Skip to content

Eaveform Privacy Policy

Last updated: October 15, 2026

1. Scope

This Policy explains how Eaveform processes personal information on eaveform.com, our legacy domains and connected workspace. See our Terms of Service. Contact support@eaveform.com about this Policy or your privacy rights.

2. Information we process

  • Account information: email address, name, avatar, sessions and necessary details from third-party sign-in you choose.
  • Creative content: uploaded photos, prompts, outputs, projects, assets and model parameters. Invocation logs may contain input links, prompts and error details; they are not all anonymous.
  • Transactions: orders, amounts, currency, payment status, transaction references, credit records and refunds. Payment credentials are processed through payment providers' checkout. Do not email full card numbers, CVVs or passwords.
  • Support and technical information: correspondence, tickets, necessary screenshots, IP addresses, browser details, request and error logs.

Only upload materials you may lawfully use. Avoid unrelated faces, private addresses, confidential designs and sensitive information.

3. Purposes and recipients

We process necessary information to authenticate accounts, run generation, store and synchronize content, fulfill orders, reconcile charges, provide refunds and support, prevent abuse and meet legal obligations. The basis depends on applicable law, including contractual necessity, legal obligations, valid consent or another lawful basis. We obtain separate consent where required.

Necessary recipients include the hosting, storage, email, authentication, AI model channels and payment providers actually used. Generation sends prompts, reference images or links and necessary parameters to the selected channel, which may be an intermediary rather than the original developer. In portal mode, text prompts are also sent to the Waffo Pancake Prompt Screening API for safety checks.

Names appear in the interface and configuration, including identifiers such as gpt-image-2.5-sunburst and gpt-image-2.5-flare. An alias alone does not establish the underlying developer. Providers may have independent data rules; we do not make an unverified promise that every provider never uses data for training. Using Eaveform does not authorize us to publish private projects, sell them to advertisers or separately use them for training. New purposes require disclosure and legally required consent.

We share only what the service requires, or lawfully disclose information to meet legal obligations, protect legitimate rights and address security incidents. Generated content is not automatically a public gallery.

4. Local storage, cookies and analytics

We use necessary session cookies and storage for theme and language preferences. Some canvas projects, assets and history may be saved in browser IndexedDB without login. This does not mean all operations are offline: generation, uploads and remote features still transmit data to servers or providers.

When signed in and synchronization is available, content may exist locally and in the cloud. Clearing browser data does not delete cloud copies, and signing out is not deletion. Export unsynchronized content before clearing storage.

Browser controls let you manage storage; blocking necessary cookies may prevent login. If non-essential analytics or marketing tracking is enabled, tools, purposes and data scope should be disclosed, with required consent and withdrawal controls before collection. Support for a tool does not mean it is enabled.

5. Retention, security and cross-border processing

We retain information as needed for services, disputes and legal obligations, not on a default basis of indefinite retention. Deletion requests may cover accounts, projects, tasks and logs. Financial, security or legally required records may remain for necessary periods with restricted use. Backups and third-party copies follow applicable processes; instant deletion of every copy is not guaranteed.

We use reasonable access controls, authentication and transmission protections, but no system is absolutely secure. Protect your account and never send passwords, verification codes or API keys to support.

Hosting, model, email and payment providers may operate in different countries, involving cross-border processing. We must provide legally required safeguards and disclosures, and do not claim unverified certifications, transfer assessments or standard contractual arrangements.

6. Your choices and rights

Depending on applicable law, you may request access, correction, export, deletion or account closure, withdraw consent where available, or restrict or object to processing. Email support@eaveform.com with your account email and request. We may verify identity as necessary and will respond within applicable legal deadlines.

Export content and resolve open orders or unused paid entitlements before deletion. We will explain lawful retention or reasons a request cannot immediately be completed. You may complain directly to a competent regulator without first contacting us.

7. Age, notices and changes

The service is for users aged 18 or older. If we learn an ineligible user has submitted information, we will investigate and take appropriate restriction or deletion steps.

Necessary account, security and transaction messages are not marketing consent. Marketing should offer applicable unsubscribe controls. Material changes will normally be notified at least 14 calendar days ahead. We seek fresh consent where required and do not retroactively expand prior authorization.

8. Contact

Brand: Eaveform. Website: eaveform.com. Support and privacy requests: support@eaveform.com.