Privacy Policy

1. Introduction & Data Controller

Rupali AI ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our AI-powered media generation platform at rupali.ai ("the Service").

Data Controller:
Rupali AI
Address: Copenhagen, Denmark
Email: support@rupali.ai

For EU/EEA users, we act as the data controller for your personal information. This policy complies with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

AI Processing Providers (“AI Providers”)
To provide our AI-powered media generation features, we use third-party AI processing providers (“AI Providers”). These providers receive and process your prompts, parameters, and uploaded media solely for the purpose of generating outputs requested by you.
Current AI Provider: Runware (runware.ai)

We may update or replace our AI Providers in the future. Any such changes will be reflected in this Privacy Policy or in a publicly accessible list of subprocessors that we maintain.

2. Information We Collect

3. How We Use Your Information

4. GDPR Rights (EU Users)

If you are located in the European Union, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to certain data processing
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Lodge a Complaint: File a complaint with a supervisory authority

To exercise these rights, please contact us at support@rupali.ai. We will respond to GDPR data requests within 30 days.

4.1 Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a data protection supervisory authority. In the EU, you can contact the authority in your country of residence. Find your local data protection authority.

4.2 Age Requirements

You must be at least 18 years old to use Rupali AI. By using our service, you confirm that you are at least 18 years of age. We do not knowingly collect data from users under 18. If we become aware that data from a user under 18 has been collected, we will delete it immediately.

4.3 AI Training & Your Data

Rupali AI does NOT use your prompts or generated content to train our own AI models.Your creative content remains private and is primarily used to provide the service you requested.
Our AI Provider may temporarily store processing data (such as logs or metadata) for system performance, safety, caching, and abuse prevention, but they do not use your inputs or outputs to train their models unless explicitly stated in their own policies. Their handling of logs is governed by their privacy terms. We do not share your content with other third parties for AI training purposes without your explicit consent.

When you generate media using our Service, your prompts, parameters, and any uploaded media (e.g. images) are transmitted to our AI Provider for processing. Our AI Provider may operate servers in the EU or in other jurisdictions, depending on model availability and operational requirements.

We process certain metadata (e.g., content safety scores) to detect prohibited content. This processing is based on our legitimate interest in ensuring platform safety and compliance with legal obligations.

5. Data Retention

We retain your personal information only as long as necessary to provide our services and comply with legal obligations.

AI Provider Retention Policies
Our AI Provider may temporarily store processing data, technical logs (e.g., prompt processing logs or model error logs) for system performance, safety, caching, or abuse detection, as permitted under their policies. These logs are controlled by the AI Provider and subject to their retention policy.

6. Third-Party Services & Sub-Processors

We use the following third-party services to provide our platform:

SCCs = Standard Contractual Clauses | DPF = EU-US Data Privacy Framework

7. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit and at rest, secure authentication, and regular security audits.

8. International Data Transfers

We may transfer and process your personal data outside the EU/EEA. Transfers by our AI provider or other subprocessors may occur depending on server location and availability. Where required by law, we protect transfers using appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• EU-US Data Privacy Framework (DPF) for certified US companies
• Adequacy decisions for countries deemed adequate by the EU

All subprocessors enter into Data Processing Agreements (DPAs) containing appropriate safeguards for international transfers.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by email or through our service.