This Privacy Policy (the “Policy”) explains what personal data Dubir Group LTD (the “Company”, “we”, “us”) collects when you use Azurade AI (the “Service”) at https://azurade.com, why we collect it, who else sees it, and what you can do about it. We follow the EU General Data Protection Regulation (GDPR) and the Cyprus law that implements it, Law 125(I)/2018. We have tried to describe what the software really does rather than what a template says it might do.

1. Controller

The data controller is Dubir Group LTD, a company registered in the Republic of Cyprus (registration number HE 394277), registered office Charalampou Mouskou & Grigori Afxentiou, 20. ATHINODOROU BUSINESS CENTER, 3rd floor, Flat/Office 306, 8010, Paphos, Cyprus. Privacy enquiries go to legal@azurade.com. We have not appointed a data protection officer, because the law does not require one for a business of our size and activity.

2. What we collect

Data you give us:

Your email address, and if you sign in with Google or Facebook, the name, email and profile picture that provider shares with us. You may set a display name. We never ask you to choose a password. Sign-in is by Google, by Facebook or by a one-time code sent to your email, and the only password on our side is a random one you never see, stored as a salted hash.
The prompts you write, the images and videos you upload as inputs, and the images and videos you generate. We keep them so they appear in your gallery.
If you signed up through a referral link, the id of the account that referred you, so that account can be credited.
The page you first arrived on, the site that sent you there, and any campaign tags in that first link, with the date. We keep this on your account so we can see which pages bring people who stay. It is never used to identify you elsewhere.
Anything you write to us at support@azurade.com or legal@azurade.com.
After a purchase, the payment status, card brand and last four digits that our merchant of record, Dodo Payments, passes back to us. Your full card number never reaches our systems.

Data collected automatically:

Server logs, with the IP address, browser and device details that arrive with every request. Cloudflare sits in front of our servers and sees your IP address first; our own web-server logs mostly record Cloudflare's addresses rather than yours.
A record of every generation: the model, the settings, the credits charged, timing, and if the generation failed, the error text.
Product analytics from two tools, PostHog on EU servers and Umami, which we host ourselves. Neither sets cookies or stores an identifier on your device (section 9). Once you sign in, PostHog events are tied to your account id, email and name, so we can see for example which model a customer tried and whether it failed. Prompts and images are never sent to analytics.

The free tools under /tools (converters, compressors, the resizer and so on) run entirely in your browser. The files you put into them never leave your device, and we do not see them.

3. Why we use it, and the legal basis

Purpose	Legal basis (GDPR Art. 6)
Create and run your account; provide the Service	Performance of a contract
Turn your prompts and inputs into images and videos, including the optional prompt-improvement step (section 4)	Performance of a contract
Sell subscriptions and credit packs; process payments and refunds	Performance of a contract; legal obligation
Service emails: sign-in codes, a welcome message, an alert when your account is used from a new device	Performance of a contract
Occasional emails about a low balance, a come-back offer, news about the product such as a new model, and new blog posts (the blog digest only if you opted in). You are told about them when you sign up, every one carries an unsubscribe link, and one click stops all of them	Consent given at sign-up; legitimate interests for customers who bought
Keep the Service secure; find and fix bugs; prevent fraud and abuse	Legitimate interests
Measure how the site and the product are used	Legitimate interests (cookieless, section 9)
Tax, accounting and other legal obligations	Legal obligation

We do not train models on your prompts, uploads or generations. Nothing in our pipeline does that today, and if that ever changes we will ask you first. What we do look at is aggregate usage, such as how many customers tried a model last week.

4. Who else sees your data

We do not sell your personal data, and we do not “share” it in the sense used by US state privacy laws such as the California Consumer Privacy Act (CCPA). It goes only to the providers below, each under a contract that binds them to protect it and to use it for our purposes alone:

Dodo Payments (Dodo Payments Inc., Bengaluru, India) is the merchant of record. It sells you the credits and subscriptions, runs the checkout, collects tax, issues receipts, and handles refunds and chargebacks. It receives your name, email and payment details.
AI model providers, the companies whose servers run the generation models. They receive your prompt, your input images or videos, and the generation settings, and they send the result back. Uploaded input files are placed on the provider's storage so the model can read them. Your account details are not sent to them.
A language-model API that rewrites your prompt when you switch on “Enhance prompt with AI” or when a prompt needs translating into English, and that turns raw technical error messages into readable ones. It receives the prompt text or the error text and nothing else.
Google, when you choose to sign in with Google.
Meta Platforms Ireland Ltd., when you choose to sign in with Facebook.
Brevo (Sendinblue SAS, Paris, France) delivers our emails. It receives your email address and the message.
Cloudflare, Inc. (San Francisco, USA) sits in front of our servers as a content delivery network and a shield against attacks. It sees your IP address and the requests you make.
PostHog (PostHog, Inc., with our data held on its EU servers) and Umami (hosted by us) for the analytics described in section 2.
Telegram, which carries internal alerts to our operators about payments and failed generations. An alert can contain your account id and email, never your prompts or content.

An app you connect yourself, such as Claude or Cursor through our MCP server, sees what you allowed it to: your email, balance, generations and their files. It is not our provider, its own privacy terms apply, and deleting its key on your profile cuts it off.

We may also disclose data where the law requires it, to enforce our Terms, or to protect someone's rights or safety. Write to legal@azurade.com for the current list of sub-processors, or, if you use the Service through our API on behalf of a business, for a data-processing agreement (DPA).

5. Where your data lives

Our application, its database and every file you upload or generate are stored on servers in the European Union, and our Umami analytics instance runs on a server in the Netherlands. Brevo and PostHog also process your data inside the EU. Dodo Payments, Cloudflare, Google, Meta, the model providers and the language-model API operate in the United States or globally, so some processing happens outside the European Economic Area. For those transfers we rely on the European Commission's Standard Contractual Clauses or on an adequacy decision, which includes the EU-US Data Privacy Framework where the provider is certified under it.

6. How long we keep it

Your account, gallery and generation records stay for as long as the account is open.
There is no delete-account button yet. To close your account, email legal@azurade.com from the address you signed up with. We delete the account, its generation records and the generated files within 30 days. What stays is only what tax and accounting law obliges us to keep. Download anything you want first, since each generation can be saved from the gallery.
Application logs are kept for 5 days, web-server access logs for up to 90 days.
Records of purchases stay for as long as Cyprus tax and accounting law requires, which is currently six years.
If you unsubscribe from our emails, we keep your address on a suppression list so that we do not email you again.
Our hosting provider takes full-server backups. Data you have deleted can remain in a backup until that backup rotates out.

7. Your rights

You can ask us for a copy of your personal data, ask us to correct or delete it, restrict or object to how we use it, and receive it in a portable format. Where we rely on consent you can withdraw it at any time, and where we rely on legitimate interests you can object. Email legal@azurade.com; we answer within one month. If you are unhappy with our answer you can complain to a supervisory authority. Ours is the Office of the Commissioner for Personal Data Protection, 15 Kypranoros Street, 1061 Nicosia, Cyprus (www.gov.cy/dataprotection). You may also complain to the authority in the EU country where you live.

8. Security

Traffic is encrypted in transit, every database record is scoped to its owner, uploaded and generated files are served through unguessable links that anyone holding the link can open, payment and generation webhooks are signature-checked before we act on them, and card numbers never touch our servers. No system is perfectly secure. The Security page describes the measures in detail and how to report a vulnerability.

9. Cookies and local storage

We set no cookies at all: no tracking or advertising cookies, and no cookie banner, because there is nothing to consent to. The Service keeps the following in your browser's local storage:

Your sign-in token and a copy of your account profile (name, email), so you stay signed in. Cleared when you sign out.
Copies of data you have already loaded, such as your credit balance, your recent generations and the plan list, so the app opens faster. It is the same data you see on screen, nothing more.
The page you first arrived on, the site that sent you, campaign tags from that link and the date, kept for 90 days. This one is not needed to run the app: it tells us which pages bring people who go on to sign up. It holds no identifier, no IP address and nothing you typed, and it is copied to your account only if you create one. A referral or promo code from a link you followed is stored the same way.

Our analytics are cookieless. Umami stores nothing in your browser. PostHog runs in memory-only mode: its session identifier lives in page memory and is gone when you close the tab. You can clear local storage through your browser settings at any time; doing so signs you out.

The video on the homepage and the developer page that shows how to connect an AI assistant to Azurade is hosted on YouTube. Until you press play it is an image served by us and nothing loads from YouTube. Once you press play, the player loads from youtube-nocookie.com and Google's privacy policy applies to it.

10. Children

The Service is for adults. We do not knowingly collect personal data from anyone under 18. If you believe we hold data about a child, tell us and we will delete it.

11. Changes to this Policy

When we change this Policy in a way that matters, we will tell you by email or in the app and update the date at the top. Smaller edits, such as a renamed vendor, just get the new date.

12. Contact

Dubir Group LTD
Charalampou Mouskou & Grigori Afxentiou, 20. ATHINODOROU BUSINESS CENTER, 3rd floor, Flat/Office 306, 8010, Paphos, Cyprus
Privacy and legal: legal@azurade.com
Everything else: support@azurade.com
Governing law: the Republic of Cyprus