral URLs. Collected automatically via server logs and cookies.

Communications: If you contact our support team or submit feedback, we retain your messages and our replies.

Service Operation: To authenticate your account, process purchases, credit tokens, queue and process AI generation jobs, deliver results to your gallery, and maintain your transaction history.

Quality & Safety: To detect and prevent fraud, abuse, and violations of our Terms of Service; to identify and filter prohibited content types; to ensure platform stability and performance.

Improvement: To analyze aggregate usage patterns, identify popular features, troubleshoot issues, and guide product development decisions. We use anonymized, aggregated data for this purpose.

Communications: To send you account-related notifications (email verification, password resets, purchase confirmations, generation completion alerts). Marketing emails require your explicit opt-in and can be withdrawn at any time.

Legal Obligations: To comply with applicable laws, respond to lawful requests from government authorities, and enforce our Terms of Service.

Essential Cookies: Required for authentication (JWT session tokens) and security (CSRF protection). Cannot be disabled without breaking login functionality.

Analytics Cookies: We use privacy-first analytics (no third-party ad trackers) to understand aggregate usage. These can be disabled via our cookie banner without affecting core functionality.

No Ad Tracking: We do not use Facebook Pixel, Google Ads conversion tracking, or any third-party advertising cookies. We do not sell your browsing data or behavioral profiles.

You can manage cookie preferences through your browser settings or our in-app cookie consent banner.

AI Model Providers: When you generate content, your prompt and settings are transmitted to the relevant AI provider (OpenAI, Stability AI, Runway ML, etc.) to process your request. Each provider handles data under their own privacy policy. We transmit only what is necessary to fulfill the generation request.

Payment Processors: Transaction details are shared with Stripe and/or Razorpay to process payments. We never receive or store your full card details.

Cloud Infrastructure: We use AWS for file storage (S3) and compute. Files at rest are encrypted using AES-256.

We Do NOT Sell Your Data: We do not sell, rent, or trade your personal information or usage data to any third party for advertising, marketing, or analytics purposes.

Legal Disclosure: We may disclose your information if required to do so by law, court order, or government request, or to protect the rights, property, or safety of PikPook, our users, or the public.

Account Data: Retained for the duration of your account. Upon account deletion, your personal data is deleted within 30 days, except where retention is required by law.

Generated Content: Stored for 90 days after generation. You can delete individual images, videos, or audio files at any time from your Gallery.

Transaction Records: Retained for 7 years as required by financial regulations (GST/IT Act compliance in India; similar in other jurisdictions).

Log Data: Server logs containing IP addresses and request metadata are retained for 90 days for security and debugging purposes, then permanently deleted.

We implement industry-standard security measures including: TLS 1.3 encryption for all data in transit; AES-256 encryption for data at rest on AWS S3; bcrypt hashing for passwords; JWT tokens with short expiry and secure refresh flows; rate limiting and IP-based abuse detection; regular security audits.

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security and are not liable for unauthorized access beyond our reasonable control.

Access: You may request a copy of all personal data we hold about you.

Correction: You may update or correct your account information at any time via Settings.

Deletion: You may delete your account and all associated data. Some data may be retained for legal compliance (e.g., transaction records).

Portability: You may request an export of your generated content and account data in machine-readable format.

Opt-Out: You may opt out of marketing emails at any time via the unsubscribe link in any email, or via your account Settings.

GDPR Rights (EU/EEA users): Right to object to processing, right to restrict processing, right to lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at privacy@pikpook.com. We respond to all requests within 30 days.

PikPook is not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@pikpook.com so we can delete the information.

Users between 13 and 18 years of age may use PikPook only with verifiable parental or guardian consent.

PikPook is operated from India and uses cloud infrastructure (AWS) with regions in the US, EU, and Asia. By using our Service, you consent to the transfer of your data to these regions.

For EU/EEA users, we ensure appropriate safeguards are in place for international transfers in accordance with GDPR Chapter V, including Standard Contractual Clauses where applicable.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email (to your registered address) and by displaying a notice on our platform at least 14 days before changes take effect.

The "Last Updated" date at the top of this Policy reflects the most recent revision. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

For privacy-related inquiries, data requests, or complaints, contact our Privacy Officer at: privacy@pikpook.com.

For general support: support@pikpook.com.

Registered address: PikPook Technologies Pvt. Ltd., Bengaluru, Karnataka, India.