a1.art

GDPR overview

The GDPR is named explicitly: the privacy policy states that personal data is collected, stored and used in strict accordance with it, and a dedicated section 7 sets out the legal bases (consent, performance of a contract, legal obligation, vital interests, public interest, legitimate interests) together with the rights of access, rectification, objection, erasure, portability and withdrawal of consent. Payment processing is grounded in Article 6(1)(b) for EEA residents. Cross-border transfer is acknowledged: all personal data is transferred to, processed and stored in the United States. Account deletion is self-service (Profile > Settings > Other > Delete Account) or available by email, and is handled within 30 days. The gaps are equally concrete: no Article 27 EU representative, no data protection officer, no European address, no data processing agreement, no published sub-processor list and no certification such as SOC 2 or ISO 27001.

Who owns the data?

Section 5 of the terms assigns copyright in generated images in full to the user who generates them; the underlying models are presented as MIT-licensed open source, with styles customised by the platform. Intellectual property in the platform itself - interfaces, software and trademarks - remains with Jishi Design&Tech (HK) Limited, its licensors and affiliates. Uploading is not publishing: original images that stay private may not be published or used by the platform or by other users, whereas publishing an original image is deemed to grant the platform the right to use it for model operation and learning, and published outputs carry a non-exclusive display licence. Facial data is processed only to produce the requested effect, is not shared and is not retained beyond processing.

Reuse rights

Because the terms assign copyright in generated images to the user, outputs can be reused without asking further permission, including commercially: the API returns watermark-free images explicitly so they can be used in the user's own business. On the web, removing the watermark and obtaining the high-definition file goes through the 'save' function, which costs one credit. Three reservations apply. Outputs may not be unique, and the terms warn that other users can obtain similar results. Styles that imitate an identified painter can produce work close to the original and create a risk of dispute, which the terms flag explicitly. Finally, users must warrant that the images they upload infringe no third-party rights; the platform recommends starting from public-domain material, citing Unsplash, or from images they own.

Data retention & training

Hosting summary

Section 6 of the privacy policy states that all personal data processed is transferred to, processed and stored in the United States, where the publisher says its US headquarters and main servers are located. The cross-border transfer is acknowledged explicitly and made subject to the user's consent. No data-residency option and no alternative region are offered. The corporate and legal framework sits elsewhere: the publisher, Jishi Design&Tech (HK) Limited, is established in Hong Kong, the governing law is that of the People's Republic of China including the Hong Kong SAR, and disputes are referred to HKIAC arbitration in Hong Kong. As a network observation rather than a declaration by the site, the domain resolves to 49.51.185.51, an address located in Santa Clara, United States, on AS132203 (Tencent). The gaps are notable: no SOC 2 or ISO 27001 certification is claimed and no sub-processor list is published. The only named provider is Stripe, described as a PCI Level 1 payment service provider.