This explains what we collect, why, who we share it with, and what you can do about it. DIGIMOOR TECHNOLOGY SOLUTIONS LLP is the data controller.
1. What we collect
| Data | Why | Kept for |
|---|---|---|
| Email address | To create your account, sign you in, send receipts and service notices | Until you delete your account |
| Password | Authentication. Stored only as a salted hash by our auth provider — we never see it | Until you delete your account |
| Prompts you write | To generate what you asked for, to show your history, and to investigate abuse | Until you delete the generation or your account |
| Files you upload | To use as source media for a generation | Until you delete the generation or your account |
| Generated outputs | To show them back to you in My Projects | Until you delete them or your account |
| Wallet balance and transactions | To run the prepaid billing and to meet our accounting obligations | Up to 7 years after a transaction, as tax law requires |
| Payment records (amount, receipt number, status) | To fulfil top-ups, issue receipts and handle refunds and disputes | Up to 7 years |
| IP address, device and browser info, request logs | Security, fraud prevention, rate limiting, debugging | Short-term operational logs; security records up to 12 months |
| Moderation records (a blocked prompt and its category) | To enforce our Acceptable Use Policy and to meet legal obligations | Up to 12 months, or longer if legally required |
We never see your card details. Card data is collected and held by our payment processor. We receive only the amount, a payment identifier and the result.
2. Legal bases (UK/EU GDPR)
- Contract — running your account, generating what you ask for, taking payment.
- Legitimate interests — securing the service, preventing fraud and abuse, keeping it working. We balance this against your rights.
- Legal obligation — accounting and tax records; responding to lawful requests.
3. Who we share it with
Only with the providers we need to run the service, each under a data-processing agreement:
- Authentication and database — stores your account, wallet and generation metadata.
- AI compute providers — receive your prompt and any source media in order to generate the output.
- Object storage — stores your uploads and generated files.
- Payment processor (Dodo Payments) — handles the transaction.
We will name our current sub-processors on request — write to turbomaxai@digimoor.com. We do not sell your personal data, and we do not share it for advertising.
4. International transfers
Our providers operate globally, so your data may be processed outside your country. Where required, transfers rely on Standard Contractual Clauses or an equivalent safeguard.
5. Your rights
You can access, correct, export, delete, restrict or object to our processing, and withdraw consent where we rely on it. Two of these are self-service, immediately, from your Account page:
- Export — downloads everything we hold on you as a JSON file.
- Delete — schedules your account for deletion after a 48-hour grace period, which exists so a stolen session cannot instantly destroy your history. You can cancel during that window. Deletion removes your account, prompts, generations and wallet. Transaction records we are legally required to keep are retained in a minimised form.
For anything else, contact turbomaxai@digimoor.com. You also have the right to complain to your local data protection authority.
6. Security
Traffic is encrypted in transit (TLS). Passwords are hashed by our auth provider. Wallet balances can only be changed by our server, never from a browser. Access to production data is limited to administrators, and administrative actions are logged and attributable.
No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant authority as the law requires.
7. Children
The service is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has an account, tell us and we will remove it.
8. Cookies and local storage
We use browser storage for things the app needs to work: your session token, your chosen theme, and interface preferences. We do not use advertising or third-party tracking cookies, so there is no consent banner to click through.
9. Changes
We will post updates here and notify you in the app of material changes.