Reference photos are sensitive by nature, so we collect as little as the product can run on. This page sets out exactly what is stored, what is only passed through, and what you can ask us to delete.
Last updated 2 August 2026 · Operated by Darkroom AI Studio · Western Australia, Australia
This policy explains what Darkroom AI Studio collects when you use Darkroom AI Studio, why, and what you can ask us to do about it. Photos of faces are personal information, and in Australia biometric-style data is treated as sensitive — so we keep collection deliberately narrow.
Account data: your email address, hashed password (handled by our authentication provider), plan, and account timestamps.
Reference photos and prompts: the images you upload and the scene descriptions you write, for as long as it takes to run the request.
Usage records: for each generation we store the AI provider and model, image count, quality, estimated and actual cost, how long it took, and whether it succeeded. This is billing and cost data — it does not include your photos.
Billing data: subscription status, period dates and payment events from Stripe. Card numbers never reach our systems.
Anti-abuse signals: we use reasonable technical measures, including device, browser and network signals, to help detect repeated free-trial abuse. In practice that means a browser fingerprint, a device identifier stored in your browser, and a one-way hash of your IP address. We store the hash, not the address, and we cannot reverse it.
We do not store your uploaded reference photos or finished renders on our servers after the request completes — they are processed in memory and returned to your browser. Save anything you want to keep.
We do not sell personal information, we do not use your photos to train AI models, and we do not run advertising trackers.
Our AI provider processes your reference photos and prompts to produce a render. Images are sent for that purpose only.
Our cloud and database provider hosts the application, accounts and usage records.
Stripe processes payments and holds your billing details under its own privacy terms.
These providers may process data outside Australia. We only use providers that commit to appropriate protections.
Photos and prompts: only for the duration of the request.
Account, usage and billing records: while your account is open, and afterwards only as long as we need them for tax and accounting obligations.
Anti-abuse signals: while your account is open, then deleted with it.
Accounts are protected by password authentication. Every database table enforces row-level access rules, so an account can only read its own data; administrative access is limited and role-checked on the server.
API keys and payment secrets live only on the server and are never sent to your browser. Traffic is encrypted in transit.
No system is perfectly secure. If a breach affects you, we will notify you and, where required, the OAIC under the Notifiable Data Breaches scheme.
You can ask for a copy of the personal information we hold, ask us to correct it, or ask us to delete your account and its data. Deletion removes your account, usage history and anti-abuse signals.
Clearing your browser storage removes the device identifier we set, though this may cause new-device checks to run again.
Requests and complaints: privacy@darkroomaistudio.com. If you are unhappy with our response, you can escalate to the Office of the Australian Information Commissioner.
We use only what the product needs: a session cookie to keep you signed in, and a device identifier used for free-trial abuse detection. There are no advertising or third-party analytics cookies.
We will update this page when our practices change and revise the date at the top. Last updated 2 August 2026.