Designkit

GDPR overview

GDPR implementation is documented rather than merely asserted. A dedicated GDPR Notice supplements the general privacy policy and covers both the EU and UK regimes. The controller is named as Meitu (China) Limited in Hong Kong, a Data Protection Officer is designated (Legal Department, compliance@meitu.com), and Article 27 representatives are appointed: Rivacy GmbH in Hamburg for the European Union and Rivacy Limited in Lancing for the United Kingdom. Legal bases are set out clause by clause under Article 6, and data subject rights are listed with their articles — access, rectification, erasure, restriction, portability, objection, withdrawal of consent and the right to complain to a supervisory authority. Transfers outside the EEA, the UK and Switzerland rely on standard data protection clauses under Article 46(2)(c). No DPA is published and no certification is displayed.

Who owns the data?

Designkit claims no ownership over what you upload: the terms state the vendor does not claim ownership rights in user content, and you keep your rights to exploit it. The reverse also applies — the assets the vendor supplies, called Virtual Goods, remain its property under a limited, revocable, non-transferable licence, and any derivative of vendor content stays with the vendor even once mixed into your own work. You warrant you hold the rights to everything you upload. Deleting content is possible at any time, though copies may persist briefly in backups. On paid plans, generated visuals are presented as royalty-free and cleared for commercial use.

Reuse rights

On a paid plan, generated images and videos can be reused without asking further permission: the homepage FAQ describes them as royalty-free and fully cleared for commercial use across stores, listings, social media and advertising, and the subscription licence covers digital reproduction on websites, online ads, social media, apps, e-publications, email marketing and audiovisual production. Two limits matter. First, physical and printed use is carved out — merchandise, product packaging and labelling, letterhead, business cards, magazines, newspapers and books are all excluded. Second, the AI terms set a default of personal, non-commercial use of the AI features, which sits awkwardly against the commercial promise made elsewhere. Output may not be used to build, train or improve any other AI service.

Data retention & training

Hosting summary

No single hosting country is announced. The privacy policy states that information may be transferred, processed and stored anywhere in the world, and names Hong Kong, Japan, South Korea, Singapore, the United States and the European Union among the possible destinations. Storage may sit on the publisher's own servers, on those of its affiliates or of its service providers, or in the cloud. Transfers out of the EEA, the United Kingdom and Switzerland are covered by standard data protection clauses under Article 46(2)(c) of the GDPR, or by statutory derogations with additional safeguards. Security is described in general terms, with encryption techniques such as SSL and an explicit refusal to guarantee absolute security. The governing law is that of Hong Kong. No sub-processor is named, no DPA is published, and no certification such as SOC 2 or ISO is displayed anywhere on the site.