Privacy Policy

This policy covers the Bildy website at bildy.ai, the Bildy app, and the Bildy API and MCP server, which you can use to reach Bildy from another program such as an AI assistant or a script of your own.

Bildy cannot make an image or a video without sending your prompt to another company. The section below on what we send to the model companies names those companies and says what we send them.

Who we are and how to reach us

Bildy is run by Fundation GmbH, Hibbelenstr. 10, 51107 Cologne, Germany, registered at Amtsgericht Köln under HRB 110232. For the purposes of the GDPR we are the controller of the personal data described here.

Write to us at info (at) fundation.one with any question about your data, or to make any of the requests described further down.

What we send to the model companies when you generate an image or a video

When you generate or edit an image or a video, we send your prompt, any pictures or clips you attached, and the settings you chose to our servers. We then send them to the company that runs the model you picked. This happens every time, in the app and over the API and MCP server alike. We cannot generate anything without it.

Two companies run the models we offer:

• Replicate, Inc. (United States) runs most of the models in the picker, among them FLUX, Seedream, GPT Image, Runway, Kling, Luma, Seedance and Wan. Replicate passes what we send on to the company that owns the model.
• Google (Google Ireland Limited and Google LLC) runs Nano Banana, Imagen and Veo, through the Gemini API and through Vertex AI.

Each of them handles your prompt and your pictures under its own privacy policy, which you can read at replicate.com/privacy and policies.google.com/privacy. We do not decide how long they keep what we send, and we cannot delete it from their systems on your behalf. Their policies say what else they do with it.

Both companies process data in the United States. For transfers out of the EU we rely on the European Commission’s standard contractual clauses and, for the United States, on the EU-US Data Privacy Framework where the company takes part in it.

We do not send your name or your email address to either of them. They receive your prompt and your files, and nothing that says who you are.

We do not sell your prompts, your pictures or your videos. We do not use them to train models, and we have no models of our own to train. You keep the rights to what you make with Bildy, which the Terms of Service also say.

Using Bildy from another program through the API or MCP server

You can connect Bildy to an AI assistant or your own software with an API key or by signing in with your Bildy account. There is no browser in the middle when you do that, so nothing is kept on your device. Everything described in the section above applies, and the files we make for you are kept on our servers until we delete them on the schedule below.

We and the model company receive whatever you type into that assistant and send on to Bildy, the same as a prompt typed into the app. Your assistant also has its own privacy policy, which we have nothing to do with.

Where your files are kept and how long we keep them

In the app, we save the images and videos you make in your own browser, and we do not copy them to our servers unless you ask us to. Cloud sync is switched off until you turn it on in the sync settings, and it is part of the paid plans. With it on, we keep a copy of your history, your notes and your writing documents on our servers so you can open them on another device, and we keep that copy until you delete it or ask us to.

We have to keep some files on our servers for a while whatever you have chosen, because that is how we get them to you. We delete them on this schedule:

• Videos we generate, and video files you upload for editing: one day.
• Images and videos made through the API or the MCP server: one day.
• Records we keep to stop a repeated request charging you twice: one day.
• Pictures submitted to a Game of Prompts room: seven days.

The download links we hand out stop working after an hour. Ask for the file again and we will give you a new link.

We keep your credit balance, your subscription status and a record of every credit you spend for as long as you have an account, because we need them to bill you correctly and to answer questions about your balance. Each entry in that record holds the date, the tool you used, how many credits it cost and your email address. We keep invoices for ten years, because German tax law requires it.

The companies we share data with, and what each one gets

We use these companies to run Bildy. Each one gets only what it needs for its job, under a data processing agreement where the law requires one.

When you search for a stock photo inside the animation studio, we pass your search words to Pexels, Pixabay, Openverse and Wikimedia Commons to find pictures. They receive the words you searched for, and nothing about your account.

Beyond this list, we do not pass your data to anyone for their own purposes, and we do not sell it.

Why we are allowed to process your data

• To give you what you asked for, such as generating an image or keeping your credit balance, we rely on our contract with you (Art. 6(1)(b) GDPR).
• To keep Bildy working and to stop abuse, we rely on our legitimate interest (Art. 6(1)(f) GDPR).
• For analytics cookies, we rely on the consent you give in the cookie banner (Art. 6(1)(a) GDPR), and you can take it back at any time.
• To keep invoices, we rely on our legal obligations under German tax and commercial law (Art. 6(1)(c) GDPR).

Cookies and analytics run only after you agree to them

Cookies are small files kept on your device. We use Google Tag Manager, and through it Google Analytics, to see which pages people visit, how long they stay, what browser and device they use, roughly which country or city they are in, and how they found us. None of that identifies you by name.

We switch these on only after you agree in the cookie banner. Clear the cookies and site data your browser holds for Bildy to take that agreement back.

How we handle your payment details

Stripe processes your payments, and we never receive your card number. Stripe is certified at PCI DSS Level 1, and their security notes are at stripe.com/privacy. We see which plan or credit pack you bought, when, and for how much, which we need for your receipt and your balance.

Your rights over your data, and how to use them

Under the GDPR you may ask us for a copy of the data we hold about you (Art. 15), correct it (Art. 16), delete it (Art. 17), limit what we do with it (Art. 18), receive it in a portable form (Art. 20), and object to processing we base on legitimate interest (Art. 21). Where we asked for your consent, you can withdraw it at any time, and that does not undo what we did with it beforehand.

Write to info (at) fundation.one and we will answer within a month. You can delete your images yourself in the app at any time. To have us erase what we hold on our servers, including your synced content and your account records, write to the address above and we will carry it out.

If you think we handled your data badly, you may complain to a supervisory authority. Ours is Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, and you may also go to the authority where you live.

When we may have to hand data to authorities

We may pass on your data where a court or an authority orders us to, or where we have to in order to defend a legal claim. We tell you when this happens, unless the law forbids us from telling you.

Keep your own backups of what you make

We do our best to keep your files safe, but images kept in your browser can be lost when your browser clears its storage or your device fails. Save anything you care about to your own disk.

Refunds for credits

Credits can be refunded in limited cases, for example when you cannot get the app to run. Write to us within 14 days of buying them. Consumers in the EU keep their statutory withdrawal rights, which this paragraph does not limit.

How we tell you about changes to this policy

We post any new version on this page with a fresh date at the top. When a change affects you in a material way, we email you about it.