1. Data we collect
- Account data: email address, Google account identifier, profile image, and login sessions.
- Service content: conversation inputs, model outputs, generated media locations, and conversation history.
- Billing data: orders, subscription status, credit ledger entries, and payment event identifiers. Creem processes full card numbers, expiration dates, and CVC values; OFR AI does not store them.
- Security and operational data: IP address, request time, error codes, and necessary audit logs.
- Product analytics: page path and a limited event name for conversion and reliability measurement. We do not send prompts, email addresses, or advertising identifiers with analytics events.
2. How we use data
We use this data to provide authentication and model services, synchronize payments and subscriptions, calculate usage, prevent fraud, diagnose faults, and meet legal and financial obligations. We do not sell personal data.
3. Service providers
Data may be sent as needed to Google for authentication, Creem for payments, Qiniu Cloud for encrypted-access media storage, and the AI model provider that you select. Providers may process data in other regions. Do not submit confidential or sensitive information that should not be processed by a third party.
4. Retention
Conversation content and generated media are retained until you delete them or your account. First-party analytics events are retained for up to 90 days. Trial-abuse network hashes are retained briefly. Payment, tax, and dispute records that must be retained by law are de-identified and kept until the applicable retention period expires.
5. Security measures
The production service uses HTTPS, HttpOnly and Secure cookies, access controls, rate limits, database backups, and payment webhook signature verification. No system can guarantee absolute security. We will handle and provide notice of security incidents as required by law.
6. Your rights
You can review your history and credit ledger and permanently delete your account from the account menu. Deletion cancels active subscriptions and removes conversations; legally required payment records are retained in de-identified form. For access, correction, or other data requests, contact support@ofrai.xyz.
7. Cookies
We use only cookies and browser storage needed to maintain login sessions, protect OAuth flows, store essential preferences, and create a tab-scoped analytics session. We do not use third-party advertising tracking cookies, and analytics respects Do Not Track.