Privacy Policy

1. Who We Are

NexAI Studio is an AI product-photoshoot platform operated by NexAI Labs LLP (“NexAI Labs,” “we,” “us,” or “our”), based in India and accessible at studio.nexailabs.com. This Privacy Policy explains how we collect, use, and protect personal data when businesses use the Service. For the personal data we process to provide the Service, NexAI Labs acts as the data fiduciary. This policy is written with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) in mind.

2. Data We Collect

We collect the following categories of information:

• Account data — your name and email address received from Google when you sign in, together with authentication identifiers.
• Customer-uploaded content — product reference photos you submit for processing. These images may include photographs of human models, that is, real people's faces.
• Generated images — the AI-generated outputs produced from your uploads, along with the prompts and references used to create them.
• Payment metadata — records of your credit purchases and transactions. Payments are handled by Razorpay; we do not collect or store your full card numbers.
• Operational and usage data — log data, device and browser information, and interactions with the Service, used to operate, secure, and improve it.

3. Why We Process Your Data

We process personal data to provide and operate the Service; generate your photoshoot imagery; authenticate users and enforce allowlist-based access; process payments and maintain billing records; provide support and communicate with you; keep the Service secure; and comply with our legal obligations. We may use aggregated or de-identified data to monitor and improve the reliability and quality of the Service.

4. AI Processing of Your Images

To generate imagery, your reference images are transmitted to third-party AI model providers (for example, Google) that act as our processors and use the images solely to fulfil your generation requests. Where you enable it, our face-masking (“black-box”) option masks human faces in uploaded reference photos before they are sent to AI providers. We do not use your uploaded images or generated outputs to train AI models.

5. Payment Data

Credit purchases are processed by Razorpay, our payment processor. Razorpay collects and handles the payment details (such as card or UPI information) needed to complete your transaction under its own terms and privacy policy. We receive confirmation and transaction metadata, but we do not store your full card numbers.

6. Storage & Security

Your data is stored on access-controlled cloud infrastructure provided by Supabase (database and storage). We use technical and organizational measures — including encryption in transit, access controls, and row-level security — to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

7. Sharing & Sub-Processors

We share personal data only with processors and sub-processors that help us deliver the Service: cloud hosting and storage (Supabase), AI model providers that generate imagery (such as Google), and our payment processor (Razorpay). These providers process data on our behalf under their own security and confidentiality obligations. We do not sell your personal data. We may disclose information where required by law or to protect our rights.

8. Data Retention

We retain account data, uploaded images, and generated outputs for as long as your account is active or as needed to provide the Service. If you close your account or request deletion, we delete your data from our active systems within a reasonable period (generally within 30 days), except where we are required to retain certain records — such as payment and tax records — to comply with the law.

9. Your Rights

Subject to applicable law, including the DPDP Act, you may have the right to access the personal data we hold about you; to correct, complete, or update it; to request its erasure; and to grievance redressal. To exercise these rights or raise a concern, contact us using the details below. We will respond within the timeframe required by applicable law.

10. Cookies

We use only essential cookies that are necessary for the Service to function — specifically, session cookies that keep you signed in after authentication. We do not use advertising cookies or third-party tracking or analytics cookies. Your theme preference is stored locally in your browser, not in a cookie.

11. Children

The Service is a business tool and is not directed to, or intended for use by, individuals under the age of 18. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice.

13. Contact & Grievance Officer

For questions about this Privacy Policy or your data, contact NexAI Labs at privacy@nexailabs.com. For formal grievances under the DPDP Act, contact our Grievance Officer, Rahul Juneja (Founder), at legal@nexailabs.com.