Privacy Policy

Welcome to Aestic. This Privacy Policy explains how Lumonova collects, uses, stores, discloses and protects your personal information when you access our website, mobile applications, or any related services (collectively, the "Services").

By creating an account or using Aestic, you acknowledge that you have read and understood this Privacy Policy.

1. Who We Are

Aestic is an AI-powered creative platform that enables users to generate, edit and enhance images using artificial intelligence. The Services are operated by:

Lumonova
Amsterdam, The Netherlands
Email: privacy@aesticstudio.com

If you have questions about this Privacy Policy or your personal data, contact us at privacy@aesticstudio.com.

2. Scope

This Privacy Policy applies to:

• the Aestic website at aesticstudio.com
• the Aestic iOS application
• the Aestic Android application
• AI image generation and editing features
• customer support
• purchases made through Apple App Store or Google Play
• all services offered by Aestic

It does not apply to third-party websites or services linked from Aestic.

3. Definitions

Account means your registered Aestic profile.

Content means any images, prompts, text, files or other materials uploaded, created or generated using Aestic.

Personal Data means any information that identifies or can reasonably identify an individual.

Processing means any operation performed on Personal Data including collection, storage, analysis, transmission, deletion or use.

Reference Image means a photograph you upload for the purpose of using Aestic's face swap, bag swap, sunglasses swap, or similar personalisation features.

Generated Image means the AI-created visual output produced by Aestic in response to your prompt or style selection.

Services means all products, software, applications and websites operated by Aestic.

User means any individual using the Services.

4. Information We Collect

4.1 Account Information

When creating an account we may collect:

• name
• email address
• authentication identifiers
• account preferences
• subscription and credit status
• country or region

Authentication is provided using Clerk, a secure third-party identity provider.

4.2 Sensitive Personal Information — Do Not Upload

YOU SHOULD NOT UPLOAD OR SUBMIT ANY OF THE FOLLOWING TO AESTIC:

• government-issued identification documents such as passports, driving licences, or national identity cards
• financial information including bank statements, credit card details, or tax documents
• health, medical, or genetic information
• biometric identifiers or templates such as fingerprints, iris scans, or voiceprints
• social security numbers, tax identification numbers, or equivalent government identifiers
• information about racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation, or criminal background
• confidential business information, trade secrets, or proprietary material you do not have the right to share
• photographs of individuals whose explicit consent you have not obtained

If you upload sensitive personal information contrary to this guidance, you do so entirely at your own risk. Aestic accepts no responsibility for any consequences of uploading such information.

4.3 Images You Upload

When using Aestic you may upload photographs, portraits, product photos, illustrations, screenshots, and design references. These images are processed only for the purpose of providing the AI features you request. Please see Section 7 for our specific handling of Reference Images.

4.4 AI Prompts

We collect prompts you submit to generate or edit images, including image descriptions, editing instructions, style requests, and composition instructions. Prompt data is used to generate the requested output and to improve the quality and reliability of our Services.

4.5 Generated Images

Images created through Aestic are stored in your account gallery so you can access, download, share, and manage your previous creations. You can delete individual generated images at any time through the app.

4.6 Device Information

We may automatically collect:

• browser type
• operating system
• device model
• application version
• IP address
• language settings
• crash reports
• performance diagnostics
• approximate geographic region

4.7 Usage Information

We may collect information about how you interact with Aestic, including features used, credits consumed, generation history, session duration, and navigation patterns. This information helps us improve reliability and user experience.

5. Purchases

Payments are processed securely by Apple App Store or Google Play depending on your device. Aestic does not receive or store your payment card details. Purchases may also be managed through RevenueCat for subscription and entitlement management. These providers maintain their own privacy policies governing payment information.

6. How We Use Your Information

We process your information to:

• provide the Services and generate AI images
• authenticate users and manage accounts
• process purchases and manage credits
• improve application performance and reliability
• detect fraud and prevent abuse
• comply with legal obligations
• provide customer support
• communicate important updates

We do not sell your personal information.

7. Reference Images and Generated Images

This is one of the most important sections of this Privacy Policy. We handle two types of image data completely differently.

7.1 Reference Images

Reference photos you upload for image generation are permanently deleted from our systems the moment your generated image is complete, or immediately upon a generation failure.

This means:

• Reference photos are used solely to complete the specific generation request you submit
• Aestic does not retain your uploaded reference photos under any circumstances after generation
• They are never stored as biometric identifiers or templates
• They are never used to train AI models
• They are never shared with third parties beyond what is strictly necessary to complete your generation request via Higgsfield
• The deletion is immediate and irreversible

7.2 Generated Images

The images Aestic generates are creative outputs stored in your account gallery for as long as your account is active. Generated images are distinct from your original reference photos — they are AI-created visual content, not biometric data or copies of your original upload.

• You can delete individual generated images at any time through the app
• All generated images are permanently deleted after your account's 30-day recovery window closes on account deletion
• Aestic claims no ownership rights in your generated images

7.3 What This Means in Practice

When you upload a photo of your face, Aestic uses it to create your generated image and then immediately and permanently deletes the original upload the moment generation is complete. The resulting generated image — which is an AI creation, not a copy of your original photo — remains in your gallery for you to use, share, or delete at any time.

7.4 Biometric Information

Because face data raises specific legal and privacy considerations:

• Aestic does not create, store, or maintain a permanent faceprint, biometric identifier, or biometric template of any individual
• Aestic does not use face data to identify, verify, or authenticate individuals
• You must have the legal right to use any face shown in the photographs you upload
• You must have obtained the consent of any identifiable individual whose face you upload, where required by applicable law
• You must not use Aestic to impersonate another person, create fraudulent identification, or produce non-consensual imagery

Before you use any face-related feature for the first time, Aestic will display a consent screen explaining how face data is processed. You must acknowledge this consent before the feature is activated on your account. This consent is recorded once and does not need to be repeated on subsequent uses.

7.5 AI Image Processing via Third-Party Providers

Aestic uses Higgsfield and NanoBanana, secure third-party AI infrastructure providers, to generate and edit images. Depending on the AI model you select, your generation request is processed by either Higgsfield or NanoBanana. When you request image generation:

• uploaded images are securely transmitted to the selected provider for processing
• prompts are processed to produce the requested output
• generated images are returned to your account
• processing is limited to the functionality you request

Aestic does not use your uploaded content to train AI models. We have no proprietary AI models. Please note that Higgsfield and NanoBanana may temporarily retain uploaded images during the processing period according to their own privacy policies. We require both providers to delete these images promptly after processing. You can review their privacy policies at higgsfield.ai/privacy-policy and nanobanana.ai.

8. Commercial Ownership

You own the images you generate through Aestic. Aestic claims no intellectual property rights in your generated outputs. Subject to our Copyright and Commercial Licence, you may use generated images for personal or commercial purposes.

You retain ownership of the original content you upload to Aestic. You remain responsible for ensuring that your use of generated content complies with applicable laws, intellectual property rights, and third-party rights.

9. Legal Basis for Processing (GDPR)

If you are located within the European Economic Area, United Kingdom or Switzerland, we process your Personal Data only where we have a lawful basis under applicable data protection laws.

9.1 Contract Performance

We process your information because it is necessary to provide the Services you request, including creating and maintaining your account, generating AI images, processing purchases, and providing customer support.

9.2 Legitimate Interests

We may process Personal Data where necessary for our legitimate business interests, provided those interests do not override your fundamental rights and freedoms. These interests include improving platform performance, detecting fraud and abuse, monitoring service reliability, and protecting the security of our Services.

9.3 Legal Obligations

We may process information where required by applicable law, regulation or governmental authority, including for tax compliance, accounting obligations, and responding to lawful requests.

9.4 Consent

Certain processing activities require your consent. Where consent is required, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. This includes marketing communications, optional analytics, optional cookies, and face feature processing (first use only).

10. Third-Party Service Providers

To operate Aestic, we work with carefully selected third-party providers. These providers receive only the information necessary to perform their services and are contractually required to protect your information. A complete list is available at aesticstudio.com/subprocessors.

10.1 Higgsfield

AI image generation and processing infrastructure. When you submit a generation request using the Higgsfield model, your uploaded images and prompts are transmitted securely to Higgsfield solely for the purpose of producing your requested output. Higgsfield is based in the United States and operates under its own privacy policy at higgsfield.ai/privacy-policy. Data transmitted to Higgsfield is protected by Standard Contractual Clauses under GDPR.

10.2 NanoBanana

AI image generation and processing infrastructure. When you submit a generation request using the NanoBanana model, your uploaded images and prompts are transmitted securely to NanoBanana solely for the purpose of producing your requested output. NanoBanana operates under its own privacy policy at nanobanana.ai. Data transmitted to NanoBanana is protected by Standard Contractual Clauses under GDPR.

10.3 Clerk

Authentication and account management. Used for sign-in, account verification, session management, and secure authentication.

10.4 RevenueCat

Subscription and purchase management. Used for processing in-app purchases, managing entitlements, and syncing purchase state across devices.

10.5 Apple and Google

If you purchase through Apple's App Store or Google Play, Apple or Google processes your payment information according to their respective privacy policies.

10.6 Cloudflare

Content delivery, security, DDoS protection, and performance optimisation.

10.7 Railway

Infrastructure hosting for portions of the Aestic backend.

10.8 Google Cloud

Secure cloud infrastructure including storage, networking, and computing resources.

10.9 Brevo

Transactional and marketing email communications. Brevo is based in the European Union.

11. Cookies

Our website and Services may use cookies and similar technologies to remember preferences, keep users signed in, improve performance, understand website usage, and maintain security.

Types of cookies include:

• Essential cookies — required for the website to function
• Functional cookies — to remember settings and improve user experience
• Analytics cookies — to understand page visits, navigation, and feature usage

Where required by law, analytics cookies will only be used after obtaining your consent. A detailed cookie inventory is available in our Cookie Policy at aesticstudio.com/cookies.

12. Analytics

We may use analytics tools to understand how users interact with Aestic. Analytics data helps us improve our Services and is not used to identify you personally unless required for fraud prevention or security.

13. Data Retention

We retain Personal Data only for as long as necessary to fulfil the purposes described in this Privacy Policy.

13.1 Reference Images

Permanently deleted immediately upon generation completing or failing. No exceptions. See Section 7.

13.2 Generated Images

Stored in your account gallery until you delete them individually or delete your account. Permanently deleted after the 30-day account recovery window closes on account deletion.

13.3 Account Information

Retained while your account is active. Processed for deletion within 24 hours of a deletion request. Your account then enters a 30-day recovery window. After 30 days, all account information is permanently deleted from our active systems.

13.4 Payment and Billing Records

Retained for the period required by applicable Dutch and EU tax and accounting law, typically 7 years.

13.5 Support Communications

Retained for 2 years after the last interaction, or longer if required to resolve ongoing issues.

13.6 Anonymised Data

Even after we delete your personal data, we may continue to retain and use anonymised data that can no longer be linked to you personally. This may include aggregate usage statistics, model performance data, and anonymised analytics.

13.7 Legal Hold

We may retain specific information for longer periods where required by law, court order, or ongoing legal proceedings.

14. Security

We implement technical and organisational measures to protect your Personal Data against unauthorised access, accidental loss, misuse, alteration, disclosure, and destruction. Security measures include:

• all data in transit encrypted using TLS 1.2 or higher
• account credentials hashed using industry-standard cryptographic algorithms
• sensitive data at rest encrypted where appropriate
• access to production systems restricted to authorised personnel with multi-factor authentication
• employee access granted on a least-privilege basis
• infrastructure protected by firewalls and intrusion detection systems
• regular security patches and updates

No method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

15. International Data Transfers

Aestic is operated by Lumonova, based in Amsterdam, the Netherlands. Some of our third-party service providers are located outside the European Economic Area, including in the United States.

Whenever we transfer personal data outside the EEA, we ensure appropriate safeguards are in place in accordance with GDPR Chapter V, including Standard Contractual Clauses as adopted by the European Commission for transfers to Higgsfield and other US-based providers.

For more information about the safeguards we have in place, please contact privacy@aesticstudio.com.

16. Your Rights Under GDPR

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights. To exercise any of them, contact privacy@aesticstudio.com. We will respond within 30 days.

16.1 Right of Access

Request confirmation of whether we process personal data about you and receive a copy of that data.

16.2 Right to Rectification

Request correction of inaccurate or incomplete personal data we hold about you.

16.3 Right to Erasure

Request deletion of your personal data in certain circumstances, including where it is no longer necessary for the purposes it was collected.

16.4 Right to Restrict Processing

Request that we limit how we use your personal data in certain circumstances.

16.5 Right to Data Portability

Receive your personal data in a structured, commonly used, machine-readable format, and transmit it to another controller.

16.6 Right to Object

Object to our processing of your personal data based on legitimate interests, and object to direct marketing processing at any time.

16.7 Right to Withdraw Consent

Where processing is based on your consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

16.8 Right to Lodge a Complaint

Lodge a complaint with a supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (AP) at autoriteitpersoonsgegevens.nl. You may also contact the supervisory authority in your country of residence.

17. Account Deletion

You may delete your Aestic account at any time through the application settings or by contacting support@aesticstudio.com.

Account deletion requests are processed within 24 hours. Following processing, your account enters a 30-day recovery window during which you may restore it by logging back in. After 30 days, all personal data including generated images is permanently deleted from our active systems, except where retention is required by applicable law.

Please note: deleting the app from your device does not delete your account or your data. You must delete your account through the app settings or by contacting us.

18. Children's Privacy

Aestic is not intended for children under 16 years of age, in accordance with the minimum digital consent age under GDPR. We do not knowingly collect Personal Data from children under 16.

If we become aware that we have collected personal information from a child under 16 without appropriate parental consent, we will take steps to delete that information as quickly as possible. If you are a parent or guardian and believe your child has provided personal information to Aestic without your consent, please contact us at privacy@aesticstudio.com.

19. Data Breach Notification

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will:

• notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of the breach, as required by GDPR Article 33
• notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms
• provide clear information about the nature of the breach, categories of individuals affected, likely consequences, and measures we are taking to address it
• maintain an internal record of all personal data breaches

If you become aware of a potential security incident affecting Aestic, contact us immediately at security@aesticstudio.com.

20. Intellectual Property and Generated Content

You own the images you generate through Aestic. Aestic claims no ownership rights in your generated outputs.

You retain ownership of the original content you upload. You are responsible for ensuring that any content you upload or generate does not infringe the intellectual property rights, privacy rights, or other legal rights of third parties.

You must not upload copyrighted material unless you have the necessary rights or permission to do so.

You acknowledge that AI-generated images may occasionally resemble existing photographs, artworks, or individuals, and that copyright laws relating to AI-generated works vary between jurisdictions and continue to evolve. Aestic does not provide legal advice regarding copyright or ownership of AI-generated content.

21. User Responsibilities

When using Aestic, you agree that you will not:

• upload unlawful content or content you do not have the right to use
• impersonate another individual
• infringe copyright, trademarks, or other intellectual property rights
• create defamatory, fraudulent, or misleading material
• generate illegal or harmful content
• upload photographs of individuals without their consent
• attempt to interfere with the operation or security of the Services
• use automated systems to abuse or overload the platform
• reverse engineer, scrape, or exploit the Services without permission
• generate content intended to make automated decisions with a material impact on individual rights in high-risk domains including employment, healthcare, finance, legal proceedings, or housing, without appropriate human oversight

You remain solely responsible for all prompts, uploaded content, and generated images created through your account.

22. AI-Generated Content

Artificial intelligence may produce unexpected or inaccurate results. Although Aestic continuously works to improve the quality of generated content, we do not guarantee that AI-generated images will always be accurate, free from errors, satisfy your intended purpose, be legally suitable for every use, or be free from similarities to other publicly available works.

Users should independently review AI-generated content before relying upon it for commercial, legal, medical, financial, or other important purposes.

When publishing AI-generated content that depicts real individuals or could be mistaken for authentic photography, you are responsible for clearly disclosing that the content is AI-generated, in accordance with applicable law including Article 50 of the EU AI Act.

23. EU AI Act Compliance

Aestic complies with Regulation (EU) 2024/1689 on Artificial Intelligence (the AI Act). Aestic is an AI image generation system subject to transparency obligations under Article 50 of the AI Act.

We meet these obligations as follows:

• Users know they are interacting with AI. Every screen where users generate images clearly identifies the process as AI-powered
• Where technically feasible, images produced by Aestic contain machine-readable metadata identifying them as AI-generated
• Where our face swap or similar features produce content that could be mistaken for authentic content of a real individual, users are reminded that they must disclose the AI-generated nature of the content when publishing it

You may not use Aestic to:

• create AI-generated content intended to deceive others without appropriate disclosure
• generate deepfakes for manipulation or fraud
• produce content depicting real individuals without their consent
• generate content that could be mistaken for authentic evidence in legal, journalistic, or scientific contexts

24. Digital Services Act Compliance

Aestic is an online intermediary service established in the European Union and complies with Regulation (EU) 2022/2065 (the Digital Services Act).

We provide a clear mechanism for users and authorities to report illegal content at report@aesticstudio.com. We act on valid reports in a diligent, non-arbitrary, and objective manner. We do not use dark patterns to influence user decisions and do not target advertising based on profiling of sensitive personal data or to minors.

Single point of contact for EU authorities: legal@aesticstudio.com (English or Dutch)

Single point of contact for users: support@aesticstudio.com

25. Copyright Complaints

Aestic operates a notice-and-takedown procedure under the EU Digital Services Act and EU Copyright Directive.

If you believe content on Aestic infringes your copyright, submit a notice to copyright@aesticstudio.com including:

• your full name, address, telephone number, and email address
• identification of the copyrighted work you claim has been infringed
• identification of the allegedly infringing material with sufficient detail to locate it
• a statement of good faith belief that the use is not authorised by the copyright owner
• a statement that the information is accurate and that you are the copyright owner or authorised to act on their behalf
• your physical or electronic signature

26. Content Moderation

Aestic uses automated safety filters and human review to prevent and remove prohibited content. We scan for known illegal content including child sexual abuse material using industry-standard hash-matching techniques and report confirmed illegal content to appropriate authorities as required by law.

You can report violations at report@aesticstudio.com. Reports are reviewed within 5 business days.

27. Automated Decision-Making

Aestic uses automated systems to generate images based on user prompts. These automated processes are initiated directly by users and are intended solely to provide the requested creative output. Aestic does not use automated decision-making to make legally significant decisions about individuals.

28. Marketing Communications

If you subscribe to newsletters or marketing communications, we may send product updates, feature announcements, and promotional offers. You may unsubscribe at any time using the unsubscribe link included in our communications or by updating your account preferences.

29. Business Transfers

If Aestic or Lumonova undergoes a merger, acquisition, restructuring, or asset sale, Personal Data may be transferred as part of that transaction, subject to applicable law. Users will be notified where required by law.

30. Data Protection Principles

We process Personal Data in accordance with the following GDPR principles:

• lawfulness, fairness and transparency
• purpose limitation
• data minimisation
• accuracy
• storage limitation
• integrity and confidentiality
• accountability

31. United Kingdom Users

Where UK data protection laws apply, references in this Privacy Policy to the GDPR shall include the UK GDPR and the Data Protection Act 2018 where applicable.

32. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Where changes are material, we will give you at least 30 days' advance notice by email and in-app notification. The Last Updated date at the beginning of this document indicates when it was most recently revised.

Your continued use of the Services following an update constitutes acceptance of the revised Privacy Policy, except where additional consent is required by law.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our processing of your Personal Data, please contact us:

• Privacy: privacy@aesticstudio.com
• Security incidents: security@aesticstudio.com
• Copyright notices: copyright@aesticstudio.com
• DSA / illegal content reports: report@aesticstudio.com
• Legal / DSA authority contact: legal@aesticstudio.com
• General support: support@aesticstudio.com
• Address: Lumonova, Amsterdam, The Netherlands

You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens (AP) at autoriteitpersoonsgegevens.nl if you believe your Personal Data has been processed unlawfully.

This Privacy Policy is governed by and interpreted in accordance with the laws of the Netherlands, without prejudice to any mandatory consumer protection rights that apply in your country of residence.