Privacy policy

What happens today

This phase serves static pages. There are no accounts, photo uploads, payments, advertising scripts or analytics scripts. The site does not set application cookies or store photos. Hosting infrastructure processes technical request data, including IP addresses, URLs and browser information, to deliver and protect pages. The intended host is Cloudflare Pages.

Waitlist

We store your email address, signup time, the page you came from, and a one-way keyed hash of your IP address used only for rate limiting. Raw IP addresses are not stored in the waitlist database. Cloudflare Turnstile (by Cloudflare) checks for bots and processes device/browser signals under Cloudflare’s privacy policy (https://www.cloudflare.com/privacypolicy/).

We will send one launch email when AI renders open. Create an account with your waitlist email to receive 20 bonus credits. No spam; unsubscribe anytime or request deletion via support@aichristmaslights.com. Waitlist records are deleted when the waitlist ends or within 12 months, whichever is earlier.

The local designer

The manual designer processes your selected photo in your browser without uploading it. A later choice to use AI will require a separate upload and consent step. Files you export will stay where you save them; deletion from our service cannot remove copies saved on your device or shared elsewhere.

Information planned for the AI service

At launch, account information will include an email address and basic sign-in profile where applicable. The service will process uploaded photos, generated outputs, selected settings and consent records. IP and device identifiers will support quotas and abuse prevention. If payments open, payment references and transaction records will support purchases and refunds; we will not collect card numbers directly.

Please remove people, documents and identifying details from photos. The AI flow will re-encode images to remove EXIF metadata, including GPS, before upload and offer a house-number and plate blur tool. Check the photo yourself: metadata removal cannot hide an address visibly printed in the image.

Retention and deletion at launch

Uploads will be deleted within 24 hours. Outputs will be kept for 30 days or until you use Delete. Those periods apply to the service copies, not your downloads. Necessary security, consent, account and payment records may need separate retention for operations or legal obligations; those periods will be documented before the relevant feature opens. Do not treat the service as a photo archive.

Processors and purposes

Planned processors include Cloudflare for hosting, storage, security and possible image moderation; Yir and underlying model providers for image generation; Google for optional sign-in; and PayPal when payments open. They will receive information needed for the relevant function. Photos will need to leave your browser for AI generation. Processor terms and any international transfer safeguards will be reviewed before launch.

We do not currently sell or share personal information for targeted advertising. No analytics provider has been enabled. If analytics or advertising is added, this policy and any required consent controls must be updated before collection begins. We do not promise model-training exclusions that have not been verified with the relevant processors.

Your choices and privacy requests

Contact support@aichristmaslights.com for access, correction, deletion or questions about processing. If GDPR or UK data protection rights apply, you may also ask about restriction, objection, portability and withdrawing consent where processing relies on it. If California privacy rights apply, you may request information, access, correction or deletion and exercise applicable opt-out rights without discrimination. We will assess requests under the law that applies and may ask for proportionate verification.

Use the subject “Privacy request.” Describe your request and the relevant account email or page URL. Do not send passwords, full payment details or identity documents in an initial email. You may also contact your relevant data protection authority. The service is intended for adults aged 18 and over; contact us if a child’s information may have been submitted.

Policy status

The operator’s verified legal details, processor arrangements and any required jurisdiction-specific disclosures must be completed before the AI service opens. Material changes will be reflected on this page. Draft updated October 30, 2026.