Privacy Policy

Openwing is operated by an individual based in Mumbai, Maharashtra, India. The operator is the contact responsible for this policy. Privacy, support and grievance requests: tulipaimodel47@gmail.com.

1. Data we process and why

• Account email, authentication identifiers and, for Google sign-in, the profile name and photo supplied by Google: to sign you in and manage your account.
• Chat messages, briefs, uploaded reference images, brand information and saved preferences: to understand requests, generate designs and maintain your projects.
• Generated images, clean backgrounds, editable text/layout settings, saved versions, feedback and downloadable design bundles: to render, review, edit and export your work.
• Plan, purchase, subscription, credit, usage, consent and activity records: to deliver access, process payments, prevent abuse and investigate billing problems.
• Support correspondence and technical diagnostics, which may include request identifiers, timestamps, IP addresses and browser information: to troubleshoot, secure the service and handle complaints.

Payment card credentials go to Razorpay; Openwing does not collect full card numbers. Do not submit passwords, payment credentials or personal data you are not authorised to share.

2. Storage and service providers

• Supabase: authentication, account records, messages, project metadata, billing/credit records, preferences and consent records.
• Cloudflare R2: uploaded files, generated images, clean backgrounds, editable design documents, previews and export bundles.
• Vercel: website hosting, server processing, operational logs and optional website analytics.
• OpenAI: AI replies, design planning, image generation and visual review. Relevant messages, briefs and reference pixels, and generated pixels when reviewing a result, are sent for these purposes.
• Razorpay: payments and recurring billing. We receive transaction references, amounts, status and related billing records.
• Google: authentication if you choose Google sign-in. We do not receive your Google password.

Private files use owner-scoped access and time-limited viewing/download links. Anyone you give a valid signed link to may access that file until the link expires; treat these links like the files themselves. Authorised service operators and providers may access data when necessary to operate, secure or support the service, or comply with law. No system can guarantee absolute security.

Providers may process data outside India under their own infrastructure arrangements and applicable law. We do not promise India-only storage or processing.

3. AI processing and model training

OpenAI states that API data is not used for model training by default unless the API customer opts in. Openwing uses API processing and does not offer a feature that trains its own model on your uploads. API data may still be retained for safety, abuse monitoring or legal purposes; OpenAI describes default abuse-monitoring retention of up to 30 days, with exceptions. We do not promise zero retention. See OpenAI data controls for its current terms.

Routine text movement, resizing, rotation, undo/redo and design-bundle export use application rendering and editing libraries rather than an additional AI generation. A request for a new AI edit, design or visual review can send the relevant content to OpenAI. Browser voice typing may use the browser vendor's speech service; microphone access requires browser permission, and recognised text is processed like other composer text.

4. Private work, sharing and public showcase

Your work is not automatically submitted to the public showcase. Choosing Showcase submits a separate copy for operator review; approved submissions and their captions are publicly viewable and may be downloaded or copied by others. Submit only content you have permission to publish. To withdraw a submission, contact the email above. Removing a private project is not a request to withdraw a separate showcase copy, and we cannot erase copies already downloaded by others.

Design bundles contain the graphic, clean background, text overlays and editable layout/copy. Sharing a bundle shares these contents. The bundle export is designed to omit account identifiers, private storage paths, authentication credentials and chat history.

We do not sell personal data or use it for advertising. Editing libraries such as Immer and fflate are bundled code; their authors do not receive your files merely because those libraries are used.

5. Retention and deletion

Projects and associated content are kept to provide your saved workspace. Archiving or removing a chat from the visible list does not guarantee immediate physical erasure. Credit, billing, security and support records may need to be kept for accounting, fraud prevention, disputes or legal obligations.

You can request access, correction, export or erasure at tulipaimodel47@gmail.com. Account deletion is also available in the account panel. The app requires active or past-due subscriptions to be cancelled first so billing is not left running. Account deletion removes account records and attempts to remove associated private files. Storage outages can delay file cleanup; contact us if you need confirmation or further erasure. Backups, provider safety records and legally required records may follow separate retention schedules. Previously shared/downloaded files are outside our control.

We may verify account ownership before acting on a request. Withdrawing consent stops future processing for the withdrawn purpose, but does not undo processing already completed or retention required by law; some features may then be unavailable.

6. Cookies, analytics and preferences

Supabase authentication cookies are necessary to keep you signed in. The browser also stores your consent choice and certain interface preferences locally. Optional Vercel Web Analytics loads only after you choose Accept all; choosing Essential only leaves it off. You can reopen privacy choices from the links below.

Analytics is cookieless, but that does not mean no data is processed. Vercel describes page URLs, referrers, approximate location and browser/device information, with a temporary visitor identifier. Openwing excludes private workspace and authentication routes from these optional page-view events and removes URL queries and fragments. Hosting/security logs needed to operate the service are separate from optional analytics. See Vercel Analytics privacy information.

7. Marketing

Creating an account alone never opts you in. Accepting these policies also does not opt you into marketing emails; marketing requires a separate opt-in. Every marketing email includes an unsubscribe link. You may use the unsubscribe link in any marketing email — one click, no login needed — or contact us to withdraw consent. Requests are honoured promptly and within 10 business days. Transactional emails, such as receipts, authentication and security notices, are separate from marketing.

8. Age, privacy rights and complaints

Openwing is intended for people aged 18 or older. We do not offer a parental-consent flow. Contact us if a child's data has been submitted so we can investigate and take appropriate action.

We handle privacy requests under applicable law, including India's Digital Personal Data Protection Act and Rules as their relevant provisions come into force. You may request access, correction, erasure, consent withdrawal and nomination where applicable. We aim to answer privacy requests within 30 days, or within the period required by applicable law.

Contact the operator at tulipaimodel47@gmail.com for privacy or consumer grievances. We acknowledge consumer complaints within 48 hours and address them within one month as required by applicable consumer law. We may request information needed to investigate. Your rights to approach an applicable regulator or consumer forum remain available. If a personal-data breach requires notification, we will notify affected people and authorities as applicable law requires.

9. Changes

Material changes carry a new policy version and a request to review and accept the current policies when reopening the workspace. Marketing consent remains separate. Contact the email above if you have questions.