Privacy Policy
Effective 19 August 2026.
The short version
We store your email address, a hash of your token, and a record of each request: how many tokens it used, what it cost, when it happened and which GIMP version you were on. We do not store your images, your prompts, or the code the model generates. There are no cookies, no analytics and no third-party trackers on this site.
What we hold, and why
| Data | Why |
|---|---|
| Email address | Identifies the account and receives sign-in links |
| Token hash | Authenticates the plug-in. We store only a hash, so we cannot read your token or use it |
| IP address at signup | Rate-limiting signups. Not recorded for ordinary chats |
| Per-request usage | Token counts, cost, status, timestamp, GIMP version. This is how credits are counted and how we know what the service costs to run |
| Purchases | What you bought and when, so balances can be explained and refunds handled |
What goes to the model
To answer a request, we send OpenAI your message and a downscaled preview image of the canvas you have open, so the model can see what you are describing. This is necessary for the product to work.
OpenAI processes it to generate the response. Under their API terms, content sent through the API is not used to train their models. We do not keep a copy of either the image or the message once the request completes.
Each request carries an opaque identifier derived from your account so that abuse can be attributed to one user rather than to the whole service. It is a salted hash and does not contain your email address.
Payments
Polar processes payments as merchant of record. They receive whatever you give them at checkout. We receive a record that a purchase happened, for what, and for how much. We never see card details.
Sign-in links are sent through Cloudflare's email service. We send no marketing email.
How long we keep it
Account and purchase records are kept while the account exists, and afterwards only as long as needed for accounting. Sign-in links expire in 15 minutes. Usage records are kept to understand costs and are not tied to the content of any request.
Your rights
Email hello@gimpbot.com to get a copy of what we hold about you, correct it, or have your account and data deleted. If you are in the UK or EU, you have these rights under the GDPR and can complain to your data protection authority.
Who holds this data
Z Industries, LLC is the data controller for the information described above. Email hello@gimpbot.com with any question about it, including a request to delete it.