Legal · Intexa Group UAB
Privacy Policy
Last updated:
This policy explains what personal data Intexa Group UAB collects when you use intexa-ai.com, why, who receives it, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR) and Lithuanian law. We collect only what we need to run the Service. We do not sell personal data, show advertising or use your content to train AI models.
1. Who is responsible for your data
The controller of your personal data is:
- Company
- Intexa Group UAB
- Legal form
- UAB (Uždaroji akcinė bendrovė) — private limited liability company
- Company code
- 307638275
- Registered
- Register of Legal Entities of the Republic of Lithuania (Registrų centras), 2026-04-10
- Registered office
- Vištyčio g. 43A, Kybartai, LT-70428, Vilkaviškio r. sav., Lithuania
- VAT code
- Not VAT-registered
- [email protected]
For any privacy question or request, email [email protected] with “Privacy” in the subject line. We have not appointed a data protection officer because the law does not require one for our activities. Our privacy contact handles all data protection matters.
2. What data we process
| Category | What it includes | Source |
|---|---|---|
| Account data | Email address, password (stored only as a one-way argon2 hash, never in readable form), account role, creation and update dates. When you start a credit purchase, we save your billing name and address to your account to prefill future purchases. You can edit these before checkout. We do not store card details. | You, at registration |
| Session data | Session identifiers (stored as a SHA-256 hash), session start and expiry times, and your browser’s user-agent string. | Your browser, when you sign in |
| Credit and purchase data | Credit balance, credit purchases (amount paid, credits received, date, internal note), receipts and invoices, and the value of credits used. For online payments: the payment provider’s transaction reference and status. We do not receive your full card number. | You, our team, the payment provider |
| Generation content | Your descriptions and settings, text you add to images (such as a headline or badge), reference images you upload (resized and stored as JPEG), the English prompt prepared from your description, and the generated images and videos. | You; the AI models |
| Generation records | Date, tool and settings, status, credits reserved and used, the AI model used, provider request IDs, provider cost and token usage, and technical error messages. | Generated by the Service |
| Consent confirmations | Your confirmation that you accept our Terms and are 18 or older, and, for tools that process photos of people, your confirmation that you have the right to use those photos. | You |
| Support and legal correspondence | Emails you send us, complaints, withdrawal requests, content reports and our replies. | You |
| Technical data | IP address, request time, requested page and browser information in server logs, and your IP address temporarily in memory for rate limiting. | Your browser |
Photos of people. If you upload photos of a person, those photos are personal data of that person. We use them only to create the images you request. We do not use them to identify anyone and do not create face templates or other biometric identifiers. Upload photos of other people only if you have their consent (see our Acceptable Use Policy).
Browser storage. If you save a draft in the workspace, your draft text and settings are stored only in your own browser, not on our servers. See the Cookie Policy.
3. Why we use your data and our legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and running your account, signing you in, keeping sessions secure | Account, session, technical | Performance of a contract (Art. 6(1)(b)) |
| Generating images and videos you request, showing your history and letting you download results | Generation content and records | Performance of a contract (Art. 6(1)(b)) |
| Selling credits, taking payment, reserving, charging and returning credits | Credit and purchase data, generation records | Performance of a contract (Art. 6(1)(b)) |
| Keeping accounting records, issuing invoices, meeting tax obligations | Credit and purchase data, account email | Legal obligation (Art. 6(1)(c)): Lithuanian accounting and tax law |
| Handling withdrawal requests, complaints, refunds and consumer disputes | Account, purchase, correspondence | Legal obligation (Art. 6(1)(c)) and performance of a contract (Art. 6(1)(b)) |
| Handling notices of illegal content, moderation decisions and requests from authorities (Digital Services Act) | Generation content, account, correspondence | Legal obligation (Art. 6(1)(c)) |
| Protecting the Service against fraud, abuse, attacks and misuse, including rate limiting and enforcing our policies | Technical, session, generation records | Legitimate interests (Art. 6(1)(f)): keeping the Service and users safe |
| Monitoring costs, quality and profitability of AI models and fixing technical errors | Generation records (including prompts) | Legitimate interests (Art. 6(1)(f)): running a sustainable, reliable service |
| Establishing, exercising or defending legal claims | Any relevant data | Legitimate interests (Art. 6(1)(f)) |
| Sending service messages (purchase confirmations, changes to terms, security notices) | Account email | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
We do not send marketing emails. If we ever do, we will ask for your consent where the law requires it and you will be able to unsubscribe at any time. Where we rely on legitimate interests, you can object (see section 7).
Providing your email address and password is necessary to create an account. Without them, we cannot provide the Service. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. AI providers may automatically refuse individual generation requests under their safety rules. If that happens, your credits are returned and you can contact us.
4. Who receives your data
We share personal data only with the service providers we need to run the Service. They act as our processors under written data processing terms, unless stated otherwise.
| Recipient | Role and data | Location |
|---|---|---|
| Server hosting provider | Hosts our servers, database and stored files: all data described above. | Estonia (EU) |
| OpenRouter, Inc. | AI routing service. Receives your prompts, descriptions, settings and reference images for each generation and returns the results. | United States |
| AI model providers reached through OpenRouter (currently Google for image and video models, Alibaba for video models and a DeepSeek text model for preparing prompts, which may be hosted by DeepSeek or another inference provider) | Process the prompt and reference images of each generation to produce the result. They do not receive your email address or account details. | United States and other countries where the relevant provider operates, which may include the People’s Republic of China or Singapore |
| Email service provider | Hosts our support mailbox and sends service emails. | Stated on request |
| Payment service provider (when online checkout is available) | Processes your card payment as an independent controller under its own privacy policy, which is linked at checkout. | Stated at checkout |
| Amazon Web Services (CloudFront) | Delivers a video shown on our “page not found” screen. Your browser connects directly to it and it receives your IP address and browser information. | Global content delivery network |
We may also disclose data:
- to our accountants, auditors and legal advisers, who are bound by confidentiality;
- to courts, law enforcement, tax authorities and other public authorities where the law requires it, including under the Digital Services Act where content involves a threat to someone’s life or safety; and
- to a buyer or successor if our business is reorganised or sold, under the same protections.
Our staff. A small number of authorised administrators can access account, credit and generation records, including prompts and generated files, only as needed for support, billing, abuse prevention, legal compliance and fixing errors. Administrative actions on credits and prices are logged.
5. International transfers
Some recipients are outside the European Economic Area (EEA). When we transfer personal data outside the EEA, we make sure it is protected by one of the safeguards in Chapter V GDPR: an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified US recipients), or the European Commission’s Standard Contractual Clauses together with supplementary measures where needed. You can ask us for information about the safeguards used and a copy of them by emailing [email protected].
We send AI providers only what a generation needs: your prompt, settings and reference images. We do not send your name, email address or payment data to them. Please do not include personal details in your prompts that the generation does not need.
6. How long we keep data
| Data | Retention period |
|---|---|
| Account data | While your account is open. Deleted within 30 days after account closure, except as listed below. |
| Generation content (descriptions, reference images, prompts, results) | While your account is open, so you can see and download your history, unless you ask us to delete it earlier. Deleted within 30 days after account closure. |
| Session records | Sessions expire after 30 days of inactivity. Session records are deleted with your account. |
| Purchase, refund and invoicing records | 10 years from the end of the financial year, as required by Lithuanian accounting law, after which they are deleted. |
| Generation records needed for accounting (date, credits, amounts, costs), without the content | Same as purchase records. |
| Complaints, withdrawal requests, content reports and moderation decisions | 3 years after the matter is closed, or longer if needed for a pending dispute or legal claim. |
| Support emails | Up to 3 years after the last message. |
| Server logs | Up to 90 days, unless needed to investigate a specific security incident. |
| Rate-limiting data | Held in memory for about one minute. |
AI providers may keep request data for a limited time for security and abuse monitoring under their own terms. We choose provider settings that limit data retention and exclude training where available.
7. Your rights
Under the GDPR, you have the right to:
- access your personal data and receive a copy (Art. 15);
- rectify inaccurate data (Art. 16);
- erase your data (“right to be forgotten”) (Art. 17);
- restrict processing (Art. 18);
- data portability: receive the data you provided in a structured, machine-readable format, and have it sent to another controller (Art. 20);
- object to processing based on our legitimate interests (Art. 21); and
- withdraw consent at any time where we rely on consent, without affecting earlier processing.
To exercise a right, email [email protected] from your account email address. We may ask for information to confirm your identity. We will reply within one month. We may extend this by two further months for complex requests and will tell you if we do. Exercising your rights is free, unless a request is manifestly unfounded or excessive. Some data cannot be erased immediately because we must keep it by law (for example, invoices).
If someone uploaded your photo without your consent, you can ask us to delete it and report the content under our Acceptable Use Policy, even if you do not have an account.
8. Complaints to a supervisory authority
You can complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, VDAI), L. Sapiegos g. 17, 10312 Vilnius, [email protected], vdai.lrv.lt, or to the data protection authority in the EU country where you live or work or where the alleged infringement took place. We would appreciate the chance to resolve your concern first.
9. Security
We protect your data with technical and organisational measures appropriate to the risk. These include encrypted connections (HTTPS), password hashing, hashed session tokens, HttpOnly session cookies, access control on every file and record, role-based administrator access, logging of administrative actions and rate limiting. If a data breach is likely to result in a high risk to you, we will inform you without undue delay.
10. Children
The Service is only for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has created an account or that images of a child have been uploaded, contact us and we will delete the data.
11. Changes to this policy
We will update this policy when our processing changes. We will notify you by email or in the Service of significant changes before they take effect. The date at the top shows when it was last updated.