Privacy Policy

DesignStation (“the platform”, “we”) is an advertising-design service operated by MXSSXTTFXAY ALMEMAR (مصطفى المعمار), trading as DesignStation at designstationai.com. The operator is the data controller for the personal data described in this policy.

The operator’s name is given as it is recorded in the machine-readable zone of the operator’s Iraqi national identity card, where the Arabic name is transliterated into Latin letters under ICAO Doc 9303.

For any question about this policy, or to exercise any right described in it, contact [email protected].

Account data: your name, email address, and profile picture where you sign in through Google or Facebook.

Content you upload: photographs of your products or premises that you send us in order to have an advertisement produced, and any text you supply with them.

Text you type: what you write when you request a design, the settings of each request, and your conversations with our assistant.

Usage data: the type of content you generate, the templates you choose, and your credit transactions.

Technical data: browser type, operating system and IP address, for performance and abuse prevention.

Photographs you upload are processed for one purpose: to render the advertisement you asked for. A photograph may contain a face — your own, a model’s, or a passer-by in a shop.

We do not perform biometric identification. We do not extract facial templates or faceprints, we do not match faces against any database, and we do not use faces to recognise or identify a person. Because the processing is not for the purpose of uniquely identifying a natural person, these images are ordinary personal data and not a special category of data.

You are responsible for having the right to upload a photograph containing another person’s image.

Retention is enforced automatically, and these are the actual windows:

• •Subscribers: generated media is kept for 30 days, then deleted.
• •Free and guest accounts: generated media is kept for 5 days, then deleted.
• •Photographs you upload: deleted after 30 days, for every account.
• •Text you type: kept while your account exists. When you ask us to delete the account, it is removed from our servers within 30 days, and its backup copies expire within the same period.
• •Account data: kept while the account exists, and removed on deletion as described in section 9.

Records we are required to keep for accounting or fraud-prevention purposes are retained for as long as that obligation lasts, and for no other purpose.

We use the following providers to run the service. Each processes data only on our instructions:

• •Supabase — database, authentication and file storage (EU)
• •Railway — application hosting (EU — Amsterdam)
• •Vercel — website hosting and delivery (EU / global edge)
• •Cloudflare — DNS, content delivery and abuse protection (global edge)
• •Sentry — error monitoring (EU / US)
• •PostHog — product analytics (EU)
• •OpenAI — the ChatGPT app channel — see section 6 (US)

Generation providers: to render an image or video we send the prompt and the reference photographs to third-party AI image and video generation providers located in the European Union and the United States. We describe them by category rather than by name because the routing between them changes; a named list would become inaccurate without notice, while the category stays true. The full current chain is available on request to business customers and to supervisory authorities, at [email protected].

We do not sell personal data, and we do not share it for advertising purposes.

DesignStation is available as an app inside ChatGPT. If you use it there, two organisations are involved and they are responsible for different things.

OpenAI is an independent controller of your conversation.Everything you type in ChatGPT, and everything ChatGPT shows you, is governed by OpenAI’s own privacy policy and terms, not by this one. We have no access to your conversation and no control over it.

Our responsibility begins at our endpoint. We receive only what the app actually sends us in order to fulfil your request: your DesignStation account identity once you link your account, the search words for a template, the photographs you attach to an order, and the order itself. That data is handled exactly as described in the rest of this policy.

Linking your DesignStation account to ChatGPT is done through a standard OAuth sign-in. You can unlink it at any time from ChatGPT’s own connector settings; unlinking ends the app’s access without deleting your DesignStation account.

Generation credits are purchased and managed on designstationai.com. Nothing is sold inside ChatGPT, and no payment details are ever entered there.

We operate from Iraq and our infrastructure is primarily in the European Union. Some providers listed in section 5, and some generation providers, are in the United States. Where personal data is transferred out of the European Economic Area we rely on the European Commission’s Standard Contractual Clauses, or on the provider’s own approved transfer mechanism.

Subject to the law that applies to you, you may:

• • ask what personal data we hold about you, and receive a copy of it
• • have inaccurate data corrected
• • have your data deleted
• • object to, or ask us to restrict, a particular use
• • withdraw a consent you have given, without affecting what was lawful before
• • complain to your local data-protection authority

If you can sign in, the fastest route is the data deletion page.

If you cannot sign in, you do not need an account to make the request. Email [email protected] from the address you registered with, or tell us enough to identify the account. We may ask for one further detail to confirm the request is genuine, so that an account is never deleted by someone else.

We acknowledge every request within 7 days and complete it within 30 days. If a request is unusually complex and needs longer, we will tell you within those 30 days and explain why.

Access to production data is restricted and audited, traffic is encrypted in transit, and database access is governed by row-level policies so one account cannot reach another’s data. No system is perfectly secure; if a breach affects your rights we will notify you and the relevant authority as the law requires.

The service is intended for business use and is not directed at children under 13. We do not knowingly collect their data; if we learn that we have, we delete it.

We update this policy when the service changes. The date at the top is the version in force. Where a change materially affects your rights, we will make it visible in the product rather than relying on this page alone.

MXSSXTTFXAY ALMEMAR, operating DesignStation — [email protected]