Privacy Policy

1. Scope and data controller

This Policy applies to DesignSmith's public website, account system, workspace, generation and review features, saved projects, customer portal integration, and support communications. 上海安吖吖数字科技有限公司 is the controller of personal data processed for these purposes. Paddle and other service providers may act as separate controllers or processors for their own activities under their policies.

2. Data we collect

Account and contact data

Your email address, internal user identifier, authentication records, account role and status, support messages, and related timestamps. DesignSmith uses email verification codes rather than a stored account password.

Project and AI content

Ideas, prompts, uploaded or extracted text and images, project state, design documents, feedback, generated output, review results, and exports that you choose to submit, save, or process. Some working drafts and upload queues may also be kept in your browser's local storage.

Personalization and usage data

Feature interactions, generation and review events, temporary activity logs, a natural-language preference profile, model usage and cost records, error information, and technical request metadata used to operate and protect the service.

Billing and subscription data

Paddle customer, subscription, transaction, product, and price identifiers; customer email; subscription status; transaction status; currency; and totals needed to provision and support access. Paddle—not DesignSmith—collects and processes full payment-card or payment-account details, tax data, and checkout billing information.

Location and device information

IP-derived or proxy-provided country information used to request localized Paddle prices, along with standard server, security, and browser information such as IP address, user agent, request time, and requested path where logged by our hosting infrastructure.

3. How we use data

• create accounts, authenticate users, maintain sessions, and provide support;
• save and restore projects and operate generation, review, revision, export, and personalization features;
• send relevant content to configured AI model providers and return generated results;
• show localized prices, open Paddle Checkout, mirror verified billing events, grant or revoke paid access, and open the Paddle customer portal;
• secure the service, prevent fraud and abuse, debug errors, enforce our Terms, and maintain service reliability;
• understand feature usage and improve product quality and workflow performance;
• comply with legal, tax, accounting, regulatory, and dispute-resolution obligations.

Depending on your location and the context, we rely on performance of a contract, legitimate interests, consent, and compliance with legal obligations. Where consent is required, you may withdraw it, although this does not affect processing already performed lawfully.

4. AI model providers

When you use an AI-powered feature, we send the instructions and relevant project or profile context needed for that request to a third-party model provider configured for the service. Those providers process data to return output and may process it in other countries. Do not submit sensitive personal data, trade secrets, or third-party confidential material unless you are authorized to do so and accept the provider-related processing.

We do not represent AI output as factual or private by default. You should review output and remove personal or confidential information before sharing or publishing it.

5. How we share data

We share data only as reasonably necessary with:

• Paddle: checkout, payments, tax handling, receipts, subscription management, refunds, fraud prevention, and buyer support;
• AI model providers: generation, analysis, translation, vision extraction, and review requests;
• hosting, email, security, and infrastructure providers: website delivery, storage, authentication email, monitoring, backup, and protection;
• professional advisers and authorities: where needed for legal compliance, claims, audits, safety, or protection of rights;
• a successor organization: in a merger, financing, reorganization, acquisition, or sale, subject to appropriate confidentiality and legal safeguards.

We do not sell personal data for money. We do not share User Content with other DesignSmith customers except when you intentionally export or share it yourself.

6. Cookies and local storage

DesignSmith uses a secure HTTP-only session cookie to keep signed-in users authenticated. Browser local storage may hold language preferences, working drafts, project cache, pre-login intake, and temporary upload or image-processing queues. Paddle Checkout and the Paddle customer portal may set their own cookies or use similar technologies under Paddle's policies.

You can clear local storage and cookies through your browser, but doing so may sign you out or remove unsaved local work.

7. Retention

We keep data only for as long as reasonably necessary for the purposes above:

• email verification codes normally expire after about 10 minutes;
• authentication sessions normally expire after about 30 days unless ended earlier;
• temporary activity logs used for personalization are normally retained for no more than 7 days, while the distilled preference profile remains until it is replaced, deleted, or the account is closed;
• saved projects and account data remain while your account or project is active and for a reasonable backup, security, or support period afterward;
• verified customer, subscription, transaction, and webhook records are retained as operational, accounting, fraud-prevention, and legal records for as long as required or reasonably necessary;
• Paddle retains payment and buyer information under its own legal and retention obligations.

We may retain limited information longer where required by law, needed to establish or defend claims, or necessary to prevent fraud and abuse.

8. International transfers

DesignSmith is operated from China, while Paddle, AI providers, hosting providers, and users may be located in other countries. Data may therefore be processed outside your country or region. Where required, we use contractual, organizational, or other lawful safeguards for cross-border processing. Laws in the destination country may differ from those where you live.

9. Security

We use reasonable technical and organizational safeguards, including encrypted HTTPS transport, restricted server-side credentials, access controls, session protections, signature verification for Paddle webhooks, and database backups. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use care when deciding what confidential information to submit.

10. Your choices and rights

Depending on applicable law, you may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or information about how personal data is processed. You may also have the right to complain to a data-protection authority.

Send a request to shuitunsiyangyuan@anyaya.cn. We may need to verify your identity and account before acting. Some data cannot be deleted immediately where retention is required for billing, security, fraud prevention, legal compliance, or the establishment or defense of claims.

11. Children

DesignSmith is intended for adults and users who can lawfully enter a contract. We do not knowingly collect personal data from children who cannot legally consent to the processing in their jurisdiction. If you believe a child has provided data improperly, contact us so we can investigate and take appropriate action.

12. Changes to this Policy

We may update this Policy when our product, providers, or legal obligations change. We will post the revised version and update the effective date. Where required, we will provide additional notice or request consent.

13. Contact