Privacy Policy

Introduction

This Privacy Policy explains how OCboard ("OCboard", "we", "us", or "our") collects, uses, shares, and protects your information when you use our website and AI-powered anime original character ("OC") generation service (the "Service"). OCboard is operated by an individual sole proprietor trading under the name "OCboard," who is the data controller responsible for your personal data. You can reach the operator at support@ocboard.app.

OCboard lets you turn structured character descriptions into full-body anime-style original character illustrations. We are committed to handling your personal data responsibly and in line with applicable data protection laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) where they apply to you.

By using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

Information We Collect

We collect the following categories of information.

Account Information

Sign-in details: When you sign in with Google (or another supported provider), we receive your name, email address, and profile image associated with that account.
Profile settings: Optional preferences you set, including your content-tier (styling) settings.
Age confirmation: if you access the 18+ ("Untamed") styling tier, we store the fact that you confirmed you are 18 or older.

Content and Generation Data

Generation inputs: The character details you enter — concept text, traits, outfit, style preset, pose, camera, background, and any free-text or edited prompts you provide.
Generated images: The OC illustrations you create, together with technical metadata such as the model used, generation parameters, content tier, and the result of automated content-moderation checks.
Generation history: A record of your generations so you can revisit, copy prompts, and reuse previous results.

Payment Information

Billing details: When you purchase credits, payments are processed by our Merchant of Record, Creem. We receive confirmation of your transaction and limited billing metadata, but we do not collect or store your full payment-card numbers.

Device and Usage Information

Technical data: IP address, browser type, device, language, session identifiers, device or visitor identifiers, and similar diagnostic information. For some free-quota and rate-limit checks, we use a one-way hash of your IP address where available. Other authentication, security, abuse-prevention, infrastructure, and logging systems may process or retain raw IP addresses for limited operational and security purposes. We also derive an approximate location (such as your country) from your IP address to apply the correct privacy-consent settings for your region and to help secure the Service.
Usage analytics and attribution: Pages viewed, features used, product events, referral source, UTM parameters, landing page, and similar usage-level data, collected through our analytics and attribution systems to help us understand and improve the Service.
Cookies and similar technologies: See our Cookie Policy for details.

How We Use Your Information

We use your information to:

Provide, operate, and maintain the Service, including generating and storing your OC images.
Authenticate you, manage your account, and remember your preferences.
Process purchases of credits and prevent payment fraud.
Apply usage limits and free-tier quotas, and prevent abuse, spam, and automated misuse.
Run automated content-moderation checks on generated images to enforce our content rules and legal obligations.
Screen generation prompts through the Creem Content Moderation API before they reach a model.
Analyze usage to debug, improve, and develop new features, where permitted and with consent where required.
Communicate with you about your account, transactions, security, and support requests.
Comply with legal obligations and enforce our Terms of Service.

Our legal bases for processing (where GDPR applies) include performance of our contract with you, our legitimate interests in operating, securing, and improving the Service, compliance with legal obligations, and your consent where required or where we ask for it (for example, optional analytics or similar technologies).

Some of these processes are automated. In particular, our moderation systems can automatically block a generation or, in cases of serious or repeated violations, suspend an account, without human involvement. If you believe an automated decision about you was made in error, you can contact us at support@ocboard.app to request human review.

We do not sell your personal data, and we do not share it for cross-context behavioral advertising. We share information with the providers below that help us run the Service, and where required by law. Most act as our service providers (processors) on our instructions; some — including Creem (payments) and Google (sign-in) — act as independent controllers for their own part of the processing, under their own privacy policies.

Cloud storage (Cloudflare R2): hosting of generated images and assets.
Hosting and database providers: running our application and storing account and generation records.
AI model providers (accessed through our AI gateway): generating images from your prompts. Prompts and the resulting images are sent to these providers to produce your output.
Content moderation (Creem Content Moderation API; and Hive / TheHive.ai for image review): screening of your generation prompts and automated review of generated images to detect prohibited content.
Authentication (Google): sign-in.
Payments (Creem, our Merchant of Record): selling and processing credit purchases; Creem acts as an independent controller for the payment data it handles.
Analytics (PostHog): product usage analytics, where enabled.
Email delivery: transactional and account-related messages.

We may also disclose information if required by law, to respond to lawful requests, to protect our rights, safety, and property or those of others, or in connection with a merger, acquisition, or sale of assets.

Data Retention

Generated images and generation history are retained while your account is active so you can access them, and are deleted when you delete them or close your account. Residual copies in encrypted backups are overwritten on a rolling cycle, typically within 30–90 days.
Account records are retained for as long as your account exists and, after closure, for up to 24 months as needed for legal, tax, accounting, and dispute-resolution purposes.
Moderation, security, session, and abuse-prevention logs are typically retained for up to 12 months (longer only where needed for an ongoing investigation or to meet a legal obligation), to investigate abuse, maintain service integrity, and meet legal obligations.

Data Security

We use technical and organizational safeguards — including encryption in transit, access controls, and hashing or pseudonymization of certain identifiers where appropriate — to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

International Data Transfers

Your information may be processed in countries other than the one in which you live. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for international transfers of personal data.

Your Rights and Choices

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, to object to certain processing, and to withdraw consent where processing is based on consent. You can manage much of your data directly in your account, and you can contact us to exercise any of these rights. You also have the right to lodge a complaint with your local data protection authority.

We aim to respond to verified requests within the time required by applicable law (for example, within 45 days under the CCPA/CPRA, extendable where permitted), and we will not discriminate against you for exercising your rights.

California residents (CCPA/CPRA). You have the right to know what personal information we collect and how we use and disclose it, to request access, correction, and deletion, and to opt out of the "sale" or "sharing" of personal information. We do not sell your personal information and do not share it for cross-context behavioral advertising, and we honor Global Privacy Control (GPC) signals where required.

Automated decisions. Where our automated moderation makes a decision that significantly affects you (such as blocking content or suspending an account), you can contact us to request human review.

Children's Privacy

The Service is not directed to children. You must be at least 13 years old, or older if your country sets a higher minimum age for using online services or for consenting to the processing of personal data (for example, 16 in much of the EU/EEA). Where we rely on consent, we require the minimum age applicable in your country. We do not knowingly collect personal data from children under the applicable minimum age. If you believe a child has provided us personal data, please contact us and we will delete it. We have a strict zero-tolerance policy against any sexualized content involving minors; see our Terms of Service.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Contact Us

If you have questions or requests regarding this Privacy Policy or your personal data, contact us at support@ocboard.app.