Privacy Policy

1. Our role and your role

Our role, and yours, depend on the data involved:

• We are the controller (or the “business” under some US state laws) of data about you as our user and about visitors to our own website: your account, subscription and billing, usage, security and advertising data, and your communications with us. We decide why and how this data is processed, and you are the individual the data is about.
• We are a processor / service provider for the content and customer data you manage through the Services (for example the content you publish, files you store, your AI inputs and outputs, data collected from visitors of your content, information about your own customers and buyers, and the end users of anything you build with our API). In this case you are the controller (or “business”) and we are your processor: you decide why and how that data is used. We process it only to provide the Services and on your instructions, keep it confidential and secure, help you respond to requests from your visitors and customers, and delete it as described in the Data retention section. You are responsible for having a lawful basis, for giving your own visitors and customers the notices required by law, and for responding to their requests.
• We can be both for the same data. For example, we process technical data about visits to content published by our users as their processor, to give them analytics, and as a controller for our own purposes of security, fraud prevention, showing advertising and improving the Services.
• Team workspaces. For your own account data we are the controller. For content and activity inside a workspace, the workspace owner (for example your employer or organization) decides how it is used, and we act as its processor.
• Our service providers. Providers such as hosting, storage, email and AI providers process data to help us deliver the Services, as described in the How we share personal data section.
• Payment gateways and advertising partners act independently. When you connect a third-party payment gateway, that provider is an independent controller of the payment data it handles. Advertising partners such as Google are likewise independent controllers of the data they collect through ads. Each acts under its own terms and privacy policy.
• Data processing terms. Where data protection law requires a data processing agreement for the data you process through the Services, we can provide one on request at [email protected].
• Your own obligations. If you publish content, run analytics, or collect data from visitors or customers, you must comply with the laws that apply to you, including cookie and tracking consent, marketing consent, consumer protection and tax laws.

2. Personal data we collect

Data you provide to us

• Account data: name, email address, password (stored hashed), language, time zone, and profile settings. If you sign in with a third-party account (such as Google), we receive the basic profile information you authorize.
• Subscription and billing data: plan, billing period, invoices, billing name and address, and tax ID. Payment card and bank details for our own subscription fees are collected and processed by our payment providers; we do not store full card numbers.
• Content you create or upload: text, links, images, files, contact details, settings and any other material you add to the Services.
• AI inputs and outputs: prompts, chat messages, images, audio, text submitted for processing, and the results generated for you.
• Tool inputs: text, domains, URLs, numbers or other data you enter into the online tools.
• Payment settings: if you connect a payment gateway, we store the account identifiers and API credentials you provide, protected by encryption, together with your payout-related settings. We do not need and do not ask for your gateway password.
• Team data: if you create or join a team workspace, the email addresses and names of invited members, their roles and permissions, and the content and activity they create within the workspace.
• API data: API keys (stored in protected form), the requests you make, request and error logs, IP addresses, and usage volumes.
• Custom domain data: the domain names you connect, related DNS records and verification status, and the security certificates issued for them.
• White-label settings: the brand name, logo, colors and other branding details you provide.
• Support and communications: messages you send us, feedback, and survey responses.

Data we collect automatically

• Device and log data: IP address, browser type, operating system, device identifiers, language, referring URL, pages viewed, dates and times, and error logs.
• Usage data: features used, plan limits and quotas consumed, and actions such as creating content or generating an AI result.
• Cookies and similar technologies: see the Cookies and similar technologies section below.
• Approximate location: derived from your IP address (country or city level), used for localization, fraud prevention and analytics.

Data about visitors to your content

When someone visits or interacts with content published by a TisTos user, we may collect technical data about that visit (such as IP-derived country and city, device type, browser, operating system, referrer, language, and which link or button was clicked) to provide analytics, enforce limits, and protect the Services. This data is made available to the user who owns the content. IP addresses may be anonymized or truncated depending on configuration. This also applies when your content is served through a custom domain or under your own branding.

Data about your customers and buyers

If you use the payment features, we process information needed to show and record transactions, such as order or item details, amount, currency, payment status, and the buyer’s name, email, shipping or billing details and other fields you choose to collect. We do not receive or store buyers’ full card numbers; these are handled by the payment gateway.

Data from third parties

We may receive data from payment providers and gateways (for example payment and payout status, limited billing details, refund and dispute notifications), from sign-in providers, and from security and fraud-prevention services.

3. How we use personal data

• Provide, operate, maintain and secure the Services, including creating your account and delivering the features you use.
• Process payments for our subscriptions, manage plans, issue invoices and prevent payment fraud.
• Connect to your chosen payment gateway, display checkout and transaction information, and pass transaction details between you, your customers and the gateway.
• Process your content, including generating AI outputs, storing files and serving published content.
• Operate the team, API, custom domain and white-label features you choose to use.
• Provide analytics to you about traffic and activity on your content.
• Show and measure advertising, including personalized advertising where permitted.
• Communicate with you: service notices, security alerts, billing messages, support replies, and (where permitted) product updates and marketing. You can opt out of marketing at any time.
• Detect, investigate and prevent abuse, spam, phishing, malware, fraud, illegal content and violations of our Terms.
• Improve, test and develop the Services, including measuring performance and fixing bugs.
• Comply with legal obligations and enforce our rights.

4. Legal bases (EEA, UK and similar laws)

Where laws such as the EU/UK GDPR apply, we rely on the following legal bases:

• Contract: to create your account and provide the Services you request.
• Legitimate interests: to secure and improve the Services, prevent fraud and abuse, and communicate with you about the Services, where these interests are not overridden by your rights.
• Consent: for non-essential cookies, personalized advertising, marketing emails, and any processing where consent is required. You may withdraw consent at any time without affecting prior processing.
• Legal obligation: for tax, accounting, and responding to lawful requests.

5. AI features and automated processing

Our AI-powered features are supported in part by third-party AI model providers. When you use them:

• Your inputs (such as prompts, text, images, audio and any other files you submit) are sent to the relevant provider solely to generate the output you requested, and results are returned to your account.
• We store your inputs and outputs in your account so you can access your history, until you delete them or your account, or as described in the Data retention section.
• We do not sell your inputs or outputs. We do not use your inputs or outputs to train our own models.
• We access these providers through their official APIs. They process data under their own terms and privacy policies, which govern how they handle, retain and use it, including any retention for abuse monitoring. Please review those policies if you use the AI features.
• We do not use voice recordings or images you submit to identify individuals or to create biometric profiles.
• AI outputs may be inaccurate, incomplete or similar to outputs generated for other users. Do not rely on them as professional advice, and review them before use.
• Do not upload other people’s voice recordings, photos or personal data without a lawful basis and any consent required. Do not use AI features to create deceptive impersonations or content that violates our Terms.

We may use automated tools (including AI-based classifiers) to detect spam, abuse and prohibited content. We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing, except for automated enforcement of clear violations (such as blocking malware links), which you can ask us to review.

6. Payments and transactions

Our own subscription fees

When you buy a paid plan from us, payment is handled by our payment providers. We receive confirmation of the payment and limited billing details, but not your full card or bank account number. If you choose a recurring payment, our payment providers may keep your payment method, or a token that represents it, so that future renewals can be charged until you cancel.

Payments between you and your customers

The Services let you connect your own account with supported third-party payment gateways so that your customers can pay you and the funds are paid directly to your gateway account. In these transactions:

• You are the seller. The sale is between you and your customer. We are not a party to it, we are not a bank, payment institution or money transmitter, and we do not receive, hold, or transfer your customers’ funds.
• You are responsible for your customers’ data. You decide what to collect, you must have a lawful basis and give your customers a privacy notice, and you must handle their requests, refunds, disputes, taxes and invoices. We process transaction and customer data only on your behalf and on your instructions to operate the Services.
• The payment gateway handles payment details. Card and bank details are entered into and processed by the gateway, under its own terms and privacy policy, not ours. The gateway may also collect data directly from your customers, run its own fraud and compliance checks, and share data with banks, card networks and authorities.
• Security standards and verification. Card details are entered directly into the gateway’s secure checkout, handled under payment card industry standards (PCI DSS), and are not stored on our servers. Gateways may require you to verify your identity or business (know-your-customer and anti-money-laundering checks) and may hold, delay or refuse payments under their own rules; those are decisions of the gateway, not of TisTos.
• Credentials. The API keys or account identifiers you provide are stored encrypted and used only to connect to your gateway account. You can disconnect the gateway at any time, after which we stop using those credentials.
• Records. We keep transaction records for as long as needed to provide the Services, to let you access your sales history, and to meet legal requirements, as described in the Data retention section.

7. Teams, API access, custom domains and white labeling

Teams

• A team workspace has an owner or administrators who can invite and remove members, assign roles, and view, manage, export or delete content and activity within the workspace, according to the permissions they set.
• If you join a workspace, the owner or administrators can see your name, email address, role and your activity in that workspace. If your workspace is provided by your employer, school or another organization, that organization decides how the workspace data is used, and you should direct privacy requests about it to them first.
• The workspace owner is responsible for inviting only people who have agreed to be invited, for managing member access, and for informing members how their data is handled.
• Content created in a workspace is controlled by the workspace owner and generally remains available to the owner when a member leaves, unless the owner deletes it.

API access

• We log API requests, IP addresses, errors and usage to operate, secure and limit the API, and to prevent abuse.
• If you send personal data through the API or build an application for your own users, you are the controller of that data and we are your processor. You are responsible for the lawful basis, the privacy notices and the security of your application.
• Keep your API keys secret, do not embed them in public code, and revoke a key immediately if you suspect it has been exposed. You are responsible for activity carried out with your keys.

Custom domains

• When you connect a custom domain, we process the domain name, DNS and verification data, and visitor traffic to that domain so we can serve your content and issue and renew security certificates.
• Visitors to a custom domain may not see TisTos’s name, but we still process their technical data as described in this Policy, as your service provider.
• You are responsible for the domain, its DNS settings, and for the cookie, consent and privacy notices required for visitors to your domain. Remove the DNS records when you stop using the domain with the Services.

White labeling

• White labeling lets you present the Services under your own brand. TisTos may not be visible to your visitors or customers, but we continue to process their data on your behalf as described in this Policy.
• You must give your visitors and customers your own privacy notice that identifies you as the party responsible for their data, and states that service providers such as TisTos process it for you. You must not suggest that this Policy is your own policy.
• You remain responsible for handling the privacy requests of your visitors and customers. We will assist you as your processor.

8. How we share personal data

We do not sell your personal data for money. We share it only as follows:

• Service providers: hosting and cloud infrastructure, content delivery and security, file storage, email delivery, security certificate issuance for custom domains, analytics, customer support tools and error monitoring, bound by confidentiality and data protection obligations.
• AI providers: to process your AI requests, as described above.
• Payment providers and gateways: to process our subscription fees, and, when you use the payment features, to pass transaction and customer details to the gateway you have connected and to receive payment status.
• Team members and workspace owners: if you are part of a team workspace, your name, email, role and activity are visible to the workspace owner and administrators, and to other members as permitted by the workspace settings.
• Analytics providers: such as Google Analytics, which receive usage, device and approximate location data to provide analytics, as described in the Cookies and similar technologies section.
• Advertising partners: such as Google AdSense, which receive cookie and device identifiers and usage data to serve and measure ads, as described in the Advertising section.
• Users whose content you visit or interact with: technical data about your visit or interaction (and, if you make a purchase, the details needed to complete it) is made available to that user, as described in this Policy.
• Content you choose to publish: anything you make public can be seen by anyone with access and may be indexed by search engines. Please check what you publish.
• Legal and safety: to comply with law, court orders or valid government requests, to enforce our Terms, and to protect the rights, safety and property of users, us or others.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this Policy’s protections.
• With your consent or at your direction, for example when you connect a third-party integration.

9. Cookies and similar technologies

We use cookies and similar technologies for the following purposes:

• Strictly necessary: sign-in sessions, security (CSRF protection), load balancing, language and cookie-consent preferences.
• Functional: remembering settings such as theme and language.
• Analytics: understanding how the Services are used and improving them.
• Advertising: showing and measuring ads, including personalized ads where permitted (see the Advertising section).

Where required by law, non-essential cookies are used only with your consent, which you can manage through our cookie banner or your browser settings. Blocking some cookies may affect how the Services work. We honor browser signals such as Global Privacy Control where required by applicable law. A detailed list of the cookies we use is available in our Cookie Policy.

We use Google Analytics, a web analytics service provided by Google, to understand how the Services are used. It uses cookies and similar technologies, and Google receives information such as the pages you visit, your device and your approximate location. You can opt out of Google Analytics with the Google Analytics Opt-out Browser Add-on. To learn more, see How Google uses information from sites or apps that use its services.

10. Advertising

We display ads on the Services, including through Google AdSense. Advertising partners, including Google, use cookies, device identifiers and similar technologies to show and measure ads, including ads based on your visits to the Services and to other websites.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to the Services and other websites.
• Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to the Services and/or other sites on the Internet.
• You can opt out of personalized advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors’ use of cookies for personalized advertising at www.aboutads.info.
• To learn more about how Google uses data when you use sites and apps of its partners, see How Google uses information from sites or apps that use its services.
• EEA, United Kingdom and Switzerland: ads personalization and related cookies are used only if you give consent through our consent banner. Without consent, ads are not personalized and may be limited or not shown. You can change your choice at any time.
• US states with privacy laws: you may opt out of targeted advertising and the sharing of your data for advertising, including through a Global Privacy Control signal or our privacy choices controls. When you opt out, we stop personalized advertising and limit how advertising partners process your data, as required by applicable law.

11. International data transfers

We operate globally and your data may be processed in countries other than where you live, including countries whose data protection laws may differ from yours. Where required, we use appropriate safeguards for transfers, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions, or other lawful transfer mechanisms. You can contact us to request details of these safeguards. A list of our main service providers (sub-processors) is available on request at [email protected].

12. Data retention

We keep personal data only as long as needed for the purposes described in this Policy:

• Account and content: while your account is active. When you delete your account, we delete or anonymize your personal data and content within a reasonable period (generally up to 30 days), except where we must keep it by law or for the legitimate purposes below.
• Stored files and AI history: until you delete them or your account; files may remain in backups for a limited time.
• Billing records: as required by tax and accounting laws (often 5–10 years).
• Transaction records of your sales: while your account is active so you can access your sales history, and afterwards only for as long as necessary for legal, dispute-resolution and fraud-prevention purposes. You remain responsible for keeping the records your own tax and accounting laws require.
• Team, API and domain data: while the workspace, domain connection or API key is active. API request logs are generally kept for a limited period. After you remove a domain, a member or a key, the related data is deleted or anonymized within a reasonable period, subject to legal and security needs.
• Logs and security data: typically for a limited period, longer if needed to investigate abuse or incidents.
• Visitor analytics: according to your plan and the retention settings of the Services.
• Support and marketing records: support messages for as long as needed to handle your request and meet legal requirements, and marketing contact details until you unsubscribe or ask us to delete them.
• Inactive free accounts and files: may be deleted after a period of inactivity, after notice where practicable.

13. Security

We use technical and organizational measures designed to protect personal data, including encryption in transit, encryption of stored payment credentials, hashed passwords, access controls, and monitoring. No system is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password, keep your credentials, API keys and gateway keys confidential, use team roles and permissions carefully, and revoke any key you believe is compromised. If we become aware of a breach affecting your data, we will notify you and the relevant authorities as required by law.

14. Your rights and choices

Depending on where you live, you may have some or all of these rights:

• Access and obtain a copy of your personal data.
• Correction of inaccurate or incomplete data.
• Deletion of your personal data.
• Restriction or objection to certain processing, including direct marketing.
• Portability: receive your data in a structured, commonly used format.
• Withdraw consent at any time.
• Not be subject to solely automated decisions with significant effects.
• Opt out of targeted advertising and of the sale or sharing of your personal data, where the law provides this right.
• Lodge a complaint with your local data protection authority.

You can exercise many of these rights yourself through the tools available in your account and on our website, such as editing your profile, exporting or deleting your data, deleting your account, and managing your cookie and email preferences. For anything you cannot do yourself, contact us at [email protected]. We may need to verify your identity, and we will respond within the time required by law (generally 30 days). We will not discriminate against you for exercising your rights. If we decline a request, we will explain why, and where the law gives you a right to appeal, you may appeal by replying to our response; you may also contact your local data protection authority.

15. Regional information

European Economic Area, United Kingdom and Switzerland

You have the rights described above under the GDPR, UK GDPR and Swiss FADP. You can complain to your national supervisory authority.

California, USA (CCPA/CPRA) and other US states

In the last 12 months we may have collected the categories of personal information described in Personal data we collect for the business purposes described in How we use personal data, and disclosed them to the categories of recipients described in How we share personal data. California and other US state residents may request to know, access, correct, delete, and opt out of sale/sharing or targeted advertising, and to limit the use of sensitive personal information. You may use an authorized agent to submit requests.

Brazil, Canada, Australia, Singapore, Vietnam, Japan, South Korea, India and others

Where local laws such as the LGPD, PIPEDA, the Privacy Act 1988 (Australia), PDPA (Singapore), Vietnam’s Personal Data Protection Law and its implementing regulations (including Decree 356/2025/ND-CP), APPI (Japan), PIPA (South Korea) or the DPDP Act (India) apply, you have the rights those laws grant, which are generally consistent with those listed above. Where these laws require your consent to the processing or cross-border transfer of your data, we ask for it (for example at sign-up or through a consent banner) before relying on it. Contact us to exercise your rights.

16. Children’s privacy

The Services are not directed to children under 16 (or the higher minimum age required in your country), and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact [email protected] and we will delete it.

17. Third-party links and services

Content, links and tools on the Services may lead to websites or services we do not control, including payment gateways. We are not responsible for their privacy practices. Please review their policies.

18. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email, in-app notice or a prominent notice on the Services before they take effect where required. The “Last updated” date shows the latest version. Continued use of the Services after changes means you accept the updated Policy. This Policy may be provided in several languages for convenience; if there is any inconsistency, the English version prevails to the extent permitted by law.

19. Contact us

Questions or requests about this Policy or your personal data:

• Email: [email protected]