# Privacy policy

> Read how account, payment, prompt, and media data are processed, disclosed, retained, and deleted, and how to request access or other privacy rights.

Canonical URL: https://imaginescenes.com/privacy-policy

Imagine Scenes uses account, payment, prompt, and media data to provide its creative workspace. Read which providers receive it, what is retained after deletion, and how to request access or other privacy rights.

## Data controller and contact

Imagine Scenes is operated by Wenkun Zhao, an individual seller operating under the laws of China. support@imaginescenes.com is our support and privacy contact, including for all privacy-rights requests, account requests, and product questions. The seller's business contact information is provided to the merchant of record for identity, tax, and regulatory review.

## Information we collect

We collect the email address and account credentials or identity-provider identifier used to create or sign in to an account; optional profile name and avatar; support communications; purchase, refund, subscription, credit, and transaction-reference records; prompts, uploaded reference media, generation settings, generation records, and output metadata; and technical and security information such as session identifiers, IP address, browser and device information, request timestamps, and error or abuse-prevention logs. We do not store full payment-card numbers.

## How we use information

We use personal information to create and secure accounts, provide and improve the studio, process and reconcile payments, deliver support and service notices, prevent fraud and prohibited use, comply with legal obligations, and protect the service. We process account and service data to perform our contract with you; security, reliability, and service improvement data for legitimate interests; payment, tax, and recordkeeping data for legal obligations; and optional marketing only with consent where consent is required. We may use aggregated or de-identified information for analysis.

## Service providers and disclosures

We do not sell personal information. We disclose information only as needed to provide the service, including to Cloudflare for hosting, databases, media storage, and Turnstile security checks when anonymous requests show signs of abuse; Google or GitHub when you choose their sign-in service; Resend to send authentication emails; Creem and Waffo Pancake when they process a purchase or screen a generation prompt for safety; and the selected third-party AI model provider, including API Mart or Kie where applicable, to process prompts, reference media, settings, and generation requests. Providers may process information under their own terms and privacy policies. We may also disclose information when required by law, to protect rights or safety, with your direction, or in a business transfer subject to continuing protections. Payment-card credentials do not pass through or remain on our servers.

## Cookies and similar technology

We use cookies or similar session technology to keep you signed in, secure requests, and operate core features. For anonymous image, video, and dedicated image-tool trials, the browser computes a fingerprint locally. Our server stores a project-specific hash, the tool, a guest session identifier, the generation reference, trial status, and timestamps to limit each browser to one successful free generation per tool even after cookies are cleared. Raw fingerprint components are not sent to our server, and the fingerprint library does not contact a third-party identification service. Successful trial records are retained for abuse prevention; failed generations release the free try. The guest cookie controls access to your uploads and downloads. To identify suspicious anonymous requests, we store project-specific hashes of network addresses, guest identifiers, and fingerprints, with request counters and timestamps. These risk signals expire after 24 hours and are removed by bounded scheduled cleanup; this is separate from successful trial records. Repeated anonymous requests, frequent fingerprint changes, or repeated failed security checks can pause free generation and uploads from the same network address for one hour, including shared networks. We store the project-specific network hash and cooldown expiry, then remove expired cooldowns through scheduled cleanup. Suspicious generation or upload requests may require Cloudflare Turnstile, which receives browser security signals and the network address to verify the request. A successful upload check can cover a small batch for up to two minutes; it does not grant another free generation. We do not currently use advertising cookies. If we add optional analytics or marketing technology, we will identify it here and provide any consent or opt-out controls required by applicable law.

## Security

We use HTTPS/TLS in transit, hashed authentication secrets where applicable, signed and time-limited authentication and media-access links, access controls, and operational logging designed to protect the service. No system is perfectly secure. If a security incident creates a material risk to your rights, we will notify affected people and regulators as required by applicable law.

## Retention and deletion

Account, profile, session, identity-link, generation-record, and stored-media data are deleted when you delete your account; media is deleted from our storage as part of that process. You may also delete individual creations. Except for the short-lived anonymous risk signals described above, we retain transaction, refund, credit-ledger, tax, dispute, customer-support, security, and moderation-audit records indefinitely for accounting, fraud prevention, disputes, security, and legal-compliance purposes. Authentication links expire after five minutes; sessions expire after 30 days unless renewed.

## Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, objection to processing based on legitimate interests, withdrawal of consent, or a portable copy of your personal information. Email support@imaginescenes.com, our designated privacy contact, from the account email with the request type and details. We may verify your identity and respond within 30 days where applicable. You may also complain to your local data-protection authority.

## International transfers, children, and third parties

Our infrastructure and providers may process information in countries other than yours. Where required, we use appropriate transfer safeguards such as contractual commitments and transfer mechanisms made available by the relevant provider. The service is for people aged 18 or older; we do not knowingly collect personal information from children. Third-party sites and providers have their own privacy practices, which this policy does not control.

## Changes to this policy

We will update this page and its Last updated date when this policy changes. For material changes, we will provide at least 15 days' advance notice by email or through the service when legally required or reasonably practicable.

Updated: 2026-10-01