Privacy Policy

GarudX.AI ("we", "us") is the data controller for personal data processed through StickLab. For privacy inquiries or to exercise your rights, contact us at info@garudx.ai.

We collect the following categories of personal data:

• Identity and account data: name, email address, profile picture, and Google account identifier from OAuth sign-in.
• Profile data: display name, bio, title, social links, and avatar you choose to provide.
• Subscription and billing data: plan tier, subscription status, trial dates, Stripe customer and subscription identifiers. Payment card details are processed by Stripe and not stored on our servers.
• Usage data: sticker downloads, generation and remix history, credit balance and transactions, and feature interactions.
• AI interaction data: text prompts you submit for generation or remix. Reference images you upload are processed in memory to fulfill your request and are not persistently stored on our servers after processing.
• Technical data: session cookies, IP address, browser type, and device information necessary to operate and secure the Service.
• Local storage: liked sticker IDs may be stored in your browser local storage.

• Provide and operate the Service, including authentication, subscriptions, downloads, and AI generation.
• Process payments and manage credits through Stripe.
• Communicate with you about your account, billing, and service updates.
• Enforce our Terms, prevent fraud and abuse, and maintain security.
• Improve and develop the Service based on aggregated usage patterns.
• Comply with legal obligations.

If you are in the EU/UK, we process personal data on the following legal bases:

• Contract: To provide the Service you signed up for, including subscriptions and AI features.
• Legitimate interests: Security, fraud prevention, service improvement, and enforcing our Terms, balanced against your rights.
• Consent: Where required, such as non-essential cookies or marketing communications.
• Legal obligation: Where we must retain or disclose data to comply with law.

We share personal data with service providers who help us operate the Service:

• Google — OAuth authentication
• Supabase — authentication, database, and file storage
• Stripe — payment processing
• OpenAI — AI image generation and content moderation
• Hosting providers — application delivery and infrastructure

We do not sell your personal data. We may disclose data if required by law, to protect rights and safety, or in connection with a business transfer (merger or acquisition).

Your data may be processed in countries outside your residence, including India and the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions for transfers from the EU/UK.

• Account and profile data: retained while your account is active and for up to 30 days after deletion request to allow recovery and backup purge.
• Billing records: retained as required for tax, accounting, and legal compliance (typically up to 7 years where applicable).
• Usage and credit transaction logs: retained while your account is active and for a reasonable period thereafter for dispute resolution.
• Session cookies: expire when you sign out or after a defined session period.

Depending on your location, you may have the right to:

• Access a copy of your personal data
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to certain processing
• Data portability
• Withdraw consent where processing is consent-based
• Lodge a complaint with your local data protection authority

To exercise these rights, email info@garudx.ai. We will respond within the timeframe required by applicable law (typically 30 days under GDPR).

We use strictly necessary cookies for authentication and session management (Supabase auth cookies). We may use local storage for preferences such as theme and liked stickers. With your consent, we use Google Analytics cookies to understand how StickLab is used. See our Cookie Policy for details. Analytics cookies are only set after you choose "Accept all" in our cookie banner.

The Service is not directed to individuals under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact info@garudx.ai and we will delete it.

We implement reasonable technical and organizational measures to protect your data, including encryption in transit, access controls, and secure payment processing through Stripe. No method of transmission or storage is 100% secure.

We may update this Privacy Policy from time to time. We will post the revised policy with an updated date and notify you of material changes via email or in-app notice where required by law.

Privacy inquiries: info@garudx.ai

General support: info@garudx.ai