Privacy Policy

Openwing is operated by an individual based in Mumbai, Maharashtra, India. This page explains what is collected when you use it, and where it goes. Contact: tulipaimodel47@gmail.com.

1. What we collect

• Your email address, and your Google profile name and photo if you sign in with Google.
• Anything you type into the chat or composer, and any reference image you upload.
• The images or clips generated for you, and the credits spent on them.
• Basic account activity: projects, timestamps, and which plan or credit pack you hold.
• Whether you opted in to marketing emails, and when — see section 8.

We do not collect payment card numbers. Those go directly to our payment processors, described below.

2. Where it is stored

Account data, projects, messages and uploaded images are stored with Supabase, our database, authentication and file storage provider. Reference images are kept in a private storage bucket; nobody but you and this service can read them directly.

3. Who else sees it

Producing a reply or a generated image requires sending your description, chat message, or an attached reference image to OpenAI, the third-party AI provider used to generate chat replies and images.

Do not upload or describe anything confidential that you are not comfortable a third-party AI system processing.

For payments, card and payment details are handled directly by Razorpay and PayPal. We receive confirmation that a payment succeeded and the amount, not your full card details.

If you sign in with Google, Google provides us your name, email and profile photo as part of that login; we do not receive your Google password.

4. Why we use it

• To run your account: sign you in, track credits, and save your projects.
• To generate what you ask for, by sending the necessary content to the AI providers above.
• To process a purchase, by sending the necessary details to Razorpay or PayPal.
• To answer support requests sent to the contact email above.
• To send marketing emails — but only to people who opted in, as section 8 describes.

We do not sell your personal data, and we do not use it for advertising.

5. Your rights under India's DPDP Act

India's Digital Personal Data Protection Act, 2023 (DPDP Act) calls this service a Data Fiduciary, since it decides why and how your personal data is used, and calls you the Data Principal. The Act and its Rules are being brought into force in stages, with most day-to-day duties scheduled for 13 May 2027. The commitments below are adopted now, ahead of that date, rather than waiting for the deadline to catch up to them.

5.1 Lawful basis

We process your personal data on the basis of your consent, given when you accept this policy, or where a specific use is permitted by the Act without needing consent, such as processing an email address you gave us to send a receipt for something you bought.

5.2 Security and breach notification

We take reasonable security measures appropriate to the data we hold, including access controls on our database and file storage and restricting who can reach production systems. If a personal data breach occurs, we will notify affected users without undue delay, consistent with the Act's requirement to inform the Data Protection Board of India within 72 hours of becoming aware of a breach.

5.3 Retention

We do not keep personal data longer than the purpose it was collected for requires, subject to what "How long we keep it" below describes for accounting and credit records.

5.4 Children

The Act defines a child as anyone under 18 and requires verifiable parental consent to process a child's data. Rather than build and operate that consent flow, Openwing's approach is simpler: the service is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child's data has reached us, contact us and it will be removed.

5.5 Access, correction, erasure and nomination

You may write to us at any time to:

• ask what personal data we hold about you and how it has been shared;
• ask us to correct data that is inaccurate or incomplete;
• ask us to erase your account and its data, subject to what "How long we keep it" below describes for accounting records;
• withdraw consent, which will stop future processing but does not undo what already happened while consent was active; and
• name someone who may exercise these rights on your behalf if you die or become incapable of exercising them yourself.

Send these requests to tulipaimodel47@gmail.com. We aim to respond within 30 days, and no later than 90 days.

5.6 Grievance redressal

If you have a complaint about how your data is handled, write to tulipaimodel47@gmail.com and we will look into it. If you are not satisfied with the response, the Act allows you to take the matter to the Data Protection Board of India.

5.7 Data sent outside India

Some providers we use to run this service, including the AI providers named above, operate outside India. Personal data sent to them for that purpose may therefore be processed outside India. This is permitted under the Act, subject to any restriction the government separately puts in place for a specific country or transfer.

5.8 Significant Data Fiduciary

The Act lets the government notify certain businesses as a Significant Data Fiduciary, based on factors like the volume of data processed, which brings extra duties such as appointing a Data Protection Officer and running regular audits. At its current size, Openwing has not been notified as one and these extra duties do not apply; this section will be updated if that changes.

6. How long we keep it

Data is kept while your account is active. If you delete a project, its content is removed from what the app shows you; some records (such as the credit ledger, for accounting) are kept longer, since that is how "where did my credits go" stays answerable. You can ask for your account and its data to be deleted by writing to tulipaimodel47@gmail.com.

7. Cookies and analytics

A cookie banner appears the first time you visit. Here is exactly what it is asking about, and what happens regardless of the answer.

• Strictly necessary. A cookie from Supabase Auth keeps you signed in. This is not optional; the service cannot know who you are without it, so there is no switch for it.
• Analytics, cookieless. We use Vercel Analytics to count page views. It does not set a cookie and does not store anything that identifies you across visits, so it runs whichever option you choose on the banner, the same way a strictly necessary cookie would, and for the same reason: there is nothing here for consent to gate.
• Everything else. Nothing beyond the two above is set today. If that changes, for example an advertising pixel, it will only load for people who chose "Accept all".

8. Marketing emails

If we send marketing emails in the future — product news, offers, tips — they go only to people who asked for them, for example by ticking a marketing opt-in at signup or on our website. Creating an account alone never opts you in.

You can opt out at any time:

• click the unsubscribe link in any marketing email — one click, no login needed; or
• write to tulipaimodel47@gmail.com and ask to be removed.

We honor unsubscribe requests promptly, and within 10 business days at the latest. Every marketing email identifies Openwing as the sender and includes our contact details plus a working unsubscribe link. We never sell your email address, and we never share it with advertisers.

Transactional emails — receipts, security alerts, password resets and other account notices — are not marketing. They are sent when needed to keep your account working, and cannot be unsubscribed from while the account exists.

9. Changes to this policy

If this policy changes materially, the "last updated" date above will change, and where practical we will notify account holders by email.

10. Contact

Questions about your data, or a deletion request: tulipaimodel47@gmail.com.