Privacy Policy

This Privacy Policy explains how Solart ("we", "us") collects, uses, shares, stores and protects your personal data when you use the Service, and the rights you have. This Policy forms part of the Terms of Service, and capitalized terms have the meanings given in the Terms of Service.

1. Scope and consent

• This Policy applies to all personal data processed through the Solart website, applications and services.
• By signing up, signing in or using the Service, you consent to us processing your personal data for the purposes, to the extent and in the ways described in this Policy, including transfers abroad under Section 8.
• If you do not agree, please do not use the Service.

2. Data we collect

Data you provide:

• Account information: your email. If you sign in with Google, we also receive your name and profile picture from your Google account.
• Input: prompts, template inputs, reference images you upload and descriptions you send to the prompt enhancer.
• Communications: emails, complaints, transfer receipts and other information you send when contacting support.

Data generated when you use the Service:

• Output you create, your generation history and Community sharing status.
• Credit top-up, deduction and refund history and your orders.
• Payment information provided by banks or payment reconciliation services: amount, time, transfer description, transaction ID and sender account details where provided by the bank.
• Consent records: the time you ticked the box accepting the Terms of Service and Privacy Policy when signing in.
• Technical data: IP address at signup and sign-in, browser and device type, access times, system logs and error logs.

Data we do not collect:

• Passwords (the Service does not use passwords), card numbers or bank login details.
• We do not extract biometric identifiers from photos you upload and do not use photos for facial recognition. Photos are only sent to Model providers to generate the Output you request.
• We do not intentionally collect sensitive personal data. Please do not include health or financial information, identity documents or other people's information in prompts or uploads. If you choose to include it, you consent to us processing it under this Policy.

3. How we use data

• Providing the Service: authenticating sign-in, generating Output, storing and displaying your history, and sharing to Community when you choose to.
• Payments: processing orders, reconciling transactions, adding, deducting and refunding credits, and handling payment complaints.
• Communication: sending sign-in codes by email, sending in-app notifications about your account, transactions and changes to the Service, and responding to support requests.
• Safety and compliance: detecting and preventing fraud, bonus abuse, multiple accounts, unauthorized access and prohibited content; investigating violations of the Terms; protecting the legitimate interests of us and our users; and meeting legal obligations and requests from competent authorities.
• Operations and improvement: monitoring performance, fixing errors and producing aggregated usage statistics.

We process data based on your consent, to perform our service contract with you, to comply with legal obligations and in other cases permitted by law.

• We do not use your Input or Output to train AI models.
• We do not sell your personal data and do not use it for third-party advertising.

4. Who can access data

• Authorized Solart staff: only when needed to support you, reconcile payments, moderate content, handle violations or keep the system secure, and they are bound by confidentiality.
• Model providers: receive the Input needed for each generation or prompt enhancement.
• Infrastructure providers: servers, databases, cloud storage and content delivery networks.
• Email delivery providers: to send sign-in codes.
• Google: when you choose to sign in with Google, under Google's policies.
• Banks and payment reconciliation services: to record bank transfers.
• Competent authorities: when required by law, or when necessary to protect the rights, property or safety of us, our users or the public.
• Successors: in a merger, acquisition, restructuring or transfer of the Service, data may be transferred to the successor, which remains bound by this Policy.

Third parties only receive the data they need and process it under their contracts and policies. We are not responsible for independent processing by third parties outside our control.

5. Public content

• By default, only you can see your Output.
• When you share to Community, the Output is public along with your display name. The prompt is only shown if the Output was created in custom prompt mode. Your email, uploaded photos and template inputs are never shown publicly.
• Public content may be viewed, downloaded or captured by others, or cached by search engines. Stopping sharing removes the content from the Service, but we cannot recall copies made by third parties.

6. Other people's personal data

• When you upload photos of or describe other people, you warrant that you have their valid consent. We process that data on your instructions and only to generate your Output.
• People whose data was put on the Service without permission may request deletion at [email protected], with enough information to identify the content. We will delete the data and related Output, even without the Account owner's consent, and may lock the violating Account.
• We do not use other people's photos or data that you upload for any other purpose.

7. Retention

• Output files and uploaded photos: 3 days from creation, then deleted automatically. Output shared to Community is kept until you stop sharing it or we remove it.
• Output you delete stays in Trash for a limited time before being permanently deleted.
• Account information, generation history and credit history: for as long as your Account exists.
• Sign-in codes: valid only for a short time and stored only in one-way hashed form.
• Sign-in sessions: until they expire or you sign out.
• Payment transaction data: for the period required by accounting and tax law, including after your Account is deleted, in a form no longer linked to your email.
• System logs and anti-fraud data: for as long as needed for security and investigating violations, which may extend beyond Account deletion to prevent abuse.
• System backups may contain deleted data for a limited time until they are overwritten on rotation.
• Data needed to resolve complaints, disputes or requests from authorities is kept until the matter is closed.

8. International transfers

Some Model providers and infrastructure providers operate servers outside Vietnam. By using the Service, you consent to the necessary data being transferred, stored and processed outside Vietnam. Such transfers are carried out in accordance with Vietnamese law on cross-border transfers of personal data.

9. Security

• We apply appropriate technical and organizational measures: HTTPS encryption in transit, sign-in sessions and sign-in codes stored in one-way hashed form, access keys for external services encrypted at rest, and administrative access limited to necessary staff.
• No system is completely secure. We cannot guarantee that data will never be accessed without authorization, and we are not liable for incidents caused by you, such as exposing your inbox or device, or by causes beyond our reasonable control.
• In the event of a personal data breach, we will notify the competent authorities and affected users as required by law.

10. Your rights

Under personal data protection law, you have the right to:

• Be informed about the processing of your data, through this Policy.
• Access your data: view your account information, generation history and credit history directly in the Service.
• Rectification: request corrections to inaccurate data at [email protected].
• Deletion: delete individual Output in Generation history, or delete your entire Account in Account > Security.
• Withdraw consent, restrict or object to processing, or request a copy of your data: send a request to [email protected].
• Lodge complaints or take legal action as provided by law.

When exercising these rights:

• We may ask you to verify that you own the Account before acting, and may refuse requests that cannot be verified, are repetitive or abusive, affect the rights of others or are unlawful.
• Valid requests are handled within the time limits set by law.
• Withdrawing consent or requesting deletion of data necessary to provide the Service means your Account can no longer be used. Withdrawal does not affect the lawfulness of processing carried out before it.
• Some data is retained after deletion as described in Section 7. Remaining credits are forfeited when your Account is deleted.

11. Children

The Service is not intended for people under 16. People aged 16 to under 18 may only use it with the consent of a parent or guardian. If we learn that an Account belongs to someone under 16, we will delete the Account and related data. Parents or guardians may contact [email protected].

12. Cookies and browser storage

On your first visit, we show a cookie notice with two choices: Necessary only or Accept all. Your choice is kept for 12 months, after which the notice appears again. You can change it at any time by clearing Solart's cookies in your browser.

Necessary cookies, always used because the Service cannot work without them:

• Session cookie: keeps you signed in, until the session expires or you sign out.
• Google sign-in protection cookie: prevents forged sign-in requests, deleted after 10 minutes.
• Language cookie: remembers the interface language you chose, kept for 12 months.
• Cookie choice cookie: kept for 12 months.

Cookies used only if you choose Accept all:

• Time zone cookie: shows dates and times in your local time, kept for 12 months. If you choose necessary cookies only, dates and times are shown in Vietnam time.

In addition:

• Browser storage: saves preferences and drafts on your device and is not sent to our servers.
• As of the date of this Policy, we do not use third-party advertising or tracking cookies. If you block cookies, you will not be able to sign in.

13. Third-party links

The Service may contain links to third-party websites or services. We do not control and are not responsible for their content or how they process your data.

14. Changes to this Policy

• We may update this Policy. The date of the latest update is shown at the top of this page.
• For material changes, we will notify you on the Service before the change takes effect. By continuing to use the Service afterwards, you accept the updated Policy.

15. Contact

Send personal data requests, complaints or security incident reports to [email protected].