Privacy policy

Piccaso ("we", "our", "us") is a visual skill builder for AI agents, built for ecommerce brands. We help teams design reusable visual workflows, connect their own AI model API keys, and produce studio-quality content at cost.

This policy explains what personal data we collect, why we collect it, and how we handle it.

Account data: your name, business email address, and company name when you register.

Billing data: payment method details collected and processed by Stripe. We never store raw card numbers on our servers.

Usage data: feature interactions, page views, session duration, and error logs used to improve the product. This data is anonymised where possible.

Workflow data: the skill configurations, node graphs, prompt templates, and settings you create inside Piccaso.

Asset data: product images, reference photos, and generated outputs you upload or save to your Asset Library.

API keys: the third-party AI model API keys you provide (OpenAI, Google Gemini, Flux, Midjourney, etc.). Keys are stored encrypted at rest and are never logged or exposed in plaintext.

To operate the service: authenticate your account, execute your skill workflows, and store your assets.

To process payments: billing and subscription management via Stripe.

To improve the product: aggregate usage analytics help us prioritise features and fix bugs.

To communicate with you: transactional emails (account events, billing receipts) and product updates where you have opted in.

We do not sell your data to third parties. We do not use your content, assets, or prompts to train AI models.

Piccaso operates on a Bring Your Own Key (BYOK) model. When you run a skill, your images and prompts are sent directly to the AI model APIs you have configured using your own API credentials.

We act as a pass-through orchestration layer. Your content is subject to the privacy and data retention policies of the AI providers you choose (e.g. OpenAI, Google). We strongly recommend reviewing those policies before connecting a provider.

Piccaso does not retain copies of images processed through third-party model APIs beyond what is explicitly saved to your Asset Library.

We share data only with the following categories of sub-processors: payment processor (Stripe), analytics (Mixpanel, anonymised), cloud infrastructure (hosting and database providers), and AI model APIs you explicitly connect.

We may disclose data if required by law, court order, or to protect the rights and safety of Piccaso users.

Account data is retained for the duration of your subscription and for 90 days after account deletion to allow recovery.

Assets saved to your library are retained until you delete them or close your account.

Billing records are retained for seven years as required by financial regulations.

You can request deletion of your account and associated data at any time by contacting us.

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data. You may also object to or restrict certain processing.

To exercise any of these rights, email us at piccadotso@gmail.com. We will respond within 30 days.

We use industry-standard encryption in transit (TLS) and at rest. API keys are encrypted with separate key material. Access to production systems is restricted to authorised personnel.

No system is perfectly secure. If you discover a vulnerability, please disclose it responsibly to piccadotso@gmail.com.

We may update this policy as the product evolves. Material changes will be communicated via email or a notice inside the product at least 14 days before they take effect.