Privacy Policy

This policy explains what inspo.dev (operated by Fan Platform Ltd, the data controller) collects about you, why, and what you can do about it. We keep it short because we keep little.

What we collect

• Account details — your name, email address and a hashed password, or, if you sign in with Google, the name, email and profile picture Google shares with us. We never see your Google password.
• Your projects — the images, video, audio and text you upload, the prompts you write, and the media that is generated from them.
• Billing — your credit balance and a ledger of purchases and generations. Card details go straight to Stripe; we only receive a customer id and confirmation that a payment succeeded.
• Your Higgsfield key, if you choose to store one. It is encrypted at rest and only ever used to make requests you initiate.
• Technical data — server logs with IP address, browser and the pages requested, kept for security and debugging. We don’t run analytics or advertising trackers.

How we use it

• To run the Service: sign you in, store your projects, generate media and keep your balance right (performance of our contract with you).
• To send transactional email — verification links, password resets, receipts. We don’t send marketing email.
• To keep the Service secure and to investigate abuse (our legitimate interests).
• To meet legal obligations, such as keeping payment records.

Who else sees it

We share data only with the providers needed to run the Service, each bound by their own terms and privacy policies:

• Higgsfield — receives your prompts and reference media to generate images and video. Uploaded reference files and generated outputs are stored on Higgsfield’s CDN for a limited period.
• OpenAI — receives your prompt and reference images when you pick a GPT Image model for a still.
• Stripe — processes payments. Your name and email are shared to create a customer record and send receipts.
• Google — only if you choose to sign in with Google.
• Resend — delivers our transactional email.
• Vercel AI Gateway — receives the tail end of the prompt you’re typing so the editor can suggest which character, scene or prop you mean. No account data is sent.

We don’t sell your data and we don’t share it with advertisers. Some of these providers are outside the UK/EU; transfers rely on their standard contractual clauses.

Cookies

We set one session cookie so you stay signed in, plus a short-lived signed copy of your session to avoid a database lookup on every request. Both are essential; there are no tracking cookies.

How long we keep it

• Projects and media: until you delete them or close your account. Deleting a project deletes its media from our servers immediately.
• Account and billing ledger: while your account is open, then as long as tax and payment rules require (typically 6 years for payment records).
• Server logs: up to 30 days.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and take it elsewhere. To close your account and delete everything, email us. If you think we’ve mishandled your data you can complain to the UK Information Commissioner’s Office or your local supervisory authority.

Security

Data is stored on a dedicated server we control, hosted by Hetzner in Germany (EU). It is transmitted over HTTPS, passwords are hashed, and stored API keys are encrypted at rest. No system is perfectly secure; tell us if you find a problem.

Contact

david@fanplatform.co.uk. See also our Terms of Service.