Privacy policy

1. Scope and operator

This policy covers account sign-in, AI creation, workflows, works management, credit billing, and support on the eluai website and iOS app. Support WeChat: luyuhao0422.

We process information to provide requested services, fulfill relevant obligations, and maintain necessary security. Where consent is required, it must be obtained in accordance with law. This policy describes processing; it is not blanket authorization for all processing, disclosures, or sensitive information processing.

2. Information we process and its purposes

Accounts and sign-in

Email, verification records, user ID, account status, chosen nickname and avatar, referral relationships, sign-in times, and registration and latest sign-in IP addresses. These verify identity, maintain accounts, manage referral benefits, prevent abuse, and protect security. Email is required for the current sign-in method; nickname and avatar are optional.

Creations and workflows

Prompts, uploaded reference images or videos, chosen models and parameters, nodes and connections, results, run status, and history. These execute generation, save workflows, display works, track tasks, and troubleshoot failures. Submission is required only when you use the relevant creation features.

Credits and transactions

Credit balances, reservations and charges, purchase orders, and payment status. Support may need order IDs, payment times, and necessary payment proof for transactions or refunds. These support settlement, reconciliation, disputes, and recordkeeping obligations.

Visits and attribution

Browser User-Agent, first visit time, visited paths and query parameters, referring URLs and domains, UTM campaign parameters, and random visitor IDs. These help understand traffic sources and promotion performance. Visitor IDs may be linked to accounts after sign-in; attribution records are not fully anonymous.

Support and security

Requests, contact details, related task or order information you provide, and necessary request times, status, error, and security logs. These help respond, verify requests, troubleshoot, prevent abuse, and address anomalies.

Upload only content you have the right to use. If prompts, assets, or links contain another person's identity, contact details, or other personal information, ensure an appropriate processing basis. Do not submit identity documents, bank details, medical records, or other sensitive information unrelated to your creation.

Browser storage

The website uses localStorage for sign-in credentials, attribution identifiers, and some preferences, and sessionStorage for some drafts and session attribution reporting status. This maintains sign-in, restores input, and avoids duplicate reports. Clearing website storage may sign you out or remove local drafts. It does not delete server records or prevent later visits from generating attribution records again.

iOS permissions and local storage

Reference images use the system photo picker; the app receives only selected images and does not request full photo-library access. Selected images are previewed locally and uploaded only after you confirm generation. Saving works requests permission to add photos or videos; if denied, you can still preview or export through the system share sheet. Manage permissions in system settings.

The current app does not request camera, microphone, contacts, location, or cross-app advertising tracking permissions. Credentials are stored in the system keychain. Account summaries, pending generation requests, and drafts are stored locally, separated by service environment and account. Draft text and references are not uploaded as generation assets before confirmation. Signing out removes current credentials and the account summary but keeps drafts and pending requests for recovery when you sign in again.

When verification is enabled, the app loads a verification page. Choosing web sign-in opens the website login in a temporary web session. That page may generate attribution and random visitor ID records described above and associate them with your account after sign-in. Closing the web session does not delete server records. Images, videos, and text enter the system share sheet only when you choose to share; the receiving app processes them under its own rules.

3. Model processing, providers, and sharing

AI generation sends prompts, references (content or access links), and generation settings to the selected model's upstream model or API provider.Models may use different providers or routes. Processing is limited to content needed for the task. Before submission, ensure assets are suitable for the relevant model. Contact support for specific providers or processing locations.

We may use email providers to send sign-in codes and object storage or CDNs to store and distribute assets and results. When verification is enabled, its provider may process necessary browser and network information. Providers process information needed for their respective services. We distinguish entrusted processing from disclosure to independent processors as required by law and apply necessary agreements and management measures.

This policy does not promise domestic processing for all models or identical retention and training rules across providers. Processing requiring separate consent, involving sensitive personal information, or transferring personal information abroad must meet applicable notification and other legal requirements separately. This policy does not replace those procedures.

Anyone with a share link may access its content; distribute links carefully. Communication through WeChat support or third-party pages is also processed under those platforms' policies. We may provide necessary records to authorized authorities or to resolve disputes and protect lawful interests.

4. Retention and security

We retain personal information for the shortest period needed for its purpose. Account and creation records support ongoing sign-in, workflow storage, and work viewing. Transaction, security, and dispute records may require continued retention under applicable law or dispute needs. Retention varies by purpose, legal duties, and account status; no single fixed period is promised.

Account authentication, access permissions, media authorization, and necessary security management reduce disclosure and misuse risks. Protect your email and verification codes, and avoid public asset or share links. Deleting workflows, clearing local drafts, and deleting all related server files are different actions. Submit a privacy request for further deletion.

Where backups, security retention, or legal duties prevent immediate deletion, further processing will be restricted as applicable and records handled when conditions permit. For personal information security incidents, we will take remedial action and provide required notices in accordance with law.

5. Access, correction, deletion, and account closure

View account, works, and credit records on the website and use available editing or deletion features. To access or copy personal information, correct errors, delete information, withdraw consent, or close your account, contact support below with your email and request scope. Account closure and complete personal information deletion are currently handled manually.

We verify identity as necessary to protect accounts and explain outcomes or reasons a request cannot be fulfilled. Withdrawing consent does not affect earlier consent-based processing. Features may stop working when required information is no longer provided. Transaction and legally retained records follow applicable requirements. If you dispute the outcome, contact the operator again or the competent authorities.

Minors

Minors should use the service under guardian guidance. Personal information of children under fourteen is sensitive and requires guardian consent and other legal conditions. Guardians who find information submitted without appropriate consent should contact us for review and handling.

Policy updates

We update this page and its date when services or processing change. Significant changes to purposes, methods, or information types will receive legally required notices and renewed consent where needed.