Privacy Policy
Document version: 2026-10-01
Exhibo Group · Portugal
Rua Sinais de Fogo, Lote 2.09.02E, 1990-110 Lisboa
What data is processed
Account and contact data, company information, selected language, uploaded files, project correspondence, generation outputs, plan usage information, and technical logs. Do not upload special categories of personal data or other people's data without a lawful basis.
Purposes and legal bases for processing
Data needed to provide the service is processed to perform the contract. Technical logs and protective measures support security, abuse prevention, and diagnostics based on legitimate interest, taking the user's rights into account. Some data may be processed to comply with legal obligations. Any optional processing that requires consent must be requested separately; accepting the Terms is not consent to advertising.
Service providers and AI
Core infrastructure is hosted in Scaleway’s European regions. AI requests are routed through OpenRouter and to selected model providers. For diagnostics, detailed requests and responses are logged, including project text. Access to logs is restricted to administrators. Data collection by providers is restricted for model requests. This does not mean that all AI processing takes place exclusively within the EU. When transferring data outside the EEA, the controller must ensure an applicable transfer mechanism, such as an adequacy decision or standard contractual clauses, and verify the terms of the specific provider. Information about providers and applicable safeguards can be requested from the controller.
Storage and protection
Access is restricted by account and role; secure connections and database backups are used. Data is retained only to the extent and for the period necessary to provide the service, protect the system, and comply with mandatory requirements. Retention criteria include the existence of an active account or project, the need to investigate an error or security incident, and mandatory retention periods for payment and contractual records. When an account is closed, deletion is assessed in light of these grounds and backup cycles.
Your rights
To the extent permitted by applicable law, you may request access, rectification, deletion, restriction of processing, and data portability, object to processing, and withdraw separately given consent. You may also lodge a complaint with the competent data protection authority. A written request should be sent to Exhibo Group at the stated postal address in Lisbon; identity verification may be required to protect the account. A response is provided without undue delay and, as a rule, within one month, subject to any legally provided grounds for extension.
Cookies and settings
The service uses necessary cookies for sign-in, security, and language preference storage. The selected language is also stored locally in the browser. This data is used to provide the requested functions. Optional advertising or analytics cookies should be enabled only after a separate choice, where required by law.