Privacy Policy - Framelust AI

Last updated: 9 July 2026

1. Introduction

AETHERFRAMES LTD ("Company", "we", "us" or "our") is committed to protecting the privacy, security and lawful processing of personal data. This Privacy Policy explains how we collect, use, store, disclose, transfer, retain and otherwise process personal data when individuals access or use the AI video generation platform available at framelust.com (the "Platform"), create an account, add Tokens, submit prompts or materials, generate outputs, communicate with us, or otherwise interact with our business.

This Privacy Policy applies to visitors, registered users, customers, prospective customers, business contacts, partner applicants and other individuals who interact with the Platform or with us in connection with the Platform.

The Platform provides AI video generation tools and related features that enable users to create AI-generated video drafts and visual content from prompts, images, creative concepts, reference materials and selected settings. The Platform may also allow users to submit Custom Creative Requests or partner applications where such features are made available.

In order to provide and support the Platform, we may process various categories of personal data, including account information, contact details, payment-related information, technical and device information, usage data, customer support communications, prompts, uploaded materials, project-related information, generated outputs and related Platform activity. In this Privacy Policy, prompts, uploaded images, files, references, instructions, creative concepts and other materials submitted by users may be referred to as "User Content".

We process personal data only where there is an appropriate legal basis and for legitimate purposes, including Platform operation, account administration, Token purchases and allocation, AI generation requests, payment processing, customer support, fraud prevention, sanctions screening, security monitoring, legal compliance, complaint handling, service improvement and protection of the Platform, users, payment partners and our business.

The Platform may rely on trusted third-party service providers, including cloud infrastructure providers, payment service providers, AI technology providers, analytics providers, fraud prevention tools, compliance partners, security providers, communication tools and other technology vendors necessary to operate and support the Platform. Where personal data is shared with such providers, we use appropriate contractual, organisational and technical safeguards designed to protect personal data and support compliance with applicable data protection laws.

We are committed to processing personal data responsibly, transparently and in accordance with applicable privacy and data protection laws, including the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and, where applicable, the European Union General Data Protection Regulation ("EU GDPR").

We do not sell personal data. We do not use private User Content, uploaded files, prompts, generated outputs, facial information, voice data or other personal data contained within User Content to train or improve publicly available AI models without the user's explicit consent, unless the data has been anonymised and aggregated in a way that does not identify the user or their content and such use is permitted by applicable law.

By accessing or using the Platform, creating an account, adding Tokens, submitting User Content, generating outputs, contacting support or otherwise interacting with the Platform, you acknowledge that your personal data may be processed in accordance with this Privacy Policy and applicable law.

2. Scope of This Privacy Policy

This Privacy Policy applies to the collection, use, storage, disclosure, transfer, retention and protection of personal data processed by AETHERFRAMES LTD in connection with the operation of framelust.com and the services made available through the Platform.

This Privacy Policy applies when individuals visit the Platform, create or manage an account, add or use Tokens, submit prompts or materials, generate AI video drafts or other outputs, use image-to-video or refinement features, submit Custom Creative Requests, apply as a partner, communicate with customer support, subscribe to marketing communications, participate in surveys or promotional activities, interact with payment systems, or otherwise use the Platform and its features.

This Privacy Policy applies to visitors, registered users, customers, prospective customers, business contacts, partner applicants and other individuals whose personal data is processed in connection with the Platform.

This Privacy Policy governs personal data processed directly by the Company as a data controller. In limited cases, where we process User Content or other materials solely on behalf of a user for the purpose of providing a requested Platform function, we may act as a processor or service provider, depending on the circumstances and applicable law.

This Privacy Policy does not apply to third-party websites, applications, products, services, social media platforms, payment providers, AI providers or other external resources that may be linked to, integrated with or accessible through the Platform. Such third parties operate under their own privacy policies, terms and practices. The Company is not responsible for the privacy practices of independent third parties.

Where third-party providers process personal data on behalf of the Company as service providers, subprocessors or technology partners, such processing is subject to appropriate contractual, confidentiality, security and data protection safeguards.

This Privacy Policy should be read together with our Terms and Conditions, Cookie Policy, Acceptable Use Policy, Refund Policy and any additional privacy notices that may be provided in connection with specific services, features, payment flows, promotions or processing activities.

By accessing or using the Platform, users acknowledge that their personal data will be processed in accordance with this Privacy Policy and applicable data protection laws.

Who We Are

AETHERFRAMES LTD is the operator of the Platform and the data controller responsible for the processing of personal data described in this Privacy Policy, except where we expressly state otherwise or where the circumstances indicate that we process data on behalf of another party.

Contact Information

AETHERFRAMES LTD
Company number: 17311888
Registered address: International House, 61 Mosley Street, Manchester, United Kingdom, M2 3HZ
Website: framelust.com
Email: support@framelust.com
Tel: +44 7379 924533

If you have any questions regarding this Privacy Policy, our privacy practices or your personal data, you may contact us using the details above.

3. Information We Collect

To operate the Platform, provide AI video generation services, manage user accounts, process Token purchases, maintain security, support users and comply with legal obligations, we may collect and process the categories of information described below.

Account Information

When you create an account, add Tokens, use the Platform, contact us, submit a Custom Creative Request, apply as a partner, subscribe to communications or otherwise interact with us, we may collect information such as your name, email address, telephone number, country of residence, billing details, account credentials, communication preferences and any other information you choose to provide.

Where you submit a Custom Creative Request or partner application, we may also collect project-related information, portfolio materials, creative references, business contact details and communications necessary to review and respond to your request.

Payment Information

Payments made through the Platform are processed by independent third-party payment service providers.

We may receive and store limited payment-related information required to manage transactions, allocate Tokens, maintain financial records, handle refunds, prevent fraud and respond to payment-related enquiries. This may include payment status, transaction identifiers, billing details, currency, purchase amount, order information, invoice details, refund status and fraud-prevention data.

We do not store complete payment card numbers, card verification codes or other sensitive payment credentials. Such information is processed directly by authorised payment service providers in accordance with their own privacy, security and compliance standards.

Technical and Device Information

When you access or use the Platform, we may automatically collect certain technical information, including your IP address, browser type and version, device type, operating system, language settings, referral URLs, access times, log data, diagnostic information and similar technical identifiers.

This information helps us maintain Platform security, prevent abuse, detect suspicious activity, analyse system performance, troubleshoot technical issues, manage access restrictions, support fraud prevention and improve the reliability of the Platform.

Usage Data

We may collect information about how you interact with the Platform, including account activity, login history, feature usage, Token purchases and deductions, generation requests, selected settings, image-to-video or refinement activity, Custom Creative Requests, support communications, preferences, notification interactions and related Platform events.

Usage data helps us provide the Services, manage Tokens, understand how Platform features are used, investigate technical issues, improve user experience, detect misuse and comply with legal, payment and security obligations.

User Content and Generated Outputs

Users may submit prompts, images, files, reference materials, creative concepts, instructions, visual direction, project details or other materials to the Platform in order to generate AI video drafts or related visual content. In this Privacy Policy, such materials are referred to as "User Content".

We may process User Content only as reasonably necessary to provide the requested Platform functionality, operate the Services, process AI generation requests, create Outputs, deliver generated results, provide customer support, investigate technical issues, maintain security, prevent misuse and comply with legal obligations.

Generated Outputs may include AI-generated video drafts, images, previews, visual assets, scene variations or other content created through the Platform based on User Content, selected settings and technical availability.

The Company does not claim ownership of User Content. The rights available to users in relation to generated Outputs are governed by the Terms and Conditions and may be subject to applicable law, third-party rights, AI provider restrictions and any conditions displayed or communicated in relation to the relevant feature.

Users remain responsible for ensuring that they have all rights, permissions, licences, consents and lawful grounds required to upload, submit, process, generate, publish, distribute or otherwise use User Content and Outputs through or outside the Platform.

The Platform may process images, videos, likenesses, voices or similar materials where such materials are submitted by users as part of their User Content. Such materials may, in some cases, contain personal data or information that could be considered biometric information under applicable law. The Company does not use such information to identify individuals, perform biometric verification, create biometric profiles, conduct facial recognition or make decisions based on biometric characteristics. Such materials are processed for the purpose of providing the requested Platform functionality, supporting user requests, maintaining security and complying with applicable obligations.

We do not use private User Content, uploaded files, prompts, generated Outputs, facial information, voice data or other personal data contained within User Content to train or improve publicly available AI models without the user's explicit consent, unless the data has been anonymised and aggregated in a way that does not identify the user or their content and such use is permitted by applicable law.

Retention of User Content and Outputs is subject to the Data Retention and Account Deletion provisions of this Privacy Policy.

4. Special Categories of Personal Data

The Platform is not intended for the collection or processing of special categories of personal data unless such processing is necessary for the user's requested use of the Platform and is supported by an appropriate legal basis.

Special categories of personal data may include information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for the purpose of uniquely identifying an individual, health information, or information concerning an individual's sex life or sexual orientation.

Users should avoid uploading, submitting or otherwise providing special categories of personal data unless such information is strictly necessary for their intended use of the Platform and they have obtained all required permissions, consents, notices, authorisations or other lawful grounds under applicable law.

Where special categories of personal data are included within User Content, the Company will process such information only to the extent reasonably necessary to provide the requested Services, process generation requests, create Outputs, maintain Platform functionality, provide support, comply with legal obligations or protect the security and integrity of the Platform.

The Company does not intentionally collect special categories of personal data for profiling, behavioural advertising, automated decision-making, biometric identification or AI model training purposes.

Where processing of special categories of personal data is required or cannot reasonably be avoided due to the nature of User Content submitted by the user, the Company will apply appropriate safeguards designed to protect such information in accordance with applicable data protection laws.

Where we knowingly process special categories of personal data, we will rely on an applicable condition under Article 9 of the UK GDPR or EU GDPR, such as explicit consent or another condition permitted by applicable law. Where required, we will also consider whether an appropriate policy document or additional safeguard is necessary under applicable data protection laws.

Users remain responsible for ensuring that any special categories of personal data submitted through the Platform are collected, used, disclosed and processed lawfully, and that any required notices, permissions, consents or other legal bases have been obtained before submission.

5. How We Use Information

We use personal data to provide, operate, maintain and improve the Platform and the services available through it. This includes creating and managing user accounts, processing AI video generation requests, enabling image-to-video and refinement features, allocating and managing Tokens, supporting Custom Creative Requests, reviewing partner applications, providing access to Platform functionality and responding to user enquiries.

Personal data may also be used to process payments, verify transactions, issue receipts or invoices, prevent fraud, detect unauthorised activity, perform sanctions or compliance checks, maintain Platform security, investigate technical issues, resolve disputes, handle complaints and communicate important service-related information.

Where users submit Custom Creative Requests or partner applications, we may use relevant information to review the request, assess technical feasibility, understand the requested creative scope, communicate with the user, request additional information where necessary and provide an appropriate response.

We may use aggregated, anonymised or de-identified information to analyse Platform performance, understand feature usage, improve user experience, develop new functionality, enhance security measures, troubleshoot technical issues and improve the reliability of our services. Such information is not intended to identify individual users.

Where permitted by applicable law, we may send users information regarding Platform updates, new features, service notices, surveys, educational materials or promotional communications. Users may opt out of marketing communications at any time by following the unsubscribe instructions provided in such communications, adjusting account preferences where available or contacting us directly.

For the purposes of applicable data protection laws, AETHERFRAMES LTD acts as the Data Controller in relation to account information, billing information, customer communications, Platform usage data, security records, fraud prevention records, compliance-related processing and other personal data processed for the operation and management of the Platform.

Where we process User Content solely to provide a requested Platform function, such as generating an Output from a user prompt or uploaded material, our role may depend on the circumstances and applicable law. In all cases, we process such information in accordance with this Privacy Policy, our Terms and Conditions and applicable data protection requirements.

6. Marketing Communications

Where permitted by applicable law, we may use your contact information to send communications relating to our services, Platform updates, new features, promotional offers, surveys, educational materials, events or other information that may be of interest to you.

Marketing communications may be delivered by email, in-Platform notifications or other communication channels that you have agreed to receive or that are otherwise permitted by applicable law.

Where required by applicable law, we will obtain your consent before sending marketing communications. In other cases, we may rely on our legitimate interests where permitted by law and where such interests are not overridden by your rights and freedoms.

You may opt out of receiving marketing communications at any time by using the unsubscribe link included in the relevant communication, adjusting your account preferences where available or contacting us at support@framelust.com.

You have an absolute right to object to the use of your personal data for direct marketing. If you object or opt out, we will stop using your personal data for direct marketing purposes, subject only to retaining limited suppression records where necessary to respect your choice and demonstrate compliance.

Opting out of marketing communications does not affect our ability to send service-related communications that are necessary for the operation of your account, provision of the Services, Token purchases or deductions, transaction confirmations, security notifications, customer support, legal notices, updates to our policies or agreements, or other important administrative communications.

We may maintain records of marketing preferences, consent choices and opt-out requests where required by applicable law or where necessary to demonstrate compliance.

7. AI Processing and Use of User Content

To provide the services available through the Platform, we process user-submitted content, including prompts, instructions, images, files, reference materials, creative concepts, project details, generated Outputs and other materials submitted in connection with AI video generation, image-to-video creation, refinement requests, Custom Creative Requests or support communications ("User Content").

User Content is processed for purposes directly related to providing the requested Platform functionality, generating Outputs, delivering AI video drafts, maintaining Platform operation, troubleshooting technical issues, ensuring security, preventing misuse, complying with legal obligations and supporting customer requests.

Where User Content contains personal data relating to third parties, the user is responsible for ensuring that an appropriate legal basis exists for the collection, use and submission of such data through the Platform. The user remains responsible for the legality of the submitted content and for obtaining any permissions, consents, notices or authorisations required under applicable law.

The Company does not use private User Content, prompts, uploaded files, generated Outputs or personal data contained within such content to train, retrain, fine-tune or improve publicly available artificial intelligence models without the user's explicit consent, unless the data has been anonymised and aggregated in a way that does not identify the user or their content and such use is permitted by applicable law.

If we introduce optional programmes that allow users to contribute content for AI model improvement, participation will be voluntary and subject to a clear opt-in mechanism. Users will be provided with information regarding the scope of processing, the categories of data involved, the purposes of processing and any available withdrawal options.

Where consent has been provided for AI training or model improvement purposes, we may take reasonable steps to remove direct identifiers, minimise personal data and process information in an aggregated, anonymised or de-identified form where appropriate.

The Platform may use third-party AI models, cloud infrastructure providers, machine learning services, video generation technologies, image generation technologies, speech or audio processing tools, content enhancement tools and other supporting technologies necessary to process requests and generate Outputs.

Where such providers process User Content on our behalf, only the information reasonably necessary to provide the requested functionality, process the generation request, maintain Platform operation, troubleshoot technical issues or ensure security may be transmitted to those providers.

We take reasonable steps to ensure that third-party providers process information in accordance with appropriate contractual, confidentiality, security and data protection safeguards. However, the availability, performance and technical operation of third-party AI systems may be subject to the providers' own infrastructure, terms and policies.

User Content and Outputs may be stored for a limited period where necessary to provide access to generated results, support account functionality, investigate technical issues, handle complaints, comply with legal obligations or protect the Platform from misuse. Retention is governed by the Data Retention and Account Deletion provisions of this Privacy Policy.

8. Legal Basis for Processing

We process personal data only where we have a valid legal basis under applicable data protection laws, including the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation ("EU GDPR").

The legal bases on which we rely may include the following.

Performance of a Contract

We process personal data where necessary to create and manage user accounts, provide access to the Platform, process Token purchases, allocate and manage Tokens, deliver AI video generation features, process User Content, generate Outputs, provide image-to-video and refinement tools, review Custom Creative Requests, respond to support enquiries and fulfil our contractual obligations to users.

Compliance with Legal Obligations

We may process personal data where necessary to comply with legal, regulatory, tax, accounting, sanctions, anti-fraud, record-keeping, consumer protection, payment-related and other compliance requirements applicable to our business.

Legitimate Interests

We may process personal data where necessary for our legitimate interests, including maintaining the security and integrity of the Platform, preventing fraud and abuse, protecting users, payment partners and the Platform, improving functionality, analysing service performance, troubleshooting technical issues, handling complaints, resolving disputes, enforcing our legal rights and ensuring the efficient operation of our business.

We rely on legitimate interests only where we consider that our interests are not overridden by the rights, freedoms or interests of the individuals concerned.

Where required by law, we rely on your consent for specific processing activities, including certain marketing communications, the use of non-essential cookies and similar technologies, and any optional participation in AI model improvement programmes.

You may withdraw your consent at any time where processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Fraud Prevention, Payment Risk and Compliance Screening

To protect the Platform, users, payment partners and our business operations, we may process personal data for fraud prevention, security monitoring, payment risk assessment, identity or account verification, anti-abuse controls, chargeback prevention, sanctions screening and compliance monitoring.

Such processing may include reviewing account information, payment status, transaction identifiers, billing details, IP address, device information, usage patterns, unusual activity, refund behaviour, chargeback history and other indicators of potential misuse or unauthorised activity.

Where necessary, we may receive or share relevant information with payment processors, fraud prevention providers, identity verification services, compliance tools, banks, card issuers, payment service providers and other authorised third parties for these purposes.

This processing may be carried out on the basis of our legitimate interests, compliance obligations, contractual necessity, payment provider requirements and the protection of the Platform, users and our business.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning users or similarly significantly affect them, unless such processing is permitted by applicable law and appropriate safeguards are applied. Fraud prevention, payment risk, sanctions screening and security checks may involve automated tools, but material account or payment-related actions may be subject to review where required by applicable law or where reasonably appropriate.

9. Data Roles and Responsibilities

The Platform enables users to submit User Content, create AI-generated Outputs, manage Tokens, submit Custom Creative Requests and, where available, apply for partner collaboration. Depending on the nature of the processing activity, different parties may have different responsibilities under applicable data protection laws.

AETHERFRAMES LTD acts as a Data Controller in relation to personal data processed for account registration, account administration, Platform operation, Token purchases and allocation, payment processing, customer support, security monitoring, fraud prevention, compliance activities, complaints handling, marketing communications, partner application review and other purposes described in this Privacy Policy.

In these circumstances, we determine the purposes and means of processing personal data.

Where users upload, submit or otherwise provide User Content that contains personal data relating to themselves or third parties, the user remains responsible for ensuring that such content is collected, used, submitted and processed lawfully, and that any necessary notices, permissions, consents or legal grounds have been obtained.

When providing requested Platform functionality, the Company may process User Content solely as necessary to generate Outputs, operate the Platform, provide Services, maintain account functionality, troubleshoot technical issues, provide support, prevent misuse and comply with applicable legal obligations.

We do not use personal data contained within private User Content for independent purposes that are incompatible with the purposes for which the content was submitted, unless the user has provided explicit consent or such processing is otherwise permitted by applicable law.

Where users submit Custom Creative Requests or partner applications, we may process the information provided to review the request, assess feasibility, communicate with the user, request additional details, manage any related support process and maintain appropriate business records.

The Company may use authorised service providers, including hosting providers, cloud infrastructure providers, AI technology providers, payment processors, analytics tools, security tools, fraud prevention providers and support systems, to process personal data on its behalf. Such providers are subject to appropriate contractual, confidentiality, security and data protection safeguards.

Where required by applicable law, additional data processing terms or data processing agreements may apply in relation to specific processing activities carried out on behalf of business customers or other users.

10. International Data Transfers

As part of providing the Platform and related services, personal data may be processed by trusted third-party service providers located in different countries. These providers may include cloud infrastructure providers, hosting providers, payment processors, AI technology providers, analytics tools, customer support tools, security providers, fraud prevention services, compliance tools, communication providers and other technology partners necessary to operate and support the Platform.

In certain circumstances, personal data may be transferred to, stored in or accessed from countries outside the United Kingdom, the European Economic Area ("EEA") or the country in which the user is located.

Where international transfers occur, we take appropriate measures designed to ensure that personal data continues to receive an adequate level of protection in accordance with applicable data protection laws. Depending on the circumstances, these measures may include adequacy regulations, Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Agreement or Addendum, contractual data protection obligations, security measures and other legally recognised transfer mechanisms.

Where User Content, prompts, uploaded files or generation requests are processed by third-party AI providers or supporting infrastructure providers, only the information reasonably necessary to provide the requested Platform functionality, process the generation request, deliver Outputs, troubleshoot technical issues, maintain security or comply with legal obligations will be shared.

We carefully select service providers and technology partners and require them to process personal data only for authorised purposes, maintain appropriate security standards and comply with applicable legal and contractual obligations relating to privacy and data protection.

Some third-party providers, including payment processors and AI technology providers, may process personal data under their own privacy policies where they act as independent controllers. Users should review the applicable third-party privacy terms where such processing applies directly to their use of the relevant service.

Where the EU GDPR applies and the Company is required to appoint a representative in the EEA, the Company will make the representative's contact details available through the Platform or upon request.

11. Data Security

We maintain technical, organisational and administrative safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, misuse or other unlawful forms of processing.

Our security measures may include encryption of data in transit and at rest where appropriate, access controls, authentication procedures, role-based access restrictions, system monitoring and logging, network and infrastructure security measures, internal security policies, supplier due diligence, regular security reviews and risk assessments.

Access to personal data is limited to authorised personnel, contractors and service providers who require such access to perform their duties and who are subject to appropriate confidentiality, security and data protection obligations.

We may also receive information from payment providers, fraud prevention services, identity or account verification providers, compliance tools and other authorised partners to help protect users, prevent unauthorised activity, detect payment misuse, maintain Platform security and comply with legal, regulatory and payment provider requirements.

While we apply reasonable and industry-appropriate safeguards to protect personal data, no method of transmission over the internet, cloud infrastructure or electronic storage system can be guaranteed to be completely secure. We therefore encourage users to protect their account credentials, use secure devices and notify us promptly if they suspect unauthorised access to their account.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will take appropriate action in accordance with applicable law, including notifying relevant supervisory authorities and affected individuals where such notification is required.

12. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Platform, maintain security, improve performance, understand how users interact with our services and provide a more efficient user experience.

Cookies are small text files placed on a user's device when visiting a website. They help websites function properly, remember preferences, maintain secure sessions and collect information about how services are used.

The Platform may use strictly necessary cookies that are essential for the operation of the Platform and enable core functionality such as account authentication, session management, secure access to user accounts, fraud prevention, payment flow support and system administration. These cookies cannot generally be disabled without affecting the operation of the Platform.

The Platform may use performance and analytics cookies to help us understand how visitors and users interact with the Platform. These cookies may collect information about page visits, navigation behaviour, feature usage, generation flow activity, system performance and technical issues. This information is generally used in aggregated or statistical form to improve the quality, functionality and reliability of the Platform.

The Platform may use functionality cookies to remember user preferences and settings, including language preferences, interface choices and other options that improve the user experience.

The Platform may use security and fraud prevention cookies to identify suspicious activity, protect user accounts, support authentication, prevent abuse, detect unauthorised access and maintain the integrity and security of the Platform.

Where used and permitted by applicable law, advertising and marketing cookies may help us measure the effectiveness of marketing campaigns, understand user engagement with promotional content and deliver more relevant communications. These cookies are used only where permitted by law and, where required, with the user's consent.

Users may manage cookie preferences through browser settings, cookie consent tools or preference management mechanisms made available through the Platform. Where processing is based on consent, users may withdraw or modify cookie consent at any time without affecting the lawfulness of processing carried out before such withdrawal.

Please note that disabling certain cookies may affect the availability, functionality, security or performance of some Platform features, including account access, payment flows, session management or generation-related functionality.

Additional information regarding the specific cookies we use may be provided through our Cookie Policy or cookie preference management tools.

Where non-essential cookies or similar technologies are used, we will request consent where required by applicable law before placing such cookies on the user's device. Users may withdraw or change their consent through the cookie preference tool where available.

Consent records relating to cookie preferences may be retained for compliance, security and audit purposes.

We do not sell personal data to third parties.

We may share personal data with trusted third parties where necessary to operate the Platform, provide the Services, process payments, allocate Tokens, support AI video generation requests, maintain security, fulfil contractual obligations, comply with legal requirements or protect the integrity of our business.

Depending on the Platform features used, personal data may be shared with payment service providers and payment processors, cloud hosting and infrastructure providers, AI technology providers, analytics and performance monitoring providers, customer support and communication tools, identity verification providers, fraud prevention services, compliance and security partners, professional advisers, auditors, insurers, legal representatives and other authorised service providers that support the operation of the Platform.

Examples of such providers may include hosting providers, cloud infrastructure providers, payment service providers, fraud prevention vendors, analytics services, customer support systems, communication platforms, security tools and AI technology providers used to process prompts, User Content and generation requests.

Where users submit Custom Creative Requests, partner applications or support enquiries, we may share relevant information with authorised service providers only to the extent reasonably necessary to review, process, support or respond to the relevant request.

We may disclose personal data where required by law, regulation, court order, governmental authority, law enforcement agency, sanctions authority, payment provider requirement or other competent authority. We may also disclose personal data where reasonably necessary to establish, exercise or defend legal claims, investigate suspected fraud, respond to payment disputes, enforce our agreements, protect the Platform, or protect the rights, property, safety and legitimate interests of the Company, users, payment partners or third parties.

We may disclose relevant personal data to regulators, financial institutions, banks, card issuers, payment service providers, fraud prevention providers, sanctions screening tools, law enforcement agencies and competent governmental bodies where required by law or reasonably necessary for fraud prevention, chargeback handling, compliance, security, risk management or payment processing.

If the Company is involved in a business restructuring, merger, acquisition, financing, sale of assets or similar transaction, personal data may be disclosed to relevant parties and advisers where reasonably necessary for that transaction, subject to appropriate confidentiality and data protection safeguards.

All third parties that process personal data on our behalf are required to maintain appropriate confidentiality, security and data protection standards and may process personal data only for authorised purposes.

14. Use of Subprocessors

The Company may engage trusted third-party service providers, subprocessors and technology partners to assist in providing, maintaining, securing and improving the Platform and related services.

Subprocessors may include providers of cloud hosting and infrastructure services, AI and machine learning technologies, payment processing services, customer support and communication tools, analytics and performance monitoring services, security tools, fraud prevention and compliance services, data storage, backup and recovery services, email delivery services and other technical providers required to operate the Platform.

Subprocessors may process personal data only for authorised purposes and, where they process personal data on behalf of the Company, only on documented instructions from the Company. They are subject to appropriate contractual obligations and are required to implement suitable technical and organisational measures designed to protect personal data.

The Company takes reasonable steps to select subprocessors that can provide appropriate privacy, confidentiality and security safeguards. The Company remains responsible for ensuring that subprocessors engaged on its behalf process personal data in accordance with applicable data protection laws and contractual requirements.

Some third-party providers, including certain payment providers, banks, card issuers, AI providers or compliance tools, may act as independent controllers in relation to specific processing activities. Where this applies, their own privacy policies and terms may also govern the processing they carry out.

The Company may maintain and update a list of material subprocessors upon request or through a dedicated webpage, where appropriate.

15. Data Retention

We retain personal data only for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, provide the Services, manage user accounts, allocate and administer Tokens, comply with legal obligations, resolve disputes, handle complaints, prevent fraud, enforce agreements and protect our legitimate business interests.

Retention periods may vary depending on the type of information, the purpose for which it was collected, legal requirements, payment provider requirements, security needs and whether the information is connected to an active account, transaction, dispute, complaint or investigation.

Account Information is generally retained for the duration of the user's relationship with the Platform and for a reasonable period thereafter where necessary to comply with legal, regulatory, accounting, fraud prevention, dispute resolution and record-keeping obligations.

Transaction, billing and payment-related information may be retained for up to six (6) years, or longer where required by applicable law, tax regulations, accounting requirements, payment provider rules, chargeback handling, ongoing disputes, investigations or legal proceedings.

User Content and generated Outputs are generally retained while the user's account remains active and for up to twelve (12) months following the user's last account activity, unless a shorter period is applied through Platform settings or a longer retention period is required for service delivery, security, complaint handling, fraud prevention, legal compliance, enforcement of contractual rights or an ongoing dispute.

Where Platform settings allow users to delete specific User Content or Outputs earlier, we will process such deletion requests in accordance with the available functionality, unless retention is required for security, fraud prevention, complaint handling, payment disputes, legal compliance or other legitimate purposes described in this Privacy Policy.

Custom Creative Request materials, partner application materials and related communications may be retained for as long as necessary to review the request, communicate with the user, maintain business records, resolve related issues and comply with legal or operational requirements.

Technical logs, security records, fraud prevention records and compliance records may be retained for up to twenty-four (24) months where necessary to investigate incidents, prevent fraud, maintain Platform security, comply with legal or payment provider obligations, detect misuse or protect the legitimate interests of the Company and its users.

Marketing preference records, consent records and cookie consent records may be retained for as long as necessary to demonstrate compliance with applicable law and to respect the user's communication choices.

Where a user requests account deletion, eligible personal data, User Content and generated Outputs will generally be deleted, anonymised or rendered inaccessible within ninety (90) days following completion of the deletion process, except where retention is required or permitted by applicable law, fraud prevention needs, payment obligations, tax or accounting requirements, unresolved disputes, legal claims, security investigations or other legitimate compliance requirements.

When personal data is no longer required for the purposes for which it was collected, we will securely delete, anonymise or otherwise dispose of the information in accordance with applicable legal and regulatory requirements.

We may retain information beyond the stated retention periods where necessary to comply with legal holds, ongoing investigations, litigation, regulatory enquiries, enforcement actions, chargeback disputes, fraud reviews or other legitimate legal or compliance purposes.

16. Account Deletion

Users may request deletion of their account at any time by contacting us at support@framelust.com or by using any account deletion functionality that may be made available through the Platform.

Upon receiving a valid account deletion request, we will take reasonable steps to deactivate or delete the account and remove, anonymise or render inaccessible personal data that is no longer required for the purposes for which it was collected.

Certain information may be retained after account deletion where retention is necessary to comply with legal, regulatory, tax, accounting or record-keeping obligations, resolve disputes or enforce agreements, prevent fraud, abuse, chargeback misuse or security incidents, protect the rights, property or safety of the Company, users, payment partners or third parties, comply with requests from courts, regulators, law enforcement authorities, payment service providers or other competent authorities.

Where technically feasible and legally permissible, eligible User Content, generated Outputs, account information and associated personal data will be deleted, anonymised or otherwise rendered inaccessible within a reasonable period following completion of the deletion process.

Account deletion does not automatically cancel completed transactions, refund used Tokens, remove outstanding payment obligations, cancel active disputes, reverse chargebacks, affect ongoing investigations or remove records that must be retained under applicable law, payment provider requirements or legitimate compliance obligations.

Where personal data or User Content has been shared with third-party service providers, payment processors, cloud infrastructure providers, AI technology providers, fraud prevention tools, compliance providers or other authorised service providers for the purpose of providing the Platform or supporting a user request, such parties may retain limited information in accordance with their own legal, contractual, security and regulatory obligations.

Additional information regarding retention periods is provided in the Data Retention section of this Privacy Policy.

17. Your Privacy Rights

Depending on your location and the applicable data protection laws, you may have certain rights regarding the personal data we process about you.

Right of Access

You may request confirmation of whether we process your personal data and, where applicable, request access to that information together with details about how it is used.

Right to Rectification

You may request correction of inaccurate personal data and completion of incomplete information that we hold about you.

Right to Erasure

You may request deletion of your personal data where there is no longer a lawful basis for continued processing, subject to any legal, regulatory, contractual, payment-related, fraud prevention, security or legitimate business obligations that require us to retain certain information.

Right to Restrict Processing

In certain circumstances, you may request that we temporarily restrict the processing of your personal data while a request, objection or dispute is being reviewed.

Right to Object

You may object to certain types of processing carried out on the basis of legitimate interests, including the use of personal data for direct marketing purposes.

For direct marketing, this right is absolute. If you object to direct marketing, we will stop processing your personal data for that purpose.

Right to Data Portability

Where applicable, you may request a copy of certain personal data in a structured, commonly used and machine-readable format and, where technically feasible, request its transfer to another service provider.

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal took effect.

You have the right not to be subject to a decision based solely on automated processing, including profiling, where such decision produces legal effects concerning you or similarly significantly affects you, except where permitted by applicable law.

To exercise any of your privacy rights, please contact us using the contact details provided in this Privacy Policy. We may request additional information to verify your identity, confirm ownership of an account or confirm the authority of a person acting on behalf of another individual before responding to a request.

We will respond to eligible requests within the time periods required by applicable law. In certain circumstances, those periods may be extended where permitted by law, for example where a request is particularly complex, involves multiple requests or requires additional verification.

If you are dissatisfied with how we process your personal data or how we have handled a privacy-related request, you may have the right to lodge a complaint with the relevant data protection authority. For users in the United Kingdom, complaints may be submitted to the Information Commissioner's Office through its official website at www.ico.org.uk.

18. How to Submit Privacy Requests

If you wish to exercise any of your privacy rights, submit a request regarding the processing of your personal data, obtain additional information about our privacy practices or make a privacy-related complaint, you may contact us at:

Email: support@framelust.com

To protect the privacy and security of individuals, we may request additional information to verify your identity before processing a request. Where appropriate, we may also request information necessary to confirm ownership of an account, verify the email address linked to the account or establish the authority of a person acting on behalf of another individual.

We will review and respond to privacy requests within the timeframes required by applicable data protection laws. In most cases, responses will be provided within one (1) calendar month from the date a valid request is received.

Where permitted by applicable law, this period may be extended if a request is particularly complex, involves multiple requests, requires additional verification or otherwise requires additional time for review. Where an extension applies, we will inform the requester of the reason for the delay and the expected response timeframe.

In certain circumstances, we may decline or limit a request where permitted by applicable law, including where a request is manifestly unfounded, excessive, repetitive, would adversely affect the rights and freedoms of others, would compromise Platform security, would interfere with fraud prevention or payment dispute handling, or where the Company is legally required or permitted to retain the relevant information.

Requests relating to account deletion, access to personal data, correction of information, withdrawal of consent, data portability, restriction of processing, objections to processing, marketing preferences or other privacy matters may be submitted using the contact details provided above.

19. Children's Privacy

The Platform and the services offered through it are intended exclusively for individuals who are at least eighteen (18) years of age.

We do not knowingly collect, solicit or process personal data from individuals under the age of eighteen (18). Persons under this age are not permitted to create an Account, add or use Tokens, submit User Content, generate Outputs, submit Custom Creative Requests, apply as a partner or otherwise use the Platform.

If we become aware that personal data relating to an individual under the age of eighteen (18) has been collected through the Platform, we will take reasonable steps to investigate the matter and, where appropriate, delete the relevant information, restrict access to the associated Account or take other action required by applicable law.

If you believe that a minor may have provided personal data through the Platform, please contact us at support@framelust.com.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Platform, Services, Tokens system, business operations, legal requirements, security practices, third-party provider arrangements or technological developments.

When changes are made, the updated version will be published on the Platform together with the revised "Last updated" date.

Where required by applicable law, or where changes materially affect your rights or the way we process personal data, we may provide additional notice through the Platform, by email or through other appropriate communication channels.

We encourage users to review this Privacy Policy periodically to remain informed about how we collect, use, protect and process personal data.

Your continued use of the Platform following the effective date of an updated Privacy Policy constitutes acknowledgement of the revised version, to the extent permitted by applicable law.

21. Contact Us

If you have any questions, requests, concerns or complaints regarding this Privacy Policy, the processing of your personal data or your privacy rights, you may contact us using the details below.

We will make reasonable efforts to respond to privacy-related enquiries within the timeframes required by applicable data protection laws.