Privacy Policy

We collect personal data that you provide directly, data generated as you use Gallery, and a limited amount of data collected automatically through your device. We group it into the following categories:

• Account data: your name, email address, authentication identifiers, workspace and organization names, the role assigned to you within a workspace, and account preferences. This is the information needed to create and secure your account.
• Content you create: the inputs and outputs you create or upload in Gallery, including your Brand DNA, ad briefs, remixes of winning concepts, hand-off documents shared with editors or freelancers, prompts and instructions you submit, and any images, files, or reference materials you upload.
• Usage, device, and log data: information about how you interact with the service, such as pages and features viewed, actions taken, timestamps, referring pages, your IP address, browser type, operating system, device identifiers, and diagnostic or crash logs. We may use privacy-conscious analytics to understand aggregate, product-level usage.
• Billing identifiers: if you subscribe to a paid plan, our payment processor collects and processes your payment details. We do not store full card numbers. We retain limited billing identifiers such as your plan, subscription status, transaction history, and a customer reference from our payment processor.
• Communications and support: the contents of messages you send us, support requests, survey responses, and any attachments or context you include when you contact us.

We use the data described above to:

• Provide and operate the service: create and maintain your account, authenticate you, and deliver the core features of Gallery.
• Generate briefs and other outputs: process the content you submit to capture your Brand DNA, generate ad briefs, produce remixes, and assemble hand-off documents.
• Process billing: manage subscriptions, process payments through our payment processor, and prevent payment fraud.
• Provide support: respond to your questions, troubleshoot issues, and send service-related communications such as account, security, and transactional notices.
• Maintain security: detect, investigate, and prevent fraud, abuse, security incidents, and other harmful or unlawful activity, and protect the rights and safety of our users and the public.
• Improve the product: understand how features are used, diagnose problems, and develop new and improved functionality. Where we analyze usage to improve the product, we rely on aggregated or de-identified data wherever practical.
• Comply with legal obligations: meet our legal, accounting, and regulatory requirements and enforce our agreements.

We send marketing communications only where permitted, and you can opt out at any time using the unsubscribe link in those messages or by contacting us.

If you are in the European Economic Area, the United Kingdom, or another region with similar laws, we rely on the following legal bases under the GDPR and equivalent legislation to process your personal data:

• Performance of a contract: to provide the service you have signed up for, manage your account, and process your subscription and payments.
• Legitimate interests: to secure and improve the service, prevent fraud and abuse, understand aggregate usage, and communicate with you about the service, where those interests are not overridden by your rights and freedoms.
• Consent: where we ask for it, for example for certain optional analytics, cookies, or marketing communications. You may withdraw your consent at any time without affecting processing carried out before withdrawal.
• Legal obligation: to comply with applicable laws, tax and accounting requirements, and valid legal requests.

Gallery uses artificial intelligence to turn the inputs you provide into useful outputs such as Brand DNA, briefs, and remixes. To do this, the content you submit, including your prompts and uploads, is sent to and processed by third-party AI model providers acting on our behalf and under our instructions.

We take a privacy-protective stance toward your content:

• We do not sell your content.
• We do notuse your content to train our own models, and we do not permit third-party AI model providers to use your content to train their or any other party’s foundation models.
• Your content is processed only to provide the service to you, that is, to generate the outputs you request and to operate and support the features you use.

Outputs generated by AI may not always be accurate or complete. You remain responsible for reviewing outputs before relying on or publishing them.

We do not sell your personal data. We share it only with service providers that help us run Gallery, and only as needed to provide the service. These providers are bound by contractual obligations to protect your data and to use it solely for the purposes we specify. We rely on the following categories of sub-processors:

• Cloudflare for hosting, core infrastructure, and content delivery.
• Supabase for our database, authentication, and file storage.
• Third-party AI model providers that process the content you submit to generate outputs, as described above.
• Our payment processor for subscription billing and payment processing.
• Our email delivery provider for transactional and service-related emails.
• Analytics providers for understanding aggregate, product-level usage.

We may also disclose personal data when required by law, to respond to valid legal process, to protect our rights and the safety of others, or in connection with a merger, acquisition, or sale of assets, in which case we will continue to protect your data in line with this policy.

Gallery, Inc. is based in the United States, and our service providers may store and process your personal data in the United States and other countries. These countries may have data protection laws that differ from those in your country.

Where we transfer personal data out of the European Economic Area, the United Kingdom, or other regions with transfer restrictions, we rely on appropriate safeguards where applicable, such as the European Commission’s Standard Contractual Clauses and equivalent mechanisms, to ensure your data continues to receive an adequate level of protection.

We use cookies and similar technologies to operate Gallery and to understand how it is used:

• Essential cookies: required to sign you in, keep you signed in, secure your session, and remember basic preferences. The service does not function properly without these.
• Analytics: we use minimal, privacy-conscious analytics to measure aggregate usage and improve the product. We do not use cookies to build cross-site advertising profiles.

You can manage or block cookies through your browser settings, though disabling essential cookies may prevent parts of the service from working. Where required, we will ask for your consent before setting non-essential cookies.

We keep personal data only for as long as we need it for the purposes described in this policy. In general:

• Account data and the content you create are retained for as long as your account is active.
• Billing records are retained as required to meet tax, accounting, and legal obligations.
• Usage and log data are retained for a limited period to support security, troubleshooting, and product analytics.

When you close your account, we delete or de-identify your personal data within a reasonable period, except where we are required or permitted to retain it to comply with legal obligations, resolve disputes, prevent fraud or abuse, or enforce our agreements. Backups are purged on a rolling schedule.

We use technical and organizational measures designed to protect your personal data, including encryption in transit and at rest, access controls that limit who can access data, authentication safeguards, and ongoing monitoring of our systems. We restrict access to personal data to personnel and providers who need it to operate the service.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your account or data has been compromised, please contact us immediately at privacy@gallery.dev.

Depending on where you live, you have rights over your personal data. We honor these rights regardless of where you are located, subject to applicable law.

If you are in the EEA or the UK (GDPR)

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete data.
• Deletion: ask us to delete your personal data in certain circumstances.
• Portability: receive your data in a structured, commonly used, machine-readable format.
• Objection: object to processing based on our legitimate interests.
• Restriction: ask us to restrict processing in certain circumstances.

You also have the right to lodge a complaint with your local data protection authority.

If you are a California resident (CCPA)

• Right to know: request the categories and specific pieces of personal information we have collected about you and how we use and share it.
• Right to delete: request deletion of personal information we have collected from you, subject to legal exceptions.
• Right to opt out of sale: we do not sell your personal information, so there is nothing to opt out of, but you retain this right.
• Right to non-discrimination: we will not discriminate against you for exercising any of your privacy rights.

To exercise any of these rights, email us at privacy@gallery.dev. We will verify your request and respond within the timeframes required by applicable law. You may use an authorized agent to make a request on your behalf where the law allows.

Gallery is a business tool that is not directed to children. We do not knowingly collect personal data from children under 16, or under 13 where stricter limits apply. If you believe a child has provided us with personal data, please contact us at privacy@gallery.dev and we will delete it.

We may update this policy from time to time to reflect changes to our practices, the service, or the law. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or through the service. The policy takes effect on the date shown above. Please review it periodically.

Questions about this policy or your personal data? Reach us at privacy@gallery.dev, or for general support at hello@gallery.dev, or through the contact page.

The data controller is Gallery, Inc., a Delaware corporation. Our postal mailing address is: [Placeholder — add postal mailing address].