Hautech

GDPR overview

The site never uses the word GDPR: there is no compliance claim, and no denial either. The privacy policy nevertheless grants rights shaped like the regulation's — access and correction, deletion, objection and restriction of processing, and data portability — exercised by writing to support@hautech.ai, with a stated thirty-day response. Consent is presented as the legal basis and can be withdrawn at the same address, and a breach notification clause covers affected users and the relevant authorities. Beyond that the documentation is thin: cross-border transfers are permitted under unspecified adequate protections, with no standard contractual clauses or adequacy mechanism named; no data processing agreement is offered; no subprocessor list is published; no Article 27 EU representative and no data protection officer is designated; and the policy carries no visible effective date.

Who owns the data?

Under the terms of service, users own the Assets they generate, and that ownership survives a downgrade or a cancelled subscription. Hautech Co. grants a non-transferable, non-exclusive and revocable licence to use the service for commercial purposes. In return, users grant Hautech Co. a perpetual, worldwide, non-exclusive and royalty-free licence to use, reproduce and display their prompts and Assets, and that licence expressly survives termination of the agreement. The same section adds that Hautech retains a proprietary right over uploaded photos for AI training and algorithm improvement. The privacy policy states separately that personal information is never sold, traded or rented to third parties.

Reuse rights

Credits bought in Studio are described as covering high-resolution outputs with full commercial rights, so generated assets can be reused commercially without asking further permission: users hold a non-transferable, non-exclusive and revocable licence and keep ownership of what they create. The restrictions sit elsewhere. The terms forbid reselling the service, reverse engineering it, running automated tools against it, sharing an account, and uploading content the user does not own. On Hautech's side, the data collected covers email address, username, prompts, uploaded photos, IP address and usage data, used for service delivery and improvement, account management, communication, analytics and legal obligations. Sharing is limited to four cases: service providers, a business transfer, legal requirements and user consent, and no subprocessor is named. One point remains unresolved: the terms claim a proprietary right to use uploaded photos to train and improve the models, while the virtual try-on page states that customer content is never used for training without explicit opt-in consent. Nothing published reconciles the two.

Data retention & training

Hosting summary

Hautech states on its homepage that it operates three data centres, located in the United States, Europe and Asia, and presents that spread as serving low latency and data compliance for users worldwide. The virtual try-on page repeats the claim of a global inference infrastructure delivering sub-second responses. Beyond that geography, nothing is committed: no jurisdiction is guaranteed, no region can be pinned to an account, no hosting provider is named, and no trust or security page exists. The privacy policy is explicit that personal data may be transferred to and maintained on servers outside the user's own state, province or country, and says only that adequate protections are in place — no standard contractual clauses, adequacy decision or transfer framework is named. The marketing site itself resolves to a United States address on Amazon infrastructure, but that describes the website rather than the generation fleet. Teams with residency requirements should note the Agency page, which offers optional on-premise or private deployments as the only documented way to control where processing happens.