Privacy Policy

1. Who we are

TCF Ltd trading as The Cloud Factory ("we", "us", "our", the "Company") operates Grafikarta, a software-as-a-service platform and brand. We are registered in England and Wales under company number 17264204 with registered office at 47 Eridge Road, Tunbridge Wells, TN4 8HR. We are the Data Controller for the personal data described in this policy.

For all privacy enquiries, contact [email protected].

2. Personal data we collect

• Account data: email address, display name, profile image (from a federated sign-in provider, if used), authentication tokens.
• Session data: session tokens, IP address, user-agent string, timestamps, used to keep you signed in securely.
• Billing data: a payment-processor customer reference and the credit ledger (purchases, debits and refunds linked to your account). If you turn on auto-reload, our payment processor (Stripe) stores your payment method, and we store a reference to it, the card brand and last four digits, and your auto-reload threshold and amount. We do not store full payment card numbers; these are held by our payment processor.
• Service content: Brand and Product details, prompts, reference images you upload, parameters of each Generation request, and the resulting generated images.
• Locale preference: your selected language, stored in a cookie.
• Advertising measurement data: if you accept advertising cookies on the marketing site, Google Ads records that you visited after clicking one of our ads, using cookie identifiers, your IP address and browser details.
• Website usage data: if you accept cookies on the marketing site, Google Analytics records the pages you view, how you reached them and how you interact with them, using cookie identifiers, your IP address and browser details.
• Application usage data: if you accept cookies on the marketing site, Google Analytics records the pages you view in the application and four milestones: signing up, creating a Product, a completed image Generation, and purchases, using cookie identifiers, your IP address and browser details. Purchases, including auto-reload top-ups, are reported to Google Analytics from our servers with your Google Analytics cookie identifier, the amount and the currency.

3. How we use your data and lawful bases

4. How we share your data

We may share personal information with carefully selected service providers, contractors, business partners, and technology providers who assist us in operating, maintaining, securing, improving, and providing the Services. Each is bound by a data processing agreement and processes personal data only on our documented instructions.

The categories of recipients include providers of:

• payment processing;
• AI image generation and processing;
• transactional email delivery;
• cloud hosting and object storage;
• authentication and federated sign-in;
• advertising measurement and website analytics (Google Ads and Google Analytics, provided by Google Ireland Limited and Google LLC), only if you accept cookies. Google Ads runs on the marketing site only; Google Analytics covers the marketing site and the application.

We may also disclose personal data to professional advisers, regulators or law-enforcement authorities where required by law, and to a successor entity in connection with a merger, acquisition or sale of assets.

5. International transfers

Several of our service providers are based outside the United Kingdom, primarily in the United States. Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or equivalent appropriate safeguards.

6. Retention

• Account, Brands, Products, Generations: kept for the lifetime of your account. On account deletion, soft-deleted within 30 days and permanently purged within 90 days, subject to legal hold.
• Billing and tax records: retained for the period required by UK tax and accounting law (currently six years).
• Sessions and logs: typically retained for up to 90 days.
• Staff access records: records of our staff viewing or acting on your account are kept for one year, then deleted.
• Payment-provider event log: retained for the statutory tax-record period.

7. Cookies

We use strictly-necessary and functional cookies, which need no consent, and, only if you accept them, advertising cookies on the marketing site and analytics cookies on the marketing site and the application. The application runs no advertising scripts.

• locale: stores your language preference for 12 months.
• session: keeps you signed in to the application; set by our authentication framework, HTTP-only, expires when your session ends.
• grafikarta_consent: remembers whether you accepted or rejected advertising and analytics cookies; set on grafikarta.com and its subdomains, for 6 months.
• Google Ads cookies (such as _gcl_au): set by the Google tag only after you select Accept, to measure which of our ads lead to visits to this website. Google keeps them for up to 90 days.
• Google Analytics cookies (_ga and _ga_RJZMH5FBM4): set by the Google tag only after you select Accept, to count visits and understand how the site and the application are used. They last up to 2 years.

The marketing site asks for your choice when you first visit. Until you accept, the Google tag runs in a restricted mode that sets no cookies and sends Google only basic, cookieless signals, such as that a page was viewed. You can change your choice at any time from Cookie settings in the site footer. Rejecting has no effect on your use of the site.

Your choice on the marketing site also applies to the application at app.grafikarta.com, which has no banner of its own. If you have not made a choice, the application treats it as a refusal.

8. Your rights

Under UK GDPR you have the right to: access your personal data; have it rectified; have it erased; restrict or object to processing; data portability; and withdraw consent at any time where processing is based on consent. To exercise any right, contact [email protected]. We will respond within one month.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Security

We apply appropriate technical and organisational measures to protect personal data, including TLS in transit, encrypted storage of credentials, scoped database access, and audit logging. No system is perfectly secure; you are responsible for keeping your account credentials confidential.

10. AI generation and your inputs

When you submit a Generation, the prompt, Product metadata and reference images are transmitted to our third-party AI image generation provider solely to produce your requested output. We do not use your inputs or generated outputs to train our own AI models. The handling of data by that provider is governed by its own policies.

Authorised members of our team may review Generations, together with the prompts, Product details and reference images used to make them, to monitor and improve output quality and to investigate faults or misuse. Access is limited to staff who need it and is logged. We do not publish or share your content as a result of this review, and it does not involve training AI models.

11. Children

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children.

12. Changes

We may update this policy from time to time. Material changes will be notified via the Service or by email. The "Last updated" date above always reflects the latest revision.

13. Contact

For all privacy enquiries and data-rights requests, contact [email protected].

14. Company information

• Company name: TCF Ltd
• Trading name: The Cloud Factory
• Company registration number: 17264204
• Contact email: [email protected]

TCF Ltd (trading as The Cloud Factory) is the Data Controller and operates Grafikarta. Registered in England and Wales.