Privacy Policy

This Privacy Policy explains what information DuskHeist collects, how we use it, and what control you have over it. It applies to duskheist.com and any related services.

We have written this in plain language on purpose. If anything is unclear, contact us at support@duskheist.com.

1. Who Is Responsible for Your Data

DuskHeist is operated by Faizan Ali, a sole proprietor based in Pakistan. For the purposes of the GDPR and similar laws, we are the data controller for the information described in this policy.

Contact for all privacy matters: support@duskheist.com

2. Information We Collect

Photos you upload. When you use the Service, you upload one or more images. These are processed to generate your artwork. See section 4, which covers this in detail.

Generated artwork. The images the Service creates for you.

Account information. Your email address. There are no passwords: you sign in with Google or with a one-time code sent to your email. If you sign in with Google, we receive your email address and basic profile information from Google.

Payment information. Handled entirely by Paddle, our payment provider and merchant of record. We never see or store your card details. We store only a record of your purchase: the amount, date, and credits added.

Technical information. Collected automatically: IP address, browser type, device type, operating system, referring page, and pages visited. Used for security, fraud prevention, enforcing free-credit limits, and understanding how the Service is used. For the last purpose we use a privacy-friendly statistics service (see sections 5 and 9) that counts visits without cookies and without building a profile of you.

Cookies. Small files stored in your browser. See section 9.

3. How We Use Your Information

We use the information we collect to:

• Process your images and deliver your generated artwork
• Create and manage your account
• Process payments and maintain credit balances
• Provide customer support
• Detect, prevent and investigate fraud, abuse and security incidents
• Enforce limits on free credits
• Understand how the Service is used so we can improve it
• Send you service-related messages, such as receipts or important changes

We do not sell your personal information. We do not sell or share your photos.

4. How Your Photos Are Handled

This is the part that matters most, so we are being specific.

We do not perform facial recognition. We want to be completely clear about this, because photographs of faces are treated as sensitive data under laws including the GDPR and the biometric privacy laws of several US states.

Specifically:

• We do not create, extract, store or use a faceprint, face template, face geometry scan, or any other biometric identifier from your photo.
• We do not use your photo to identify you, to match you against any database, or to recognise you across images or sessions.
• We do not sell, lease, trade or otherwise profit from any facial data, and we never will.
• Your photo is used for one purpose only: as a visual reference so the AI model can draw an illustrated character based on it.

The output is an illustration. It is not a measurement of your face.

Where your photo goes. When you generate an image, your uploaded photo is transmitted over an encrypted connection to our AI processing provider, OpenAI, to produce the output. It is processed solely to fulfil your request.

How long we keep it. Your uploaded photo is deleted from our servers within 24 hours of upload. We keep it only as long as needed to run your generation and handle an immediate retry.

How long our AI provider keeps it. Please read this. Deleting a photo from our servers does not delete it from theirs. OpenAI retains API inputs and outputs for a limited period (currently up to 30 days) for abuse monitoring and legal compliance, after which they are deleted. This retention is controlled by OpenAI under their own policies, not by us. We are telling you this so you know exactly what happens to your image.

Training. Your photos are not used to train our models. We do not grant our AI provider permission to train on your images, and API data is not used for model training by default under their policy.

Who can see your images. Your uploads and generated artwork are private to your account. They are not published, listed or shown to other users unless you explicitly opt in to featuring your work in our public gallery. You can withdraw that opt-in at any time.

5. Who We Share Information With

We share information only with service providers who help us operate, and only to the extent needed:

We may also disclose information where required by law, to enforce our Terms, or to protect the rights and safety of our users or the public.

6. Legal Basis for Processing

Where the GDPR or UK GDPR applies to you, we process your information on these bases:

• Contract: to deliver the service you have asked for, including processing your photo to generate your artwork
• Legitimate interests: security, fraud prevention, enforcing free-credit limits, and improving the Service
• Consent: for optional features such as featuring your artwork publicly, and for non-essential cookies
• Legal obligation: where the law requires us to retain or disclose information

7. Your Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct information that is inaccurate
• Delete your information and your account
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent you have previously given
• Lodge a complaint with your local data protection authority

To exercise any of these, email support@duskheist.com. We will respond within 30 days and will not charge you or treat you differently for asking.

8. Retention

Data held by our AI provider is subject to their retention period, described in section 4.

9. Cookies

We use cookies for:

• Essential functions: keeping you logged in, remembering your credit balance, security and fraud prevention. These cannot be switched off.

We do not use advertising cookies. We measure visits with Umami, a statistics service that sets no cookies, collects no personal information such as your name or email, and does not follow you across websites. It records only the page address (without anything after a question mark, except a campaign tag in our own links such as "utm_source=tiktok", which tells us which platform a visit came from), the referring site, and your browser, device type and country. If your browser sends a "Do Not Track" signal, you are not counted at all.

You can control cookies through your browser settings. Disabling essential cookies may prevent parts of the Service from working.

10. Data Security

We protect your information using encryption in transit (HTTPS), encrypted storage, restricted internal access, and secure handling of API credentials.

No system is completely secure. While we take these measures seriously, we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.

11. International Transfers

We operate from Pakistan, and our service providers may process data in other countries, including the United States and the European Union. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for these transfers.

By using the Service you understand that your information, including your uploaded photo, will be processed outside your country of residence.

12. Age Requirement

The Service is for adults only. You must be 18 or older to use it.

We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us with personal information, contact us at support@duskheist.com and we will delete it and close the account.

13. Changes to This Policy

We may update this Privacy Policy. When we do, we will update the "Last updated" date above and, for material changes, notify you through the Service or by email.

14. Contact

For any privacy question or request: support@duskheist.com