Privacy Policy

Data controller and operator: Dreamega IT LLC, a Wyoming limited liability company, 30 N Gould St, Ste N, Sheridan, WY 82801, United States.

1. Scope

This policy explains how GenSpicy handles information when you visit the site, create an account, purchase credits, use its adult AI creative tools, or take part in the referral program.

2. Information We Handle

Depending on the features you use, this may include:

• Account details such as your name, email address, and sign-in records
• Your 18+ and terms confirmation, with its date and the terms version you accepted
• Sign-up context: IP address, approximate country, browser language, the first external site that referred you, and campaign (UTM) tags in the link you arrived with
• Prompts, uploaded reference media, generated outputs, and generation settings
• Credit-pack purchases, credit reservations and charges, and transaction records
• Referral records, if you were referred or you refer others
• Device, browser, session, security, and diagnostic information
• Support messages and abuse reports

Payment card details are handled by the payment processor rather than stored by GenSpicy.

3. Why We Use Information

We use information to operate accounts and generations, deliver purchases, keep your history, run the referral program, provide support, prevent abuse, enforce adult-safety rules, secure the service, meet legal obligations, and improve reliability.

4. Your Media Stays Private

Your generated and uploaded media are private to your account. They are not shown in a public gallery or to other users, and the files are delivered only to your signed-in account. Private means private inside GenSpicy: to create a result, your prompt, selected reference media, and settings must be sent to the AI provider (section 5).

5. Service Providers

We share information with providers only as needed to run the service. Some of them are used only when the operator turns them on in the admin settings; those are marked "when enabled".

• AI generation: our third-party AI generation partner receives prompts, selected reference media, and generation settings to complete each request, and processes them under its own terms and privacy policy. It keeps generated media for up to seven days.
• Storage: generated outputs and uploads are kept in the configured object storage (for example Cloudflare R2 or another S3-compatible service).
• Payments: the payment provider you choose at checkout (for example Stripe, PayPal, or Creem) processes your payment and shares the payment result with us.
• Support inbox: Cloudflare receives messages sent to support@genspicy.com. We store the email text, headers, original message and attachments privately so authorized staff can handle your request. Telegram support alerts include the sender address, subject, a short text excerpt and a link to the private inbox. Attachment files are not sent in these alerts.
• Email: an email provider (for example Resend or Cloudflare Email) sends account and verification emails, when enabled.
• Google sign-in: if you sign in with Google or Google One Tap, Google shares your name, email address, and profile picture with us, when enabled.
• Basic traffic statistics (Plausible, when enabled): cookie-free pageview measurements run independently of the optional analytics cookie choice. We send known public page paths (other model, tool and template detail paths are grouped), short UTM source/medium/campaign labels, and the external referring site’s origin. Other query parameters, URL fragments, account and admin pages, prompts, media and account identifiers are excluded. Requests naturally include technical network information such as IP address and browser User-Agent. We do not add persistent visitor identifiers or analytics cookies. Do Not Track, Global Privacy Control and the browser’s Plausible ignore setting disable these pageviews.
• Google Analytics (when enabled): Google Consent Mode sends limited cookieless measurement pings before a choice or after rejection. We send pageviews only for known public pages, remove private URL parameters, group detail paths, and limit external referrers to their origin. Private routes use a generic placeholder for tag metadata. With analytics consent, Google can use analytics cookies and connect visits to the conversion events below. Advertising signals and ad personalization are disabled. These limited pings still reach Google and are not a promise of complete visitor counts. Do Not Track and Global Privacy Control disable our browser Google tracking.
• Microsoft Clarity (when enabled): with your analytics consent, heatmaps and session recordings help us understand visits to public pages while you are signed out. Page content is masked, and we do not send custom account identifiers to Clarity. Sign-in, account, payment, and other private pages, as well as pages with query parameters or URL fragments, are excluded. Microsoft may process technical visit information and pseudonymous cookie identifiers under its Privacy Statement. Recording stops if you withdraw analytics consent, sign in, or enter an excluded page, and stays off until a full page load.
• Support chat: Crisp or Tawk.to can provide a chat widget, when enabled. They receive the messages you send and technical data about your visit.

Account, purchase, credit, and referral records are kept in GenSpicy's own database.

With your analytics consent, we send Google Analytics events for registration, generation, insufficient credits, top-up clicks, checkout, and confirmed purchases; these custom event payloads exclude email addresses, prompts, reference and generated media, and raw provider errors.

6. Cookies and Local Storage

We use these first-party cookies:

• Sign-in session (named with the genspicy prefix, such as genspicy.session_token): keeps you signed in. Required.
• Regional availability (genspicy_timezone): remembers the timezone reported by your browser for up to one day so the server can enforce regional access restrictions. IP country is supplied by Cloudflare; this check does not require us to store your full IP address.
• Language (PARAGLIDE_LOCALE): remembers the language you chose.
• Cookie choice (cookie_consent): remembers whether you accepted or rejected optional cookies.
• Analytics continuity (ga_funnel_context): with your analytics consent, keeps GA client and session IDs for up to 30 minutes to connect registration and checkout events.
• Referral (genspicy-affiliate-referral): when you open a referral link, stores the referral code for 30 days so that a new account can be credited to the person who shared it. The first valid link counts. It is HttpOnly, so page scripts cannot read it. If you reject optional cookies, it is not set, and an existing one is removed.
• Attribution (utm_source, utm_medium, utm_campaign, utm_term, utm_content, first_referrer): for 30 days, remember the campaign tags and the external site you first arrived from, so we can record them on your account if you sign up.

Google Analytics and support chat providers may set their own cookies when permitted. Our basic Plausible pageviews do not set cookies.

Withdrawing analytics consent removes existing Google Analytics cookies and stops new custom Google Analytics conversion events and Clarity recordings and updates your account's consent record to suppress delayed purchase reports, subject to connectivity; events already sent cannot be recalled. Limited Google cookieless measurement and basic Plausible pageviews remain separate from that choice and honor the browser controls described above.

Your browser's local storage also keeps: your 18+ confirmation from the age gate (for 30 days on that device), unsent prompt drafts and studio preferences, and your light or dark theme. You can clear these in your browser at any time. Clearing them does not delete the 18+ and terms record on your account.

7. Referral Program

If you share a referral link, your referral page shows each account you referred by a masked email address (for example a***@example.com), whether it has made a qualifying purchase, and the commission recorded for it. This tells you that the person signed up and, where applicable, made a purchase. If you were referred, the person who referred you sees this information about your account. We do not show them your full email address, your prompts, or your media.

8. Retention and Deletion

Retention depends on account settings, operational needs, safety requirements, and law. You can delete your generated and uploaded media from your media library at any time. You can close your account in Settings → Profile → Danger Zone after signing in again. This clears your profile, revokes all sessions, connected sign-ins and API keys, and makes your prompts and media inaccessible immediately. Stored media is removed by background cleanup. Remaining credits become unusable; account deletion does not issue a refund. Active generations, pending payments or refunds, and uncanceled subscriptions must be resolved first. We retain the account email and billing, support, safety and reward history for accounting, fraud prevention and legal obligations; the email remains reserved to prevent account reuse and duplicate rewards. For email reuse or deletion of other eligible personal information, email support@genspicy.com from the address on your account. Some transaction, fraud-prevention, or legal records may need to be kept longer.

9. Security

We use reasonable technical and organizational safeguards. No online service can promise absolute security, so avoid uploading identifying material you do not want processed by the service.

10. Adults Only

The service is not intended for anyone under 18. If we learn that a minor has provided personal information, we will take steps to remove it and restrict access.

11. Your Choices and Rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or export personal information, and to withdraw consent to optional cookies. Contact us to make a request. We may need to verify your identity.

12. International Processing

Our providers may process information in several countries, including the United States. Where required, appropriate transfer safeguards are used.

13. Contact

Privacy requests may be sent to support@genspicy.com.