Privacy Policy

This Privacy Policy explains how Aeen ("Aeen", "we", "us", or "our") — the product and brand operated by sahel alenjaz Project Management L.L.C S.O.C, a company established in the United Arab Emirates ("UAE") — collects, uses, shares, and protects information about you in connection with our websites, mobile applications, application programming interfaces, and related services (together, the "Service"). It is designed to comply with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and, where applicable, other data-protection laws.

By creating an account or using the Service you acknowledge that you have read and understood this Policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Information you provide

• Account information: name, email address, profile image, and authentication credentials (managed through our authentication provider; we never store your password in plain text).
• Billing information: handled entirely by our payment partners — Stripe for purchases on our website, and Apple or Google for purchases made inside our mobile apps. From Stripe we receive a billing token, the last four digits of your card, the card brand, and the country of issue. From Apple and Google we receive only a purchase confirmation and a transaction identifier. We never see or store full card numbers or security codes.
• Content: text prompts, uploaded reference images, brand-kit assets, style definitions, campaign briefs, generated images and videos, and any feedback you submit.
• Communications: messages you send to support, and content you choose to publish to public features (for example, the Explore gallery).

1.2 Information collected automatically

• Usage information: features used, generation and credit counts, actions taken, plan and paywall interactions, and timestamps.
• Device and connection information: IP address, browser and device type, operating system, app version, language, the mobile platform you use (iOS or Android), and the country your connection resolves to.
• A device identifier generated by our mobile app and stored on your device. We use it only to apply free-credit and free-trial limits fairly and to detect abuse of those offers. It is not an advertising identifier, we do not use device fingerprinting, and we do not use it for tracking or profiling.
• Push notification token, if you enable notifications, so we can tell you when a generation finishes.
• Diagnostics: crash reports and performance data used to keep the Service stable.
• Cookies and similar technologies: a small number of strictly necessary cookies for authentication, security, and preferences. We do not use third-party advertising or cross-site tracking cookies. See Section 4.

1.3 Sensitive information — please do not upload

2. How We Use Your Information

• To provide, operate, secure, and maintain the Service, including processing your prompts and delivering generated content.
• To create and manage your account, apply your plan and credit balance, and authenticate you.
• To process payments, issue invoices, prevent fraud and abuse, and apply applicable taxes (including UAE VAT where due).
• To communicate with you about your account, security, billing, and material changes to the Service. Marketing messages are sent only with your consent, and you can opt out at any time.
• To monitor performance, diagnose and fix problems, and improve the Service.
• To enforce our Terms of Service, protect users and the public, and keep the Service safe and lawful.
• To comply with legal obligations and respond to lawful requests from competent authorities.

2.1 AI training and your content

We do not use your private prompts, uploaded reference images, or generated outputs to train our own or any third party's AI models. Content you voluntarily make public (for example, by posting it to the Explore gallery) may be displayed to other users as part of that feature, but is still not used for model training without your explicit consent.

2.2 Human review of AI-generated images — not of your uploads

To keep quality high, a small number of authorised Aeen staff review samples of the images and videos produced by the Service — looking at visual defects, how closely a result followed its prompt, and safety issues — and use what they learn to improve our prompts, templates, model selection, and generation settings. This review covers AI-generated outputs only. The reference photos and images you upload are used solely to produce the result you asked for; they are not opened, browsed, or assessed by our team for quality, analytics, or any similar purpose.

Access to generated content for review is limited to authorised staff under confidentiality obligations, is logged, and reviewed outputs are never published or shared outside Aeen without your consent. This review does not train AI models (see Section 2.1). We may still access uploaded content in the narrow cases described elsewhere in this Policy — to investigate a suspected violation of our Terms of Service, to respond to a lawful request from a competent authority, or to provide support you have asked us for. If you would prefer your generated images to be excluded from quality review, email [email protected].

2.3 Photographs of people, and facial references in video

Certain video templates are designed to place a person in a generated scene. Where you use one of those templates and upload a photograph of a person, we transmit that photograph to BytePlus (see Section 3.1) and register it in a private reference library held under our account, because the model cannot otherwise carry a face consistently through a clip. The registration lasts only for that one render — typically one to four minutes — after which we delete the registered copy. Where a template does not need a person, no such registration happens and your image is passed to the model as an ordinary reference.

Depending on where you live, a photograph processed in order to recognise or reproduce a specific person's face may be treated as sensitive or biometric personal data. By uploading a photograph of a person to a feature described as placing a person in a scene, you consent to that processing. You may withdraw consent at any time by not using those templates, and you may contact [email protected] with any question about it. We do not use these references to build a face database, to identify anyone, or to train any model.

Only upload a photograph of another person if you have that person's permission. You are responsible for obtaining it (see our Terms of Service, Section 7).

3. How We Share Your Information

We share information only as needed to run the Service, and only with the categories of recipients below. We do not sell your personal data and do not share it for cross-context behavioural advertising.

• Service providers (sub-processors) that host data and power core features, listed in Section 3.1. They act on our instructions under contracts that require confidentiality and appropriate security.
• AI model providers that perform image and video generation and analysis on our behalf. Your inputs and outputs are sent to them only to fulfil your request. We select providers that contractually restrict using API content to train their public models.
• Payment providers — Stripe for website purchases, and Apple and Google for in-app purchases — which handle card data, billing, taxes, and fraud prevention under their own privacy policies.
• Professional advisors (such as lawyers, accountants, and auditors) where reasonably necessary.
• Authorities and other parties when required by applicable law, regulation, court order, or lawful request, or to protect the rights, safety, or property of Aeen, our users, or the public.
• In a corporate transaction (such as a merger, acquisition, financing, or sale of assets), in which case we will require the recipient to honour this Policy.

3.1 Sub-processors

We currently rely on the following sub-processors. We may update this list as the Service evolves.

We self-host our database, authentication, and queue software on infrastructure we rent from the provider named above. We are the controller and operator of that software; the hosting provider supplies the underlying machine only.

3.2 If you contact us on Instagram

We operate an Instagram account and use Meta's Instagram Professional API to reply to comments and messages, including automatically. If you comment on or message that account, we receive your Instagram user ID, username, and the content of your comment or message, and we store them so we can reply and avoid replying twice. We rely on our legitimate interest in responding to enquiries about our business. This processing is governed by this Policy and by Instagram's own terms; to have your record removed, email [email protected].

4. Cookies and Similar Technologies

We use only strictly necessary cookies and browser storage to keep you signed in, secure your session, remember your preferences, and operate the Service. We do not use advertising, analytics, or cross-site tracking cookies, and we do not embed any third-party analytics or advertising code. Because we set no optional cookies, we do not show a cookie consent banner. You can control cookies through your browser settings, but some features may not work properly if you disable them.

On the website, your browser's local storage also holds working state so that a page reload does not lose your place — your language and theme choice, your current generation settings, and any reference images you have attached but not yet submitted. This data stays in your browser, is not transmitted to us except when you submit a generation, and is cleared when you clear your browser's site data.

5. Retention

• Generated content: kept for as long as your account exists, so that it stays available in your library. We do not delete it on a timer. When you delete an item, we remove it from your library and from our storage.
• Uploaded reference images: held only while the generation you submitted them for is queued and running. Once that generation finishes or fails, the uploaded image is removed from the job record automatically. Where a reference was staged in storage for a video model to fetch, it is deleted after the render.
• Generation records: we keep a record of each generation — its type, model, timestamps, credit cost, and the text prompt you wrote — after the uploaded images have been removed. We use these records for support, billing accuracy, abuse investigation, and aggregate statistics.
• Account and billing records: kept for the life of your account and for up to 7 years after closure to comply with tax, accounting, and anti-fraud obligations.
• Closed accounts: see Section 8.1, which sets out exactly what we delete and the limited records we keep.
• Backups: we take routine database backups for disaster recovery. Deleted data can persist in a backup until that backup is rotated out, which happens within 14 days. We do not restore backups to recover deleted user data.
• Server logs and diagnostics: retained for a rolling operational window and not used to build any profile of you.

6. Security

We use encryption in transit (TLS) and at rest, scoped access keys, rate limiting, audit logging on sensitive actions, and regular review of our providers' security practices. No system is perfectly secure. If we become aware of a personal-data breach that is likely to cause you harm, we will notify you and the competent authority (including the UAE Data Office) as required by applicable law.

7. International Data Transfers

Aeen is operated from the United Arab Emirates. Our database, authentication service, and job queue run on a server located in Germany. Generated images and video are stored with Cloudflare R2 and served from its global edge network. To generate content we send your prompts and reference images to AI providers that process them in the United States, Singapore, and other countries — see the table in Section 3.1, which names each provider and its processing region.

Where we transfer personal data outside the UAE, we do so in accordance with the PDPL — for example, to jurisdictions recognised as providing an adequate level of protection, or under appropriate contractual safeguards with the recipient. For users in the EEA, UK, or Switzerland we rely on Standard Contractual Clauses or another valid transfer mechanism (see Section 11). You can request details of the safeguards that apply by emailing [email protected].

8. Your Rights and Choices

Subject to applicable law (including the PDPL), you may have the right to:

• access the personal data we hold about you and request a copy;
• request correction of inaccurate or incomplete data;
• request deletion of your data;
• restrict or object to certain processing, and withdraw consent where processing is based on consent;
• request your data in a portable, machine-readable format; and
• lodge a complaint with the UAE Data Office or your local supervisory authority.

You can review and edit core account information in your profile settings, and unsubscribe from marketing via the link in any marketing message. To exercise any other right, email [email protected]. We respond within the period required by law (and in any event within 30 days where practicable). We may need to verify your identity first.

8.1 Deleting your account — and what we keep

You can delete your account yourself, from aeen.ai/delete-account or from the app. Deletion is immediate and permanent — it is not a request queued for review, and it cannot be undone. When you delete your account we erase your login and profile, your credit balance and plan, your generated images and video and the stored files behind them, your saved styles, projects, and templates, your gallery and any published posts, your device and notification records, and your payment customer record.

• Anti-abuse records: the device identifier and IP address associated with any free-credit or free-trial grant or refusal, the country and mobile platform seen on the account, and the fact that a free grant was claimed. We keep these because free credits and free trials are metered per device, and deleting an account would otherwise reset that meter and let the same device claim the offer indefinitely. They are retained on the basis of our legitimate interest in preventing fraud and abuse of a free offer.
• Financial and accounting records: purchase and credit-ledger entries required for tax, accounting, and dispute resolution, kept for up to 7 years as described in Section 5.
• Support and safety records: support conversations, feedback, and any content report you filed or that was filed about your content, kept so that we can evidence how a complaint was handled.
• Aggregate statistics that no longer identify you.

These records are not used to contact you, to build a profile, or for any purpose beyond the ones stated. If you believe your circumstances mean we should erase them too, email [email protected] and we will consider the request on its merits and reply.

9. Children

The Service is not directed to, and is not intended for, anyone under 18 years of age. We do not knowingly collect personal data from minors. We do not currently ask for or verify your date of birth; we rely on the age rating of our App Store and Google Play listings, on the age requirement in our Terms of Service, and on reports. If you believe a minor has provided us personal data, contact [email protected] and we will delete the account and its data.

10. Mobile Apps and App Stores

Our mobile applications are distributed through the Apple App Store and Google Play. The data we collect through the apps is described in this Policy and summarised in the privacy disclosures we provide on each store (Apple's "App Privacy" labels and Google's "Data safety" section). The apps may request device permissions (for example, access to your photo library or camera) only to enable features you choose to use, such as uploading a reference image; you can manage these permissions in your device settings.

Subscriptions and credits bought inside the mobile apps are purchased from Apple or Google, not from us. Apple or Google processes your payment and holds your payment details under its own privacy policy; we receive only a confirmation that a purchase succeeded, the product bought, and an identifier we use to add the credits to your account. Subscriptions and credits bought on our website are processed by Stripe, as described in Section 1.1.

11. Notice to Users in the EEA, UK, and Switzerland

This section supplements the Policy above for individuals in the EEA, UK, and Switzerland.

11.1 Controller

sahel alenjaz Project Management L.L.C S.O.C (operating as Aeen) is the controller of your personal data for the purposes of the GDPR and UK GDPR.

11.2 Lawful bases

• Performance of a contract — to provide the Service you request.
• Legitimate interests — to operate, secure, and improve the Service and prevent fraud, where not overridden by your rights.
• Consent — for marketing and any optional cookies, which you may withdraw at any time.
• Legal obligation — to meet tax, accounting, and other legal duties.

11.3 Your rights

You have the rights listed in Section 8 (access, rectification, erasure, restriction, objection, portability, and withdrawal of consent) and the right to lodge a complaint with your local supervisory authority. To exercise them, email [email protected].

11.4 Automated decision-making

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you.

12. Other Regions

Depending on where you live, you may have additional rights under local law (for example, residents of certain U.S. states have rights to access, delete, and opt out of "sale"/"sharing" of personal information — which we do not do). To exercise any such right, contact [email protected].

13. Third-Party Links

The Service may link to third-party websites and services we do not control. We are not responsible for their privacy practices; please review their policies before sharing information with them.

14. Changes to This Policy

We may update this Policy from time to time. The "Effective" date at the top reflects the current version. For material changes we will provide additional notice (for example, by email or in-product notice) at least 14 days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

15. Contact Us

Privacy enquiries: [email protected]
Support: [email protected]
Legal: [email protected]
Postal: sahel alenjaz Project Management L.L.C S.O.C, Office 201, F-280, Amna Mohammed Hussain Al-Jazeeri Al-Tamimi Building, Deira, Dubai, United Arab Emirates.