Privacy Policy

1. Information We Collect, Generally

Information you provide to us.

• Account and identity. When you sign in, we receive your name, email address, and username from our identity provider, and we store your account settings (such as your account role, plan or tier, theme, and the product interests you select) and your onboarding status. We also work out from your email domain whether your address is personal or work. If you join a waitlist, contact sales or support, or send feedback through the Service, we collect the email address and information in your message.
• Information you tell us about you and your advertising. After you sign up, we may ask how you would describe yourself (for example, an online store owner, an agency or a freelancer) and about how much you spend on ads, or manage for clients, each month. After your first ad download, we may ask where the ad will run, including if you are a guest. If you choose “Other,” you can add a short note. These questions are optional and you can skip any of them. If a guest answers and later signs up, the answer moves to the account.
• Content you create and upload (“Your Content”). This includes the prompts and instructions you enter; the images, videos, and emails you generate; brand kits (such as logos, product images, mood and reference images, brand descriptions, tone of voice, fonts, and colors) and any files you upload; custom personas, which may include images of people (including faces) that you upload; and any website URL you ask us to analyze in order to build a brand kit.
• Payment information. If and when you purchase a paid plan, your payment is collected and processed by our third-party payment processor (such as Stripe). We do not receive or store full payment card numbers, and we may keep limited billing records such as your plan, transaction identifiers, and billing contact.

Information we collect automatically.

• Usage and device data. When you use the Service, we automatically collect log and device information such as your IP address, browser type, device and operating system, the pages and features you use, and timestamps. We record usage events (for example, when you generate an image or video) to operate the Service, to apply usage limits, and to understand how the Service is used. Section 7 describes the analytics tools we use.
• Browser storage. See “Cookies, Tags and Analytics” below.

Guest sessions. If you use the Service without creating an account (where guest access is available), we create a temporary, anonymous session identified by a token stored in your browser. Content created during a guest session is associated with that session and is transferred to your account if you later sign in.

2. How We Use Your Information

We use the information we collect to:

• provide and operate the Service, including generating the images, videos, emails, and other creative outputs you request;
• index Your Content so you can search it within the Service;
• maintain your account, apply your settings, and personalize your experience;
• apply usage limits and plan entitlements, and prevent abuse;
• understand how the Service is used and measure our advertising, as described in Section 7;
• understand who uses the Service, how different kinds of customers use it, and who to build for and market to, including from any questions you choose to answer;
• keep a customer record for your account, as described in Section 7;
• communicate with you about the Service, including service and transactional messages, support responses, and, where permitted, product updates;
• maintain the security and integrity of the Service, prevent fraud, and comply with law; and
• process payments for paid plans, through our payment processor.

We do not train AI models on Your Content. We do not use Your Content, including your prompts, uploads, or generated outputs, to train or fine-tune AI models. Your Content is used to provide the Service to you, and is shared with the third-party AI providers described in Section 3 solely to generate the output you request and to index Your Content so you can search it. Those providers handle data in accordance with their own terms.

3. AI Providers and How Your Content Is Processed

To create your outputs, index Your Content for search, and run the Service, we share relevant information, such as your prompts, reference images, brand assets, the videos and images you generate or upload, and any website URL you provide, with third-party providers that act as our service providers, including:

• AI generation providers that produce text, image, video, audio, avatar, and lip-sync results;
• an AI search-indexing provider (currently Google, through its Gemini embedding service) that indexes Your Content so you can search it;
• media storage and content-delivery providers that host and serve your generated files;
• web-data providers that retrieve information from a website URL you provide so we can build your brand kit;
• advertising-intelligence providers used to surface examples of public competitor advertisements by brand name; and
• email-delivery providers used to send a test email to a recipient address you specify.

Search indexing. So you can search your ads by what they show and say, we send Your Content, including the videos and images you generate or upload, their scripts, and details such as the brand, product, and ad type, to Google’s Gemini embedding service. The service returns an embedding, a list of numbers that represents the content, which we store as derived data with your content. We use embeddings only to find content when you search, and search results only include content you already have access to. An embedding is deleted when the content it was made from is deleted. Indexing covers content you created before this feature was introduced as well as new content. If you search with an image or video of your own, we send it to the same service to find matches and do not store it. We use a paid Google service for indexing, and under its terms Google does not use the content to train its models.

We share information with these providers only to provide the Service, and they process it in accordance with their own privacy terms. We maintain a current list of these subprocessors and will provide it on request to privacy@anoki.ai.

4. Information Sharing

We share personal information only as described in this Policy, including:

• Service providers and subprocessors, as described in Section 3, and additional providers that support hosting, identity and authentication, customer support, and internal operations. For example, we route in-product feedback and bug reports, which may include a screenshot, to our team through a messaging tool;
• Analytics, advertising and consent providers, such as Google, PostHog and Cookiebot, as described in Section 7;
• Our customer relationship management provider, HubSpot, as described in Section 7;
• Legal and safety, to comply with applicable law, respond to lawful requests, enforce our terms, and protect the rights, property, and safety of Anoki, our users, and others; and
• Business transfers, in connection with a merger, acquisition, financing, reorganization, or sale of assets.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

5. Your Content and Visibility

Your creations are private to you, and to your organization if applicable, by default. Your Content becomes visible to others only if (a) you choose to share it or make it public, or (b) you give us permission to feature it, for example in examples or showcases.

If you make content public, others may be able to view, and in some cases copy or reuse, that content, so please do not include confidential or sensitive information in anything you make public. You are responsible for ensuring you have the rights to any materials you upload, including images of people; do not upload an image of a person without their permission. You retain your rights in Your Content as set out in our Terms.

6. Your Choices

• Access and update. You can view and update your account information and settings within the Service. To change or delete any answers you gave to our sign-up questions, contact privacy@anoki.ai.
• Delete your account and content. You can delete your account from within the Service. Deleting your account removes your content from our active systems, including files stored on our content-delivery network. Some information may remain, including analytics data held by PostHog and Google Analytics and information held by HubSpot, as described in “Retention.”
• Communications. You can opt out of non-essential or promotional emails. We will still send you service and transactional messages.
• Cookies. You can change your cookie choices at any time through Cookie settings. See Section 7.

7. Cookies, Tags and Analytics

We use browser storage that is necessary to operate the Service, for example to keep you signed in, to remember a guest session, to remember your cookie choices, and to remember which in-product tips you have already seen.

Optional cookies. Our cookie banner, run by Cookiebot, lets you allow or refuse optional cookies. If you allow statistics cookies, Google Analytics, a Google service, sets cookies that recognize your browser across visits so we can understand how the Service is used.

What Google Analytics receives. It receives the address and title of each page you view, including anything that address contains, such as a search you typed; the features, apps and buttons you use; links you follow out of the Service, forms you use and how far you scroll; when you start or finish a generation, download or share; the domain of a website you scan; an identifier for your account or guest session and for the projects you work on and share; the type of ad you first chose; when you sign in or sign up, the button that led you there, and how many product interests you select; whether you are a guest or registered user; whether your email address is personal or work; your credit balance; and your device, browser and language. Google also receives your IP address when your browser connects to it.

If you refuse or have not chosen. Google Analytics does not set cookies on your device. Your browser still sends Google most of the information above, without cookies.

Advertising measurement. Our Google Analytics property is linked to our Google Ads account, so visits and actions on the Service, such as sign-ups, can be reported to Google to measure our advertising. This happens without cookies if you refuse. If you allow marketing cookies, Google may use cookies to connect those actions to ads, and we keep in your browser the ad click identifiers and campaign tags that brought you here (such as gclid, fbclid and UTM tags), including from advertising cookies set on our website at creativeai.anoki.ai.

Product analytics. If you allow statistics cookies, we also use PostHog, a product analytics service hosted in the United States, to understand how the Service is used. If you have an account, PostHog receives your email address and name. It receives every page you visit, with its full address, including anything that address contains, such as a search you typed or the address of a website you asked us to scan; the address of the page that sent you to the Service, the campaign tags and ad click identifiers that brought you here (such as UTM tags, gclid and fbclid), and the campaign, website and page through which you first arrived; if you have an account and Meta’s advertising cookies are set in your browser, for example by our website at creativeai.anoki.ai, the identifiers those cookies hold for your browser and your ad click; and how you use each page: how long you stay on it, the buttons, links and other things you click, with their text, when you change a field (but never what you type into it), the forms you submit, repeated clicks and clicks that do nothing, how far you scroll, and where on the page you click and move your mouse, which PostHog shows as heatmaps. It also receives events from our servers such as sign-ups, generations, downloads and purchases, including what you paid; identifiers for your account or guest session, your organization, your browser and the projects you work on; whether you are a guest or registered user, your plan and your credit balance; the type of ad you first chose; the domain of a website you scan; whether your email address is personal or work; and the product interests you select and your selected answers to the questions about you and your advertising described in Section 1, including the places you say your ad will run, but not any note you add after choosing “Other.” We keep those notes in the app’s saved answers, and the one about how you describe yourself also goes to HubSpot, as described below. PostHog also receives your device type, browser, operating system, language, time zone and screen size; how quickly pages load and respond; errors in the page’s code and requests to our servers that fail; and your IP address when your browser connects to it, which PostHog may store and use to estimate your location, such as your city and country. PostHog keeps in your browser’s storage its identifier for your browser and copies of what it sends about you, such as your email address and name, the address and referrer you first arrived with, and the campaign tags and ad click identifiers above. It does so if you allow statistics cookies, even if you refuse marketing cookies, and refusing statistics cookies removes it.

Session recordings. PostHog also records your visits: a replay of each page as it appeared on your screen, including the text, images and other content shown on it, your mouse movements, clicks and scrolling, and a list of the requests the page makes, with their addresses and timing. What you type into fields is hidden in recordings, but text the page then shows, such as a prompt you have sent, and anything in a page or request address, such as a search, appears in them. Protected images and videos may not appear in a recording.

What PostHog does not receive. PostHog receives no events and no recording from the page a shared link opens, and shared links are hidden where our pages list them. It can still learn that you visited or arrived from a shared page, how long you stayed and how far you scrolled, but never the link’s private code. From the page addresses and links it receives, we remove the private code of a shared link, the codes used to sign you in, and any part of an address named as a token, password or email address. Typed notes you add after choosing “Other” are not included in answer analytics.

Your statistics choice applies to the browser where you make it. Each browser where you are signed in or have a guest session reports its choice to us when you visit, and we store the most recently reported choice with that account or guest session. Our servers send PostHog information about you only while that stored choice allows statistics cookies. It stays in effect until a browser reports a different choice, even if the choice has since expired or been cleared in your browser. If you refuse or have not chosen, PostHog does not load in your browser. If you later refuse, PostHog stops receiving information about you from that browser and from our servers, although information already on its way to PostHog may still arrive. If you still allow statistics cookies in another browser, PostHog keeps receiving information from that browser, and your next visit there tells our servers to send it again. Changing your choice does not delete what PostHog has already received; see “Retention.”

Customer records in HubSpot. If you have an account, we keep a customer record for it in HubSpot, a customer relationship management service, to understand who uses the Service, how they use it and how they found us. We create it after you sign up and keep it up to date, and your cookie choices do not change this. HubSpot receives your email address and name; your account identifier, sign-up date and organization name; whether your email address is personal or work; your plan and whether you have signed up, finished a generation or paid; your answers to the questions about you and your advertising described in Section 1, a group we work out from how you describe yourself, and any note you add after choosing “Other” for how you describe yourself; the first website link you gave us for a brand kit or product kit, without anything after its path, with its domain and the kind of site it is; and the dates of your first finished generation and first download. About once a day, if you have been active, it also receives how many sessions, active days, brand kits, images and videos you have, the date of your latest session, your credit balance if your account has one, the credits you have spent, and what you have paid us, after refunds. A note you add about where your ad will run stays in the app’s saved answers. HubSpot receives nothing from a guest session unless you sign up and it moves to your account, and nothing about our own team’s accounts.

Linking your earlier visits. If you allow marketing cookies on our website at creativeai.anoki.ai, HubSpot’s tracking records the pages you visit there and how you found us, and sets a cookie that identifies your browser. That cookie can also be read at cai.anoki.ai. When you sign up, if you also allow marketing cookies in the Service’s cookie banner, we send HubSpot that cookie’s identifier and the campaign tags (such as UTM tags) that first brought you here, so HubSpot can connect those visits, their original source and any ad campaign to your customer record. If you refuse, or have not chosen by about 10 minutes after you sign up, we create your record without them and those visits stay unconnected. Changing your choice after your record is created neither undoes a connection already made nor adds one.

Tools we may add. In the future, we may also report actions such as sign-ups, downloads and purchases directly to advertising platforms, such as Google Ads and Meta, if you allow marketing cookies. Such a report could include a hashed version of your email address, the ad click identifiers that brought you here, and your IP address and browser details, so they can connect the action to an ad.

Your choices. You can change your choice at any time through Cookie settings, in the footer of our public pages and in your account menu. You can also control browser storage through your browser settings, although some features may not work if you disable it.

8. Children

The Service is designed for use by adults (ages 18 and over). We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with personal information, please contact privacy@anoki.ai and we will take steps to delete it.

9. Retention

We retain personal information for as long as your account is active, and for the period reasonably necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. When you delete your account or content, we delete or de-identify the associated information from our active systems. Residual copies may persist in routine backups for a limited period before they are overwritten. Deleting your account deletes any answers you gave to our sign-up questions. However, deleting your account does not automatically delete analytics data held by PostHog or Google Analytics, including any answers to our sign-up questions that were sent to PostHog. You can ask us at privacy@anoki.ai to delete it. When you delete your account, we also delete your customer record in HubSpot, and HubSpot keeps a deleted record for 90 days before removing it permanently. The details we sent when we created that record, such as your email address, name, account identifier, sign-up date, plan and any campaign tags, can stay in HubSpot’s form records after that. You can ask us at privacy@anoki.ai to delete them. Cookies set by Google Analytics last up to two years unless you clear them.

10. Security

We take appropriate technical and organizational measures designed to protect personal information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Do Not Track

Some browsers offer a “Do Not Track” (DNT) signal. The Service does not currently respond to DNT signals.

12. Changes to This Privacy Policy

We may update this Policy from time to time. We will post the updated version with a new “Last Updated” date and, where appropriate, provide additional notice.

13. Contact Us

If you have questions or requests regarding this Policy or your information, contact us at privacy@anoki.ai.

14. Additional Information for U.S. States

If you are a resident of California, Colorado, Connecticut, Utah, or Virginia, or another U.S. state with applicable privacy laws, you may have additional rights, including the right to access, correct, or delete your personal information and to opt out of certain processing. We do not sell your personal information or use it for cross-context behavioral advertising. For more detail, please refer to the Anoki U.S. States Privacy Notice, and contact privacy@anoki.ai to exercise your rights.

15. Additional Information for the EEA, Switzerland, and the UK

If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have rights under the GDPR and UK GDPR, including the rights of access, rectification, erasure, restriction, objection, and data portability, and the right to lodge a complaint with your supervisory authority. Information about the legal bases on which we process your information, and how to exercise these rights, is set out in the Anoki Europe Privacy Notice. You may also contact privacy@anoki.ai. Your information may be transferred to and processed in the United States and other countries, and where required we apply appropriate safeguards to such transfers.