Start producing photos at scale today.
get started
Last updated: 25 October 2026
ProductAI is operated by Shape, interaktivne digitalne izkušnje, d.o.o. (Shape d.o.o.), Slovenska cesta 56, 1000 Ljubljana, Slovenia, registration number 8724822000, VAT ID SI68015178 ("we", "us"). We are the controller of the personal data described in this policy.
This policy covers the website www.productai.photo, the ProductAI web app, the ProductAI iPhone app, the ProductAI Shopify app and the ProductAI API.
For anything about your data, write to team@productai.photo. We answer within one month.
We only process personal data for a purpose listed below, each with its legal basis under Article 6 of the GDPR.
| Purpose | Data | Legal basis |
|---|---|---|
| Your account and sign-in | Name, email address, user id, sign-in method (email, Google or Apple via Auth0), language | Contract (Art. 6(1)(b)) |
| Creating images and video | Photos and files you upload, prompts, chat messages, settings, the results we generate, product details from a connected Shopify store | Contract (Art. 6(1)(b)) |
| Payments, credits and invoices | Plan, credit balance, payment history; card details are handled by Stripe or Apple and never reach us | Contract (Art. 6(1)(b)); keeping invoices: legal obligation (Art. 6(1)(c)) |
| Service and account emails | Email address, account events (receipts, password reset, credit and plan notices) | Contract (Art. 6(1)(b)) |
| Marketing emails to customers | Email address, name, how you use ProductAI | Legitimate interest (Art. 6(1)(f)) under the existing-customer exception, see section 3 |
| Support | Your messages, email address, user id | Contract (Art. 6(1)(b)) |
| Basic product analytics without cookies | Pages viewed, features used, device and browser type, approximate location from IP; linked to your user id if you are logged in | Legitimate interest (Art. 6(1)(f)): keeping ProductAI working and improving it |
| Measuring our ads on the server | Sign-up, checkout and booked-call events with your email address in hashed form, IP address and browser | Legitimate interest (Art. 6(1)(f)): knowing which ads bring customers; you can object, see section 9 |
| Analytics and advertising cookies | Cookie ids, pages viewed, sign-ups and purchases, ad click ids (fbclid, fbp, fbc), campaign (UTM) tags, session recordings | Consent (Art. 6(1)(a)) |
| Security and abuse prevention | IP address, logs, request data | Legitimate interest (Art. 6(1)(f)) |
| Legal claims and requests from authorities | The data relevant to the case | Legal obligation (Art. 6(1)(c)) or legitimate interest (Art. 6(1)(f)) |
If you do not give us the data needed for the contract (for example an email address), we cannot provide an account. Everything that relies on consent is optional.
Service emails. We send emails you need to use ProductAI: receipts, password and sign-in emails, plan and credit notices. You cannot opt out of these while you have an account.
Marketing emails. If you created a ProductAI account or bought from us, we may email you about similar ProductAI features, tips and offers. We rely on the exception for existing customers in Slovenian electronic communications law (ZEKom-2) and on our legitimate interest. You can object at any time, for free: use the unsubscribe link in every marketing email or write to team@productai.photo. We never sell your email address. We send emails through Resend and, for some customer profiles, Klaviyo.
Without your consent we use only what the site needs to work (sign-in, language, your cookie choice) and basic product analytics in PostHog. In this mode PostHog stores nothing on your device and records no sessions. If you are logged in, these events are linked to your account id (not your email). We use this to find bugs and see which features are used.
Ad measurement on our server. When you sign up, start a checkout or book a call, our server tells Meta (Facebook and Instagram) about it, with your email address in hashed form, your IP address and your browser type, so we can see which ads bring customers. You can object to this at any time by writing to team@productai.photo.
With your consent we also use:
Visitors from the EU, EEA, UK and Switzerland see a banner and choose Accept or Reject; nothing in this list runs until you accept. Elsewhere these tools are on by default. You can change your choice at any time with Cookie settings in the footer. Withdrawing consent stops future use and deletes the Meta and PostHog cookies; it does not affect what happened before. The cookies are listed in section 11.
ProductAI creates images and video with generative AI models run by specialised providers. To produce what you ask for, the content you give us has to be sent to one of them.
What we send. Only what the generation needs: the photos you upload, take with the camera in our app or pick from your library; your prompts and chat messages; settings such as model, aspect ratio and resolution. For founder videos we also send your voice recording and selfie. We do not send your name, email address or payment details.
Who receives it. Depending on the model and feature you use: OpenAI, Google, Anthropic, fal.ai, Replicate and HeyGen (founder videos). Some models made by ByteDance and Alibaba run on fal.ai or Replicate. The full list with locations is in section 6.
How it is used. Only to produce the result you asked for. Your inputs and results are stored in your ProductAI account so you can reuse them. We do not sell your content or use it for advertising.
In the iPhone app we explain what is sent and to whom, and ask for your permission, before any of your content goes to these providers. If you decline, nothing is sent.
Automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (GDPR Art. 22). AI models generate content and may automatically refuse a request that breaks a provider's content rules; this does not affect your account or your rights.
We do not sell personal data. We share it only with the service providers below, who process it for us under a data processing agreement, and only as far as their task needs.
| Provider | What they do for us | Where the data is processed |
|---|---|---|
| Heroku (Salesforce) | Hosts our API and main database | United States |
| Amazon Web Services | Stores uploaded and generated images; resizes images; renders founder videos | Sweden and Germany (EU); United States for video rendering |
| Vercel | Hosts our website and web app | Global edge network, United States |
| Auth0 (Okta) | Sign-in and account security | EU |
| PostHog | Product analytics, session recordings | EU (Germany) |
| Analytics (GA4, Tag Manager), image labelling (Cloud Vision), Gemini image models, Google sign-in | United States and EU | |
| Meta Platforms | Ad measurement (pixel, Conversions API), WhatsApp messages if you use our WhatsApp assistant | Ireland and United States |
| Intercom | Support chat | United States |
| Resend | Service and marketing emails | United States |
| Klaviyo | Customer email profiles and events | United States |
| Stripe | Card payments, subscriptions, invoices | Ireland and United States |
| OpenAI | Image models, transcription of founder-video recordings | United States |
| Anthropic | The chat assistant | United States |
| fal.ai, Replicate | Hosting of image and video models | United States |
| HeyGen | Founder videos (voice and avatar) | United States |
| ConvertAPI | Converting uploaded vector files (SVG) | Lithuania (EU) |
| Slack | Internal alerts to our team, such as account deletion requests | United States |
| QuotaGuard | Fixed IP addresses for webhooks we send to API customers | United States |
Independent controllers. If you pay in the iPhone app, Apple processes the payment under its own privacy policy. If you install ProductAI from the Shopify App Store or connect your store, Shopify shares store and product data with us and may bill you; Shopify is responsible for its own processing.
Authorities. We disclose data to courts, police or other authorities only when the law requires it, and only what the request covers.
Business transfers. If Shape d.o.o. or ProductAI is sold or merged, your data may pass to the new owner, who must keep to this policy.
Several providers above process data in the United States, including our main database host. For each transfer we rely on one of:
You can ask us for a copy of the safeguards for a specific provider at team@productai.photo.
| Data | How long |
|---|---|
| Account, uploads, generated images and video, prompts and chats | Until you delete your account, then deleted within 14 days |
| Backups of the database | Overwritten within 30 days after deletion |
| Invoices and payment records | 10 years after the end of the year they relate to, as Slovenian tax law requires (ZDDV-1) |
| Marketing email status | Until you unsubscribe; we keep your address on a do-not-email list so we honour the opt-out |
| Support conversations | Until you delete your account |
| Analytics events (PostHog) | 2 years, then deleted; deleting your account removes the link to your account id |
| Google Analytics | 14 months |
| Server and security logs | Up to 30 days |
| Record of a deletion or rights request | As long as needed to prove we handled it, at most 3 years |
Cancelling or letting a subscription lapse does not delete your account: your images stay available until you delete it.
Under the GDPR you have the right to:
Self-service. In the app, go to Settings → Account:
For anything else, write to team@productai.photo. We may ask you to confirm your identity. We answer within one month; in complex cases we may extend this by two more months and will tell you why.
Complaints. You can complain to a data protection authority. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si. You can also complain in the EU country where you live or work. We would appreciate the chance to fix the issue first.
Age. ProductAI is not meant for anyone under 16, and we do not knowingly collect their data. If you think a child has given us data, contact us and we will delete it.
Security. We encrypt data in transit (TLS) and at rest, limit staff access to what their job needs, use sign-in through Auth0, and protect our email with SPF, DKIM and DMARC. If a breach puts your rights at high risk, we will tell you without undue delay.
Your content and other people. If you upload photos of other people, make sure you are allowed to.
Changes. If we change this policy in a way that matters, we will email account holders at least 14 days before it takes effect and update the date at the top. Earlier versions are available on request.
"Necessary" items run without consent because the site cannot work without them. "Consent" items run only after you click Accept (in the EU, EEA, UK and Switzerland).
| Name | Set by | Purpose | Duration | Type |
|---|---|---|---|---|
| pai_consent (local storage) | ProductAI | Remembers your Accept or Reject choice | Until you clear it or reopen Cookie settings | Necessary |
| pai_consent_required (session storage) | ProductAI | Remembers whether your region needs the banner | Browser session | Necessary |
| appSession, auth_verification | ProductAI (Auth0) | Keeps you logged in; protects sign-in | Up to 7 days; sign-in only | Necessary |
| NEXT_LOCALE | ProductAI | Remembers your language | 1 year | Necessary |
| sidebar:state | ProductAI | Remembers if the app sidebar is open | 7 days | Necessary |
| pai_onepager | ProductAI | Access to the partner one-pager after entering its password | 60 days | Necessary |
| intercom-id-*, intercom-session-*, intercom-device-id-* | Intercom | Support chat in the app; on marketing pages only after consent | Up to 9 months | Necessary in the app; consent on marketing pages |
| ph_*_posthog (cookie and local storage) | PostHog | Recognises your browser across visits for analytics and session recordings | 1 year | Consent |
| _ga, _ga_* | Google Analytics | Counts visits and measures sign-ups and purchases | 2 years | Consent |
| _fbp, _fbc | Meta | Links visits to Facebook and Instagram ad clicks | 90 days | Consent |
| campaign_data | ProductAI | Remembers which ad or campaign brought you (UTM tags, ad click ids) | 30 days | Consent |
When you reject or withdraw consent we delete the PostHog, Meta and campaign cookies we set. Payments happen on Stripe's and Apple's own pages, which use their own cookies.
Shape d.o.o., Slovenska cesta 56, 1000 Ljubljana, Slovenia
team@productai.photo
