Draft: to be reviewed by counsel before launch.
Legal
Privacy Policy
Last updated October 18, 2026
This policy explains what personal data KatoGen collects when you use katogen.ai, why, who processes it for us, and the choices you have.
The short version
- We collect what we need to run KatoGen: your email address, what you make and upload, your credits and payments.
- To make your images, video and audio, we send your prompts and uploads to the AI model providers named below.
- We don't sell your data, show ads or use your content to train AI models.
- We use only strictly necessary cookies. Analytics stay off unless you accept them, and we don't load any analytics today.
- Email support@katogen.ai to see, correct, export or delete your data.
Who we are
KatoGen (“we”) is responsible for the personal data described here. The company that operates KatoGen, its address and, where needed, our representative in the EU and UK will be named here before launch. Until then, reach us at support@katogen.ai.
What we collect
Your account
- Your email address, and when you first confirmed it.
- Sign-in records: a session for each signed-in browser, and a one-time sign-in link while it's valid.
- Your plan, credit balances and credit history: every charge, refund, purchase and adjustment.
What you make and upload
- Prompts, settings, the models you choose, and the images, video and audio you generate.
- Uploads: reference images, video and audio; tracks and performance clips; photos, logos and portfolio pictures for events, releases and stylist pages; and selfies for try-ons.
- Projects, and the details of events, releases, artist and stylist profiles and service menus you create, including captions and lyrics.
Your uploads may include other people's images or voices. You're responsible for having their consent (see our Acceptable Use Policy).
Payments
Stripe collects your payment details. We keep your Stripe customer ID, the plan and top-ups you bought, and any refunds or disputes, so we can credit your account correctly.
Reports and support
If you report content, we keep your name, email address, the link, your description, the statement you confirmed and your typed signature. If you email support, we keep the conversation.
Technical data
- Your IP address and email address are used to rate-limit sign-ins, uploads, runs and reports. We store them only as keyed hashes in counters that are deleted when their time window ends.
- Our host keeps request logs, which include IP addresses.
- Cookies and local storage, described below.
How we use it
- To run KatoGen for you: sign you in, send your prompts and uploads to the model that makes your output, store the result, sign it with Content Credentials where its format allows, and show you your library and pages.
- To bill you: price runs, charge and refund credits, process plans and top-ups, and send receipts.
- To keep KatoGen safe: rate limits, fraud and abuse prevention, and fixing problems.
- To handle reports and the law: review reports, take content down, keep records the law requires, and report child sexual abuse material to NCMEC.
- To answer you when you contact support.
If you're in the EEA or the UK, our legal bases are: performing our contract with you (running the service and billing), our legitimate interests (security, abuse prevention and improving KatoGen), legal obligations (tax records, takedowns and reports to authorities), and your consent (any analytics cookies, once we add them).
We don't sell or rent your personal data, don't share it for advertising, and don't use your prompts, uploads or outputs to train AI models.
Who processes it for us
These companies process personal data for us, each under its own terms and privacy policy. What a model provider keeps, and for how long, is set by its own terms for API customers.
Higgsfield
Runs most of our image and video models.
Receives: Your prompts, settings and reference uploads, and the outputs it makes. Reference files you upload for a run are stored on its upload storage.
OpenAI
Runs GPT Image 2, and reads flyers and drafts copy in the Event Studio.
Receives: Your prompts, reference images, and the flyer image and event details you import.
ElevenLabs
Makes voiceovers, music and sound effects, and transcribes audio for captions and lyrics.
Receives: Your scripts and prompts, and the audio of a video or track you caption.
Stripe
Processes payments, subscriptions, invoices and the billing portal.
Receives: Your email address, payment details and billing address. We never see your full card number.
Supabase
Hosts our database and file storage.
Receives: Everything in your account: your profile, credits, prompts, uploads, outputs, pages and reports.
SendGrid (Twilio)
Sends our emails: sign-in links, receipts and report receipts.
Receives: Your email address and the email's content. Open and click tracking are off.
Vercel
Hosts the KatoGen app.
Receives: The requests your browser makes, including your IP address, in its logs.
The server that assembles kit videos will run with a cloud provider we'll name here before launch. We also share data when the law requires it (for example, reports to NCMEC or answers to valid legal requests), to protect people or KatoGen, or as part of a sale or merger of the business, under this policy.
What other people can see
- Your library is private. Nothing you make is public until you publish it.
- Publishing to Community shows the output with its prompt, model and settings. Anyone can see it and reuse the prompt.
- Event, release and stylist pages show what you publish on them to anyone with the link, and search engines may find them.
- Approval and spin-off links show a kit to whoever you send them to.
Content Credentials
The Content Credentials (C2PA manifest) we add to outputs say that KatoGen signed the file, with an internal file ID. When the file had no manifest before, ours also says it was made with AI and which model made it. When the provider had already signed it, the provider's manifest stays in the file and ours, added as an edit, doesn't name the model. Ours don't include your name or email address. Anyone with the file can read them. Some files are stored without our manifest; the Terms of Use list them.
How long we keep it
- Your account: while it's open.
- Deleted generations: we delete their output files from our storage straight away, and keep the record (prompt, settings, model and cost) for your credit history. The kit images and reels made from a generation stay with the event, release or stylist they were made for until you delete that.
- Sign-in: links expire after an hour; a session lasts 30 days and renews while you use it.
- Rate-limit counters: deleted when their window ends.
- Payment records: as long as tax and accounting law requires.
- Reports and moderation records: kept, so we can show what was reported and what we did. How long is still to be set.
- At our providers: model providers keep inputs and outputs under their own terms. Higgsfield keeps its copy of an output for at least seven days, and keeps reference uploads on its upload storage, which we can't delete for you.
When you close your account, we delete your account data, except what the law requires us to keep, or what we need for a report, a dispute or fraud prevention.
Your rights and choices
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict how we use it, and to withdraw consent. To use these rights, email support@katogen.ai from the address you sign in with. We'll confirm it's you by email and answer within one month.
- In the EEA or the UK, you can also complain to your data protection authority.
- In US states with privacy laws, such as California: we don't sell or share personal data for targeted advertising, and we won't treat you differently for using your rights.
- You can delete generations from your library, unpublish what you've published, and change your cookie choice any time.
Where your data is
Our database and storage are in the United States, and so are most of our providers. If you use KatoGen from elsewhere, your data is transferred to the US. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses.
Security
- Sign-in uses one-time email links, so there are no passwords.
- Everything travels over HTTPS.
- Only our servers can reach the database, and provider keys never reach your browser.
- Tracks and performance clips are kept in private storage.
No system is perfectly secure. If a breach affects your data, we'll tell you as the law requires.
Children
KatoGen is for people 18 and older. We don't knowingly collect data from anyone younger. If you believe a minor has an account, email support@katogen.ai and we'll delete it.
Changes to this policy
We may update this policy. If a change matters, we'll tell you by email or in the app before it takes effect. The date at the top shows the latest version.
Contact
Questions or requests about your data: support@katogen.ai.