Privacy Policy

1. Introduction

AIKIZI ("we," "us," or "our"), operated by Kalai Labs Pvt Ltd (India), respects your privacy and is committed to protecting your personal data. This privacy policy explains what we collect, how we collect it, and how we use, share and protect it when you use our AI-powered media analysis platform on the web or in the AIKIZI iOS app.

By using AIKIZI, you consent to the data practices described in this policy. Sending your content to a third-party AI provider is separate: in the iOS app, we ask for your permission first (see Section 4). If you do not agree with these practices, please do not use our services.

2. Information We Collect

2.1 Account Information

• Google account email and profile information, such as your name and profile picture (when you sign in with Google)
• Your name and email address from Apple (when you sign in with Apple). If you use Hide My Email, we receive Apple's private relay address.
• Username/handle you choose
• Profile picture, banner and bio (if provided)
• Consent records (when you accepted our Terms and Privacy Policy, and age confirmation)
• Your own AI provider API keys, if you add them on the web. We store them encrypted.

2.2 User Content

• Images, videos, and audio files you upload for analysis
• Prompts, lyrics, text and reference images you enter to create images, video or audio
• Questions you type when you ask about an image
• Voice recordings, when you use voice features on the web. We send them to the AI provider named in Section 4 and do not store them.
• AI-generated analysis results and content you create using our AI generation features
• Content you choose to publish publicly

2.3 Searches

When you search, we receive the words you type or speak. When you search Explore, we store your search words and filters. If you are signed in, we store them with your account ID. We use them to improve search and to suggest related searches. Suggestions never show who searched.

Searches inside your own library are not stored. Voice searches on the web may be stored with your account so we can show you the results.

2.4 Usage and Device Data

• Features you use and actions you take
• Credit purchases and consumption
• Time and date of access
• Device type, browser type, operating system, and app version
• IP address and approximate location (country/region level)
• Push notification device token (if you allow notifications in the iOS app)

2.5 Data Kept on Your Device (iOS App)

The iOS app keeps some data on your device: your app settings, your AI data-sharing choice, your recent searches, a cache of images you have viewed, your recent Studio results, and a Spotlight index of your published decodes so you can find them in system search. Recent searches, cached images, Studio results and the Spotlight index are deleted when you sign out. Your AI data-sharing choice is saved for each account and stays when you sign out.

2.6 Local Storage and Tracking (Web)

We use browser local storage for authentication and session management (via Supabase Auth). We also use PostHog for product analytics to understand how users interact with our platform. PostHog may set cookies for analytics purposes. You can control cookies through your browser settings.

We set one first-party cookie (aikizi_src, 90 days) that records how you first reached us — the referring website, any campaign tags in the link, the page you landed on, and your country. It contains no identifier, is never shared with a third party, and is not used to track you across other websites. If you create an account, this is stored with it so we know which channels bring people to AIKIZI. Your browser also keeps a copy of the same details in its local storage (aikizi_first_touch, 90 days), used only if the cookie is missing when you sign up. Declining analytics in our cookie banner switches this off entirely: nothing further is recorded, and anything already recorded is deleted. Declining sets one more first-party cookie (aikizi_no_attr, 400 days) whose only content is that refusal — it is what makes the refusal stick on later visits.

2.7 How We Collect It

• From you: when you create an account, upload files, type prompts, questions or searches, record your voice, add an API key, or edit your profile.
• Automatically: when you use AIKIZI, we record usage, device and app information, and your IP address. The iOS app sends us a push notification token if you allow notifications. On the web, PostHog and our first-party cookies collect usage data as described in Section 2.6.
• From third parties: Google and Apple, when you sign in with them (name, email address, profile picture); Apple (App Store) and RevenueCat, when you buy in the iOS app (purchase and subscription records); and Dodo or Razorpay, when you pay on the web (payment and subscription status).

3. How We Use Your Information

We use the information we collect to:

• Provide Services: Process and analyze your uploaded content and create content with AI, using the AI providers listed in Section 4 for the features you use
• Account Management: Manage your account, credits, and preferences
• Improve Platform: Analyze usage patterns to enhance features and performance
• Improve Search: Use stored searches to improve results and suggest related searches
• Service Improvement: Use anonymized, aggregated usage patterns (such as popular categories and feature usage) to improve our services. We do not use your uploaded images, videos, or audio content to train AI models.
• Security: Detect and prevent fraud, abuse, and security threats
• Communication: Send service-related notifications and updates
• Legal Compliance: Comply with applicable laws and regulations

4. AI Processing and Third-Party AI Providers

Some AIKIZI features send your content to third-party AI providers. This table shows what each feature sends, who receives it, why, and where the feature is available.

What Each Request Includes

For the features you use, each request carries only what the feature needs: your content and the settings for that request. We do not add your name, email address or AIKIZI account ID. Your content itself can still include personal data, such as a face in a photo or a name in a prompt.

If you add your own Google or ElevenLabs API key on the web, requests for those features use your key, so that provider can link them to your own account with them. If your key fails, we may retry with our key. Requests made with your own key are covered by your own terms with that provider.

How Providers Must Protect Your Data

We share personal data with these providers only to deliver the feature you asked for. They process it under their business or API data-processing terms. We require them to give it the same or equal protection as this policy: keep it confidential, keep it secure, and use it only to provide their service to AIKIZI.

Cloudflare AI Gateway

Many requests to Google Gemini, ElevenLabs and BytePlus pass through Cloudflare AI Gateway, which we use to monitor requests and apply rate limits. Others, such as file uploads to the Gemini Files API, go directly to the provider. We have turned off the gateway's response cache for Gemini requests. The gateway keeps request logs, which can include the content sent. We use these logs only to run and troubleshoot the service.

Storage and Training

• Uploaded content is stored securely on third-party cloud infrastructure (Cloudflare)
• AI analysis is performed in real-time and results are stored in our database
• Private content is not shared with other users unless you publish it
• We do not use your personal content to train AI models

5. Data Sharing and Third Parties

We do not sell your personal information.

We share your information only with these parties, and only as this policy describes:

• AI Providers: Anthropic (Claude API: image decodes and image chat on the web, Japanese readings of decodes, and the Prompt Guess game), Google (Gemini API, including Gemini image models, the Gemini Files API, Gemini embeddings and Gemini Live), ElevenLabs and BytePlus ModelArk (Seedream and Seedance, paused since September 2026; items made with them before then stay), for the features in Section 4.
• Infrastructure: Supabase (database and authentication), Cloudflare (hosting, image storage, media storage, AI Gateway), Upstash (caching)
• Payments: Dodo (global payments), Razorpay (India payments), Apple (iOS in-app purchases), RevenueCat (iOS purchase and subscription management)
• Email: Resend (account, payment and newsletter emails)
• Analytics: PostHog for usage analytics
• Legal Requirements: When required by law, court order, or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

6. Data Security

We implement industry-standard security measures including:

• TLS/SSL encryption for all data in transit
• Encryption at rest for stored data
• Access controls and authentication requirements
• Regular security monitoring

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

In the event of a data breach that affects your personal information, we will notify affected users within 72 hours of becoming aware of the breach, via email and in-app notification, in accordance with applicable data protection regulations.

7. Data Retention

• Account Data: Retained while your account is active
• Uploaded Content: Retained until you delete it or request account deletion
• Search History: Explore searches are kept while your account exists. If you delete your account, they are no longer linked to you.
• Usage Logs: Retained for up to 24 months for analytics
• Consent Records: Retained for legal compliance purposes
• AI Providers: Providers and Cloudflare AI Gateway may keep request data for limited periods under their terms and our settings, for example for abuse monitoring or logs

If you request account deletion, we schedule it for 30 days later, and you can cancel during that time. After that, we remove your personal data and uploaded content from our systems. Some data may be retained where required for legal compliance or legitimate business purposes (e.g., transaction records).

8. Your Privacy Rights

8.1 General Rights (All Users)

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and data
• Withdraw AI Data-Sharing Consent: In the iOS app, turn off Settings › Privacy › AI Data Sharing at any time. The app then stops sending your content to AI providers, and the rest of the app keeps working. Content you already uploaded stays on AIKIZI until you delete it, and our servers may still process it as described in Section 4.
• Withdraw Consent: Withdraw consent to all processing by deleting your account
• Data Portability: Request a copy of your personal data in a structured, commonly used, machine-readable format

To exercise any of these rights, contact us at hello@aikizi.com. We will respond within 30 days.

Note on AI Analysis: AIKIZI's core service involves automated AI analysis of content you upload. This analysis is a fundamental part of the service you are using and does not constitute automated decision-making that produces legal effects or similarly significant effects on you.

9. Children's Privacy

AIKIZI is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13. If we discover that a child under 13 has provided us with personal information, we will delete it promptly.

Users between 13 and 17 years old may use AIKIZI only with parental consent. For users in India under the age of 18, verifiable parental consent is required in accordance with the Digital Personal Data Protection Act (DPDPA).

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States and India. Our infrastructure providers (Cloudflare, Supabase, Google) and the AI providers in Section 4 may process data in multiple jurisdictions.

We ensure that our third-party providers maintain appropriate data protection commitments, including industry-standard security certifications and safeguards such as encryption in transit and at rest, access controls, and regular security audits.

If you are located in the European Economic Area (EEA) or United Kingdom (UK), your data may be transferred to countries outside the EEA/UK. We protect it during such transfers through our providers' contractual data protection terms, so it keeps the same or equal protection described in this policy.

11. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will:

• Update the version number and effective date at the top of this page
• Notify you via email or in-app notification
• On the web, ask you to accept the updated policy before you continue

Your continued use of AIKIZI after changes constitutes acceptance of the updated policy.

12. Grievance Officer

In accordance with the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the following person is designated as the Grievance Officer:

• Name: Sharan Ramakrishna, Founder
• Email: hello@aikizi.com

Complaints will be acknowledged within 24 hours and resolved within 15 days from the date of receipt.

13. Contact Us

For questions about this privacy policy, to exercise your rights, or to report a privacy concern:

• Email: hello@aikizi.com

We will respond to your request within 30 days.