Privacy Policy

Account information

When you create or maintain an account, we may collect:

• your name or display name;
• email address;
• account identifier;
• authentication information;
• preferences and settings;
• subscription or credit balance; and
• communications you send to us.

Payment and transaction information

Purchases are processed using third-party payment providers. MouthpieceAI may receive information such as:

• transaction amount;
• currency;
• payment status;
• subscription status;
• transaction identifiers; and
• limited billing information.

Complete payment-card credentials are processed by our payment provider rather than intentionally stored by MouthpieceAI.

User Content

When you use our creative tools, you may provide:

• photographs and reference images;
• prompts;
• character information;
• uploaded images, video or audio;
• LoRA or other model-training materials where supported;
• campaign materials;
• generated media;
• project files; and
• other information you choose to upload or create.

We refer to these materials collectively as "User Content."

Technical and usage information

We may automatically collect limited information associated with use of the Service, including:

• IP address;
• browser type;
• device and operating-system information;
• timestamps;
• session and authentication information;
• pages and features used;
• referring pages;
• request and diagnostic information;
• error logs; and
• security events.

We use this information primarily to operate, protect, troubleshoot and improve MouthpieceAI.

MouthpieceAI allows you to create characters using reference photographs and other visual material.

A photograph depicting an identifiable person may constitute personal information.

AI systems may also analyze characteristics of an image or create mathematical representations, embeddings or other derived information in order to reproduce a character consistently.

A photograph is not automatically a biometric identifier simply because it contains a face.

However, where MouthpieceAI or a provider acting on our behalf processes an image in a manner that constitutes biometric processing under applicable law, we treat that information according to the requirements applicable to sensitive or biometric information.

We use reference images and associated derived information to provide features requested by the user, such as:

• character creation;
• identity or appearance consistency;
• image generation;
• image-to-video generation;
• character customization; and
• related creative functions.

Where applicable law requires express consent for biometric processing, we will request it separately rather than relying solely on acceptance of this Privacy Policy.

This distinction matters. Canadian privacy guidance, for example, says sensitive biometric processing will generally require express consent and that simply describing biometric processing somewhere in a privacy policy may not be sufficient.

You must have the necessary rights, permissions or other lawful basis to upload and use images of identifiable people.

Depending on the jurisdiction and intended use, this may involve privacy, publicity, personality, copyright, biometric or other rights.

MouthpieceAI's technical ability to process an image does not mean that you have the legal right to use that image.

Our Terms of Service may impose additional restrictions concerning impersonation, deceptive media, non-consensual content and other uses of identifiable individuals.

We may process personal information to:

• create and administer accounts;
• authenticate users;
• provide the Service;
• process prompts and generation requests;
• create and maintain characters;
• store and retrieve User Content;
• process purchases, subscriptions and credits;
• provide customer support;
• send account and transactional communications;
• maintain generation histories and projects where enabled;
• detect fraud and abuse;
• secure our systems and users;
• diagnose failures and improve reliability;
• develop and improve MouthpieceAI;
• enforce our Terms and policies;
• comply with applicable law; and
• establish, exercise or defend legal claims.

We will not use personal information for a materially incompatible new purpose without providing any notice or consent required by applicable law.

AI generation necessarily requires information to be processed by computing infrastructure and, in some cases, third-party AI providers.

Your private content

MouthpieceAI does not sell your private User Content as AI training data.

MouthpieceAI does not use private reference images or private generated assets to train publicly available general-purpose AI models without your consent.

We may use aggregate, de-identified or operational information to understand performance, prevent abuse and improve MouthpieceAI, where permitted by law.

AI service providers

We may transmit information required to complete a generation to AI infrastructure providers acting on our behalf.

One such provider is fal.ai. fal's current terms distinguish customer-provided inputs from anonymized or aggregated usage data.

We therefore do not represent that no operational or derived information can ever be used by an infrastructure provider. Instead, we seek to limit the personal information provided to what is reasonably necessary to perform the requested service and select provider arrangements appropriate to the information being processed.

Where applicable law requires us to identify a legal basis for processing, including under the GDPR or UK GDPR, our processing may rely on:

Performance of a contract:

when processing is necessary to provide a feature or service you requested.

Consent:

where you have affirmatively agreed to particular processing and consent is the appropriate or required basis.

Legitimate interests:

where necessary for legitimate business purposes such as securing the Service, preventing fraud, maintaining reliability and improving our products, provided those interests are not overridden by your applicable rights.

Legal obligations:

where processing is necessary to comply with law.

Establishment or defence of legal claims:

where permitted by applicable law.

The appropriate legal basis depends upon the information, purpose and jurisdiction involved.

Where consent is our legal basis, you may withdraw that consent subject to applicable legal and technical limitations. Withdrawal does not make prior lawful processing unlawful.

We do not sell your personal information.

We may disclose information in the following circumstances.

Service providers and subprocessors

Companies may process information on our behalf when necessary to operate MouthpieceAI.

Provider	Function	Information potentially processed
Vercel	Website and application infrastructure	Requests, technical information and application data
Supabase	Database, authentication and storage	Account information, application data and stored User Content
fal.ai	AI inference and media generation	Prompts, reference media and generation inputs
Stripe	Payments and billing	Payment, billing, transaction and fraud-prevention information

Stripe can act as either processor or controller depending on the processing activity, including for functions such as payment processing, fraud prevention and legal compliance.

DigitalOcean is not currently part of our production processing stack and is therefore not currently listed as a MouthpieceAI service provider.

We may update our subprocessor list as our infrastructure changes.

Legal process

We may preserve or disclose information if reasonably necessary to:

• comply with applicable law;
• respond to valid legal process;
• respond to lawful governmental requests;
• protect the rights or safety of users or others;
• investigate fraud or security incidents; or
• establish, exercise or defend legal claims.

Where legally permitted and reasonably practicable, we may notify affected users of requests for their information.

Corporate transactions

Information may be disclosed or transferred as part of a merger, financing, acquisition, restructuring, insolvency, sale of assets or similar transaction.

Any personal information transferred remains subject to applicable privacy law.

MouthpieceAI is operated from Canada and is intended for users internationally.

Our service providers operate infrastructure in multiple jurisdictions. Your information may therefore be processed outside the country in which you live.

For example, Vercel states that its primary processing facilities are in the United States and provides contractual mechanisms addressing transfers from the EEA, UK and other jurisdictions. Stripe similarly provides international-transfer mechanisms including applicable Standard Contractual Clauses and UK transfer provisions.

Where required, we use recognized mechanisms intended to protect international transfers, which may include:

• adequacy decisions;
• Standard Contractual Clauses;
• UK transfer addenda or agreements;
• contractual safeguards; or
• other mechanisms recognized under applicable law.

Information processed in another country may be subject to lawful access by courts, law-enforcement bodies or governmental authorities in that jurisdiction.

The physical location of data depends on the services and infrastructure involved.

Our database and storage provider, Supabase, supports specific hosting regions, including Canada, the United States, EU member states, the United Kingdom, Switzerland, Singapore, Japan, South Korea, Australia, India and Brazil. The selected project region determines where the project's primary data is stored.

Regional hosting does not necessarily mean that every processing operation associated with MouthpieceAI occurs exclusively in that region.

AI generation, payment processing, security systems and other providers may involve processing in additional jurisdictions.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy or as required by law.

Retention periods vary according to the type of information and how it is used.

Account information

Generally retained while your account remains active and afterward where reasonably necessary for legal, security, fraud-prevention, accounting or dispute-resolution purposes.

User Content

Generally retained while you maintain the associated content, character, project or account, unless a feature clearly specifies a different retention period.

Reference images

Reference images may be retained where needed to maintain a character or provide requested functionality.

Deleting a character, reference image or account may trigger deletion of associated information from active MouthpieceAI systems, subject to technical, security and legal limitations.

Backups

Deleted information may remain temporarily in backups or disaster-recovery systems until those copies are overwritten through their normal lifecycle.

We do not promise an arbitrary "30-day" or "90-day" deletion period unless that period is actually implemented for the relevant system.

Privacy rights vary by jurisdiction.

Depending on where you live, you may have the right to:

• know whether we process your personal information;
• access personal information;
• obtain a copy of certain information;
• correct inaccurate information;
• request deletion;
• restrict certain processing;
• object to certain processing;
• withdraw consent;
• obtain portable data;
• opt out of certain sales, sharing or targeted advertising;
• limit certain uses of sensitive personal information;
• appeal certain privacy decisions; and
• complain to an applicable privacy regulator.

We will not unlawfully discriminate against you because you exercised a privacy right.

California law, for example, provides qualifying consumers with rights concerning access, deletion, sale/sharing opt-outs and non-discrimination.

To exercise a privacy right:

privacy@mouthpiece.ai

We may need to verify your identity before fulfilling a request.

Where permitted, an authorized agent may submit a request on your behalf, although we may require evidence of that authority.

If the GDPR applies to our processing of your personal data, you may have rights including:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• portability;
• withdrawal of consent; and
• lodging a complaint with a competent supervisory authority.

Where we rely on legitimate interests, you may request information about those interests and object to applicable processing.

Where legally required for our activities, we will maintain any required representative or Data Protection Officer information and make it available here or through our Privacy Center.

Where UK data-protection law applies, personal information will be processed in accordance with applicable UK requirements, including the UK GDPR and Data Protection Act 2018.

Applicable international transfers may use recognized UK transfer mechanisms.

You may also have the right to lodge a complaint with the UK's Information Commissioner's Office.

MouthpieceAI operates from Canada.

Canadian users may have rights under applicable federal or provincial privacy legislation concerning access, correction, consent and complaints.

Where sensitive or biometric information is processed, we apply consent and safeguarding requirements appropriate to its sensitivity and the applicable jurisdiction.

Canadian privacy guidance specifically emphasizes data minimization, limited retention and appropriate safeguards for biometric information.

Residents of certain U.S. states may have additional privacy rights.

Depending on applicable law, these can include rights to:

• access;
• know;
• correct;
• delete;
• obtain portable information;
• opt out of sale or sharing;
• opt out of certain targeted advertising or profiling;
• limit certain processing of sensitive information; and
• appeal the denial of a request.

Sale and sharing

MouthpieceAI does not sell personal information for money.

We also do not currently use personal information for cross-context behavioural advertising.

If our practices change in a manner that creates additional opt-out obligations, we will provide the required controls.

Where applicable, we will honor legally recognized browser-based opt-out preference signals, such as Global Privacy Control, for processing to which those signals legally apply.

AI generation necessarily involves automated processing.

However, generating an image, video or character at your request is different from making a consequential automated decision about you.

MouthpieceAI does not currently use automated systems to make decisions producing legal or similarly significant effects concerning matters such as employment, credit, housing, insurance or access to essential services.

If we introduce such functionality, we will provide any disclosures and rights required by applicable law.

We use technical, administrative and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, loss and misuse.

These may include:

• encrypted network connections;
• authentication and authorization controls;
• restricted administrative access;
• database security controls;
• logging and monitoring;
• secure development practices;
• infrastructure protections; and
• incident-response procedures.

Our infrastructure providers also maintain their own security controls. For example, Vercel's current DPA specifies encryption of covered customer data at rest and TLS protection in transit.

No online service can guarantee absolute security.

If a security incident involving personal information occurs, we will investigate and provide notifications to affected individuals or regulators where required by law.

MouthpieceAI may use cookies, local storage and similar technologies for purposes such as:

• authentication;
• maintaining sessions;
• security;
• remembering settings;
• fraud and abuse prevention; and
• essential website functionality.

We do not currently use advertising cookies for behavioural advertising.

If we introduce non-essential analytics, advertising or tracking technologies, we will provide any notices, consent mechanisms and preference controls required by applicable law.

Users in jurisdictions requiring prior consent for non-essential technologies will be given appropriate choices before those technologies are activated.

We may send communications necessary to operate MouthpieceAI, including:

• account verification;
• password and security messages;
• purchase confirmations;
• credit or subscription information;
• important product notices;
• privacy or Terms updates; and
• service-related communications.

Where we send optional marketing communications, you may unsubscribe from them.

You may continue receiving necessary transactional, security or legal messages after unsubscribing from marketing.

MouthpieceAI is intended only for people 18 years of age or older.

You may not create an account if you are under 18.

We do not knowingly collect personal information from children through accounts intended for adults.

If we learn that a person under 18 has provided personal information contrary to this requirement, we will take reasonable steps to investigate and delete it where appropriate.

If you believe a minor has provided personal information to MouthpieceAI, contact:

privacy@mouthpiece.ai

MouthpieceAI may contain links to or integrations with third-party services.

Where another organization independently determines how it processes information, that organization's privacy policy governs its processing.

This Privacy Policy does not control the independent privacy practices of third parties.

Organizations may use MouthpieceAI on behalf of employees, clients or other users.

Where MouthpieceAI processes personal information solely on the instructions of a business customer, the business customer may be the controller, business or organization primarily responsible for that information under applicable privacy law.

In those circumstances, privacy requests concerning information controlled by that organization may need to be directed to the organization itself.

Technology changes. Laws change. MouthpieceAI will too.

We may update this Privacy Policy to reflect changes to the Service, our providers, our processing activities or applicable law.

When we make changes, we will update the Last updated date.

For material changes, we may also provide notice through MouthpieceAI, by email, or by another appropriate method.

Where applicable law requires consent before a new processing activity begins, updating this document alone will not substitute for obtaining that consent.