Privacy Policy

1. Scope and Controller

This Privacy Policy explains how CircleAI ("CircleAI," "we," "us," or "our") collects, uses, discloses, stores, and protects personal information when you use the CircleAI mobile app, website, support channels, subscriptions, ads, AI editing features, and related services.

CircleAI is the controller of personal information we decide how to use. Some companies that help operate the app, such as app stores, advertising networks, purchase processors, hosting providers, and AI infrastructure providers, may act as independent controllers or processors under their own privacy policies.

If local law gives you rights or protections that are stronger than this policy, we will honor those rights where they apply. Nothing in this policy limits non-waivable consumer, privacy, or data protection rights.

2. Information We Process

Photos, prompts, masks, and AI edits

When you use the AI editor, you choose a photo, mark or circle the area you want changed, and write a prompt. The app may process the selected photo, marked area, prompt, generated result, and related technical data needed to provide the edit. Do not upload photos, prompts, or content unless you have the rights and permissions to use them.

Device, app, and usage data

We and our service providers may process device type, operating system, app version, language, country or region, IP address, network data, identifiers, crash or diagnostic data, feature usage, ad interactions, subscription state, and similar technical information.

Purchases and subscriptions

Subscriptions and in-app purchases are handled by app stores and purchase infrastructure. We may receive product identifiers, entitlement status, transaction identifiers, renewal state, trial status, refund or cancellation state, country or store region, and similar information. We do not receive your full payment card number from Apple, Google, or payment processors.

Support and contact information

If you contact us, we process the information you provide, such as your email address, message, screenshots, device details, purchase details you choose to share, and support history.

Website data

The website is hosted by third-party infrastructure. Hosting and security systems may process IP address, browser type, device information, request path, referring page, timestamps, and similar logs to deliver the website, prevent abuse, and measure reliability.

3. App Permissions

CircleAI may request permissions that are necessary or useful for app features, including camera, photo library, storage or media access, notifications, and tracking or advertising permission where required by the platform. You can grant, deny, or later change permissions in your device settings. If you deny a permission, some features may not work.

4. AI Photo Processing

CircleAI uses third-party AI infrastructure to generate photo edits. This may include sending the selected image, marked area, prompt, and related request data to OpenRouter and model providers routed through OpenRouter, or to other AI providers we use in the future.

We do not intentionally use your photos to identify you, perform face recognition, create a biometric template, build a biometric database, or determine sensitive traits. AI systems may still process visual content that incidentally includes faces, people, locations, documents, or other sensitive details if you choose to upload them.

We do not train our own AI models on your photos or prompts. Third-party AI providers may process and retain data according to their own terms, security controls, abuse-prevention practices, and legal obligations. We require service providers to use personal information only as permitted by contract or law where they act on our behalf, but we do not control every independent provider policy.

AI output may be inaccurate, unexpected, or similar to content generated for others. You are responsible for reviewing results before using or publishing them.

5. How We Use Information

• To provide, generate, save, display, and export AI photo edits.
• To operate app features, subscriptions, entitlements, trials, restore purchases, and premium access.
• To provide support, respond to privacy requests, troubleshoot bugs, and improve reliability.
• To show ads, measure ad performance, prevent ad fraud, and comply with advertising platform requirements.
• To protect the app, users, service providers, and the public from fraud, abuse, security threats, illegal content, or misuse.
• To comply with law, court orders, app store rules, tax, accounting, consumer protection, and regulatory obligations.
• To enforce our terms, investigate violations, defend legal claims, and complete business transactions such as a merger, acquisition, financing, or asset sale.

6. Legal Bases Where Required

Where GDPR, UK GDPR, Swiss data protection law, LGPD, or similar laws require a legal basis, we rely on one or more of the following:

• Contract: to provide the app, AI edits, subscriptions, support, and requested services.
• Consent: for optional permissions, tracking where required, certain advertising uses, notifications, or processing that legally requires consent.
• Legitimate interests: to secure, debug, improve, market, and operate the service, prevent abuse, and understand product performance, balanced against your rights.
• Legal obligation: to comply with app store, tax, accounting, law enforcement, regulatory, and consumer protection duties.
• Vital or public interests: only where necessary for safety, security, legal claims, or emergencies.

You may withdraw consent where consent is the basis for processing. Withdrawal does not affect processing that happened before withdrawal or processing based on another lawful basis.

7. Advertising, Tracking, and Analytics

CircleAI may show ads through Google Mobile Ads or similar advertising partners. Advertising providers may process device identifiers, advertising identifiers, IP address, coarse location, app activity, ad views, ad clicks, and other signals to deliver, limit, measure, personalize, and protect ads.

On iOS, we request App Tracking Transparency permission before tracking where Apple requires it. On Android, you may reset or delete your advertising ID and adjust ad personalization in Google settings. You can also limit ad tracking through your operating system settings.

We do not sell personal information for money. Some advertising or analytics disclosures may be considered a "sale," "sharing," or "targeted advertising" under California or other US state privacy laws. You may opt out by using device privacy settings, denying tracking permission, resetting or deleting the advertising ID, limiting ad personalization, or contacting us with the subject "Do Not Sell or Share."

The website does not currently use cross-context behavioral advertising cookies. If we add website analytics, pixels, or cookies that require consent or opt-out controls, we will update this policy and provide the legally required controls.

8. When We Share Information

We may share personal information with the following categories of recipients:

• AI infrastructure providers, including OpenRouter and routed model providers, to generate requested edits.
• App stores and purchase infrastructure, including Apple, Google, and RevenueCat, to manage purchases, subscriptions, trials, entitlements, and refunds.
• Advertising and attribution providers, including Google Mobile Ads, to serve and measure ads and prevent fraud.
• Hosting, CDN, security, and infrastructure providers, including Vercel for the website.
• Support, email, diagnostics, analytics, and operations providers that help us respond to users and operate the product.
• Professional advisors, auditors, insurers, payment, accounting, legal, and compliance providers.
• Authorities, courts, regulators, app stores, or other parties when required by law or necessary to protect rights, safety, security, users, or the service.
• Successors or potential successors in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to appropriate safeguards.

We do not knowingly disclose personal information to third parties for their own independent marketing unless we have permission or the disclosure is otherwise allowed by law.

9. Retention

We keep personal information only as long as reasonably necessary for the purposes described in this policy, unless a longer period is required or permitted by law.

• Photos, masks, prompts, and generated results: processed as needed to generate and return the edit. Copies saved by you remain on your device or wherever you export them. Third-party AI providers may retain request data under their own policies and legal obligations.
• Local app settings and history: stored on your device until you delete them, clear app data, or uninstall the app.
• Purchase and entitlement records: kept as long as needed to provide premium access, restore purchases, resolve disputes, support refunds, prevent fraud, and meet tax or accounting obligations.
• Support messages: generally kept while needed to respond and for a reasonable period afterward for quality, dispute, legal, and security purposes.
• Website, diagnostic, ad, and security logs: kept according to provider retention settings, security needs, legal requirements, and operational needs.
• Aggregated, de-identified, or anonymized information: may be kept indefinitely when it no longer identifies a person.

10. International Transfers

CircleAI is available internationally. Personal information may be processed in the United States, Israel, the European Economic Area, the United Kingdom, Canada, and other countries where we or our service providers operate. These countries may have privacy laws different from your country.

Where required, we use appropriate transfer safeguards, such as adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Addendum, contractual protections, consent, necessity to provide the service, or other lawful transfer mechanisms.

11. Security

We use reasonable technical, organizational, and administrative safeguards designed to protect personal information. No system, network, AI provider, app store, or internet transmission is completely secure. You should avoid uploading highly sensitive documents, confidential information, or content you are not authorized to share.

12. Your Privacy Rights

Depending on where you live, you may have rights to access, confirm processing, correct, delete, export, port, restrict, object, withdraw consent, opt out of sale, sharing, targeted advertising, profiling, or certain automated decisions, limit use of sensitive personal information, appeal a denied request, or complain to a regulator.

These rights may apply under laws including GDPR, UK GDPR, Swiss law, CCPA/CPRA, other US state privacy laws, LGPD, PIPEDA, POPIA, PDPA, APPI, PIPA, DPDP, and similar laws worldwide. Not every right applies in every place or every situation.

To make a request, email kyle@orinandco.com. We may need to verify your identity, your device, your purchase, or your authority to act for another person. We will not discriminate against you for exercising privacy rights, but some features may not work if required data is deleted or permissions are disabled.

13. California and US State Notices

For California and similar US state laws, the categories of personal information we may collect include identifiers, internet or electronic network activity, commercial information, approximate geolocation, audio/visual information you choose to provide through photos, inferences related to app usage, and sensitive personal information if you choose to include it in photos or prompts.

We use these categories for the business and commercial purposes described above. We disclose them to the categories of recipients described above. We do not knowingly sell or share personal information of people under 16. We do not use sensitive personal information to infer characteristics about you.

To opt out of sale, sharing, or targeted advertising where applicable, use device controls, deny tracking permission, limit ad personalization, reset or delete your advertising ID, or email kyle@orinandco.com with the subject "Do Not Sell or Share CircleAI."

14. Children and Teens

CircleAI is not directed to children under 13, and we do not knowingly collect personal information from children under 13. In places where the age of digital consent is higher, children below that age may use CircleAI only with valid parent or guardian consent where allowed by law.

If you believe a child provided personal information without appropriate consent, contact us and we will take reasonable steps to delete it or otherwise handle it as required by law.

15. Automated Processing and AI Outputs

CircleAI uses automated AI systems to generate image edits requested by users. These outputs are creative or utility edits and are not intended to make legal, employment, credit, housing, insurance, education, healthcare, criminal justice, or similarly significant decisions about any person.

16. Your Content and Other People

You are responsible for the photos and prompts you submit. If your content includes another person, private property, confidential information, a child, a document, or sensitive details, you must have all rights, notices, permissions, and lawful bases needed to use that content with CircleAI.

17. Third-Party Links and Platforms

CircleAI may link to app stores, subscription controls, support email, AI providers, advertising providers, or other third-party services. Their privacy practices are governed by their own policies. You should review the privacy settings and policies of Apple, Google, OpenRouter, RevenueCat, Google Mobile Ads, Vercel, and any other third-party service you use with CircleAI.

18. Changes to This Policy

We may update this policy as the product, providers, laws, app store requirements, or business needs change. The updated version will be posted with a new last updated date. If changes are material, we will provide additional notice where required by law.

19. Contact

For privacy questions, access requests, deletion requests, opt-out requests, appeals, or complaints, contact kyle@orinandco.com.