Privacy Policy

Last updated: 19 September 2026

Draft. This text describes how the product works today, but it has not been reviewed by a lawyer, and the values shown [in brackets] still have to be filled in. Do not rely on it as final until this notice is removed.

1. Who is responsible for your data

[Legal entity name], [registered address], is the controller of the personal data described here. For any privacy question or request, write to [privacy contact email].

2. What we collect, and why

Account. Your name, email address and a hashed version of your password (we never store the password itself). If you sign in with Google, we receive your name, email address and profile picture from Google. Used to create your account and sign you in.
Sessions. For each sign-in we keep a session record with its expiry date, your IP address and your browser’s user-agent. Used to keep you signed in and to protect the account against misuse.
What you create. Your prompts, the settings you choose and the files you add as inputs are sent to the generation platform to produce your result. Input files you upload are stored with our file storage provider at a public web address so the generation platform can read them — do not upload anything you would not want reachable by someone who has that address.
Technical logs. Our servers and hosting provider keep short-lived logs of requests (time, address requested, IP address, errors) to run and secure the service.

Your generation history and favourites are currently stored in your own browser, on your device, and are not kept on our servers. [Update this paragraph when history moves to the account].

We do not sell your data, and we do not use advertising trackers.

3. Cookies

The service only uses cookies it needs in order to work:

ohf.session_token, ohf.session_data — keep you signed in (up to 30 days).
ohf-locale — remembers the language you chose (1 year).
ohf_device — a random identifier that groups the files you upload from this browser.

Your theme choice (light or dark) is kept in your browser’s local storage.

4. Who receives your data

Higgsfield (generation platform) — receives your prompts, settings and the addresses of your input files, runs the model you chose, and hosts the generated files.
Vercel — hosts the service and stores the files you upload.
[Database host] — stores account and session records.
Google — only if you choose “Continue with Google”.
Stripe — processes payments. When you subscribe or buy credits, your card details go directly to Stripe; we never see or store your full card number. We keep a record of your payments (amount, date, status, Stripe’s reference) and your Stripe customer reference.
[Add the email provider when it is in use].

Some of these providers process data outside your country, including in the United States. [State the transfer safeguards you rely on, e.g. Standard Contractual Clauses].

5. Legal bases

Where the GDPR applies, we process account, session and creation data to perform our contract with you, and security logs on the basis of our legitimate interest in keeping the service safe.

6. How long we keep it

Account data: until you delete your account, then removed within [period].
Session records: until they expire or you sign out.
Uploaded input files: [retention period for uploads].
Generated files: hosted by the generation platform, guaranteed available for at least seven days.
Technical logs: [log retention period].

7. Your rights

Depending on where you live, you can ask to access, correct, delete or export your data, and to object to or restrict some uses of it. Write to the contact address above; we answer within one month. You can also complain to your data-protection authority — [name the lead authority, e.g. the CNIL in France].

8. Children

The service is not intended for anyone under [minimum age]. If you believe a child has created an account, contact us and we will remove it.

9. Changes

We will update this page when the service changes — in particular when paid plans, server-side history or new providers are introduced — and tell you about significant changes before they take effect.