Privacy Policy
Last updated: November 6, 2026
Your privacy is important to us. This policy explains what data we collect, how we use it, and your rights regarding your information.
1. Information We Collect
We collect information you provide directly: account details (name, email), the images and videos you upload for generation, and your prompts and generation settings. When payments are offered, card and other payment details are entered with our third-party payment processor; we receive a record of what you bought and paid, not your full card number. We also collect information automatically: device and browser information, IP address, usage patterns and feature interactions, generation history and metadata, and cookies for session management.
2. How We Use Your Information
We use your information to: provide and maintain the Service, including processing AI generations; manage your account, credits, and subscriptions; improve our models and generation quality; communicate service updates and relevant information; detect and prevent fraud or abuse; comply with legal obligations; and personalize your experience based on usage patterns.
3. Uploaded Content
Images and videos you upload for generation are processed by our AI systems and may be sent to third-party AI model providers (currently WaveSpeed AI, APIMart, Kie AI, Replicate and Higgsfield) for processing. Multi-Shot also sends your reference image, and the shots already made from it, to OpenAI, which classifies the image and writes the prompt for each shot. We keep your uploads in our cloud storage, linked to your account, so you can use them again, and they may help us improve the Service. They stay yours, and we don't sell them to anyone. Deleting your account permanently deletes them (see Section 7), and you can ask [email protected] to delete particular files sooner.
4. Generated Content & Content Moderation
AI-generated content is stored in your account history for your convenience. Generation metadata (prompts, parameters, timestamps) is stored alongside outputs. Removing an item from your history takes it out of your account; the file itself is deleted from our storage when you delete your account. Generated content may be used in aggregate, anonymized form for model improvement. Before anything is generated, we automatically check the text of every prompt and block requests that sexualize minors or ask for certain other prohibited content. Content reported to us (see Section 5 of the Terms) is reviewed, removed when it breaks our Terms and, where the law requires, reported to the authorities, including NCMEC. Content moderation logs may be retained as necessary for legal compliance and safety purposes.
5. Data Sharing & Third Parties
We share data with: AI model providers (images/videos for processing only, under data processing agreements); a third-party payment processor, once payments are offered (to take payments and prevent fraud, under its data processing terms); cloud infrastructure providers (Cloudflare, for hosting and storage); authentication provider (Clerk, for account management). We don't use third-party analytics services. We maintain Data Processing Agreements (DPAs) with all third-party processors as required by GDPR. We do not sell your personal information. We may disclose information if required by law, court order, or to protect our rights and safety.
6. Data Security
We implement industry-standard security measures including: encryption of data in transit (TLS/SSL) and at rest; secure authentication through Clerk; regular security audits and monitoring; access controls and least-privilege principles. While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
7. Data Retention
We keep your account data for as long as your account exists. When you delete your account in Settings, it is deactivated straight away, any active plan is cancelled, and every image and video you uploaded or created is permanently deleted from our storage and cleared from our content delivery network's cache. The account record itself stays (your email address, credit balance and generation history: prompts and settings, without the files), so that you can sign in again and restore the account and its credits; deleted files can't be brought back. To have that record erased too, email [email protected] from your account's email address. Within one month we then permanently delete the account, its generation history and the payment records we hold, together with your sign-in. Our payment processor keeps its own records of payments for as long as tax and accounting law requires. Anonymized, aggregate statistics that can't identify you may be kept indefinitely.
8. Your Rights
Depending on your jurisdiction, you may have the right to: access the personal data we hold about you; correct inaccurate personal data; request deletion of your personal data; object to or restrict processing of your data; data portability (receive your data in a machine-readable format); withdraw consent at any time where processing is based on consent. You can download a copy of your data and delete your account from your Settings page; Section 7 explains what deleting removes and how to have the rest erased. For anything else, email [email protected].
9. Cookies
We only use the cookies and browser storage the Service needs: to keep you signed in (set by our sign-in provider, Clerk) and to remember choices such as your language and your answer to the cookie banner. Visits are counted without cookies: our server notes the country and a code that changes every day, and nothing is stored in your browser for it. We don't use advertising cookies. The banner on your first visit lets you choose all cookies or essential ones only; to answer again, clear this site's data in your browser and the banner comes back.
10. Children's Privacy
SpicyHub AI is only for adults: you must be 18 or older, or the age of majority where you live if that is higher. We don't knowingly collect personal information from anyone younger. If we learn that an account belongs to a minor, we close it and erase its data.
11. International Data Transfers
Your data may be processed in countries other than your own. We ensure appropriate safeguards are in place for international data transfers, including standard contractual clauses where applicable. By using the Service, you consent to the transfer of your data to countries that may have different data protection laws.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. Continued use of the Service after changes constitutes acceptance of the updated policy.
13. Contact Us
For questions or concerns about this Privacy Policy or our data practices, email [email protected] or use our Support page. For EU residents, you may also contact your local data protection authority.
This privacy policy is effective as of the date stated above and will remain in effect except with respect to any changes in its provisions in the future, which will be in effect immediately after being posted on this page.