Privacy Policy

WOOX helps brands generate ad-ready images, video, and audio. To do that, we process information you give us, content you create, data from sources you choose to connect, and records generated as you use the service.

This policy covers the WOOX platform at woox.art, including the marketing site and the app. It does not cover:

• Third-party services you connect (such as a Shopify store or an ad account) or the AI model providers we route work through. Those services process data under their own privacy policies; Section 5 describes the categories of providers we use.
• Your customers’ data, as between you and your customers. If you connect data about your own customers (for example, store reviews), you remain responsible for it as its controller; WOOX processes it on your instructions to provide the service.

WOOX operates from the United States and offers the service to business users in the United States. Section 8 describes where data is processed, and Section 11 describes the rights we honor for every user, regardless of location.

Account and sign-in. Sign-in is handled by our dedicated authentication provider. When you create an account we receive your name, email address, and authentication details, whether you sign in with Google or with an email and password. We never receive your Google password.

Workspace and brand data. We collect your workspace details (name, members, and their roles), the brand kit you choose to add (brand colors, voice rules, personas, reference images), and your workspace settings, including your spend cap and billing preferences.

Content you provide. We process the prompts and settings you enter and the reference images and files you upload. Uploads can contain personal information — for example, the face or voice of a real person. You are responsible for having the rights and consents for what you upload, as described in the Terms, and Section 11 describes the commitments we make about content that depicts real people.

Generated content. We store the images, video, audio, and text WOOX generates for you (your “Outputs”) in your workspace library.

Connected data sources. If you connect a data source — Shopify (products, product images, store reviews) or the ad platforms Meta and TikTok (ad performance) — we receive data from it to ground your generations. Connections are optional, launch in phases, and are controlled from your workspace. We store the connection credentials in encrypted form, scoped to your workspace. Connected platforms are data sources, not ways to sign in.

Usage and billing. We keep records of the jobs you run (model, settings, status, and price), your prepaid balance and its transactions, and your spend against your cap. Payments are processed by our payment processor. Card details are collected by the processor in an embedded frame served from its own domain, so full card numbers never touch our servers; we receive billing metadata such as a customer identifier, card brand and last four digits, and charge status. Our payment processor is a PCI DSS Level 1 certified service provider.

Device and log data. Like most services, we receive standard request data — IP address, browser type, and pages requested — in our hosting and security logs, and we collect error reports through our monitoring tools. Error reports are scrubbed to exclude your content and personal identifiers before they are stored.

Support and communications. If you write to us (for example at hello@woox.art or legal@woox.art), we keep the correspondence so we can respond and improve support.

Analytics. We use a privacy-focused analytics service on our public marketing pages — not inside the app — in cookieless mode, described precisely in Section 12.

We use the information above to:

• Provide the service — run your generations, return Outputs to your workspace, and operate the WOOX assistant;
• Run your workspace — authenticate you, manage members and roles, and ground generation in your connected data and brand kit;
• Keep the service safe — detect and prevent fraud, abuse, and security incidents, and enforce our Terms and acceptable-use rules;
• Bill you — price each job, draw completed work against your prepaid balance, apply your spend cap, and process payments through our payment processor;
• Support you — answer questions and troubleshoot;
• Improve the product — understand how features are used, diagnose problems, and make WOOX better;
• Meet legal obligations — comply with law and respond to lawful requests.

When you generate content or use the WOOX assistant, the content needed for that job — your prompt, settings, any reference uploads, and the brand or catalog context involved — is transmitted to the AI providers that perform the work, and the result is returned to your workspace.

We send the content of the job, not your identity. Provider requests do not include your name, email address, or WOOX account identifiers.

What our providers may do with job content, by capability:

• Image and video generation — our generation provider processes generation content in its data centers in Southeast Asia. Under its data-processing terms, it processes customer content solely on our instructions and does not use it to train models or pass it to third parties without authorization — authorization we do not give.
• The WOOX assistant and language features — powered by a leading language-model provider whose commercial terms prohibit training its models on API content. It deletes API inputs and outputs from its systems within about 30 days in the ordinary course; content its safety systems flag can be retained longer — up to about two years, with safety-classification metadata kept longer — for trust-and-safety purposes.
• Additional curated models — hosted by a provider that processes job content to provide the service and runs its own content-safety scanning; its standard terms also permit it to use de-identified, aggregated usage data, which may be derived from customer content, to improve its services and models. It operates from the United States.
• Speech and voiceover — engaged when voice generation launches on WOOX. The standard terms of speech-model providers can permit training on submitted content by default; before voice generation launches on WOOX, we will either secure terms that turn that off for WOOX traffic or update this disclosure to say exactly what applies.

Each provider processes content under its own terms and policies, listed in Section 5. Providers apply their own trust-and-safety scanning to submitted content; that scanning, not WOOX, is the enforcement point for content rules at generation time. Provider retention varies by provider and purpose and is governed by their published terms, as described above. We grant no provider any license to your content beyond what fulfilling your requests requires; where a provider’s own standard terms reserve additional limited uses, we say so in the descriptions above.

Outputs from generative models can be inaccurate, and different customers can receive similar outputs. Generated media may contain, or may lack, embedded provenance metadata or watermarks depending on the underlying model; WOOX does not currently add or certify provenance marks. Your responsibilities for reviewing and using Outputs are in the Terms.

We use the providers below to operate WOOX. Each processes data on our behalf for the stated purpose. We require sub-processors to protect data consistent with this policy and applicable law.

When this list changes: this page is the public record of our sub-processors. When we add or replace a sub-processor in a way that materially changes how your data is processed, we update this list and the “Last updated” date, and we notify workspace owners by email before the change takes effect.

Shopify, Meta, and TikTok are data sources you connect, acting on your instructions — they are not our sub-processors, and connecting them never signs you in to WOOX.

For Shopify specifically, from the moment store connections are available we honor the three mandatory Shopify privacy webhooks, so your store and your store’s customers can exercise their rights:

• Customer data requests — if a shopper asks your store for their data, Shopify forwards the request to us and we return any data we hold tied to that customer. In practice this is minimal: WOOX works with products, product images, and reviews, not individual shopper records.
• Customer redaction — we delete any data we hold tied to a specific customer identifier.
• Store redaction — about 48 hours after your store disconnects WOOX, Shopify sends the store-redaction signal and we delete the cached product and review data tied to that store and revoke its stored credentials. Outputs you generated remain yours in your workspace and follow the ordinary retention rules in Section 9.

As the merchant, you remain the controller of your customers’ data; WOOX processes connected data on your instructions as your processor.

We share personal information only as described here:

• Sub-processors — the providers in Section 5, to operate the service on our behalf;
• Legal and safety — when required by law or legal process, or to protect the rights, safety, and security of WOOX, our users, or the public, and to enforce our Terms;
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this policy or give you notice of any material change.

WOOX operates from the United States. Your data is processed in the United States and in the countries where our providers operate: generation content is processed by our generation provider in Southeast Asia as described in Section 4, our analytics are hosted in the European Union, and our other providers process primarily in the United States. Each provider’s own terms, listed in Section 5, describe its safeguards, and we require our providers to protect data consistent with this policy and applicable law.

If you use WOOX from outside the United States, you understand that your information will be transferred to and processed in the locations above. The rights in Section 11 are available to you wherever you are.

We may remove abandoned or unsaved artifacts from working storage as part of routine housekeeping. When your account or workspace closes, you may request an export of your data for up to 30 days (Section 11); after that we delete or de-identify it in the ordinary course of our systems, except where we must keep specific records to meet legal obligations.

We protect data with reasonable administrative, technical, and physical safeguards, including:

• Encryption in transit across the service, and encryption at rest for connection credentials, with stored write-credentials revoked when you disconnect an integration;
• Strict workspace isolation — one workspace cannot read another’s data, strictly enforced and continuously verified;
• Role-scoped access inside workspaces and for our own team;
• Private media delivery — generated media is stored privately and served through signed, expiring links; it is never public;
• Clean telemetry — our logs and analytics are engineered to exclude your content and to avoid persistent personal identifiers, and our error monitoring scrubs reports before they are stored.

No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security. If a breach affects your data, we will notify you and the authorities as required by law.

We honor these requests from every user, regardless of location, as a term of our service:

• Access — receive a copy of the personal information we hold about you;
• Correction — fix inaccurate information;
• Deletion — have your personal information and content deleted;
• Export — receive your workspace data in a portable form, including for up to 30 days after your account or workspace closes.

We provide these rights as commitments to our users everywhere. Honoring them is voluntary with respect to the laws of jurisdictions where we do not operate or offer the service, and is not an acknowledgment that any particular jurisdiction’s law applies to us.

How to exercise them: email legal@woox.art from the address on your account, or include enough information for us to verify it is you; you may use an authorized agent where the law allows. We confirm receipt, verify the request, and respond within 30 days in the ordinary course, or within the time a shorter legal deadline requires. If we decline a request, we explain why, and you can appeal by replying “Appeal” — a different reviewer will look at it and respond.

Content that depicts real people. Reference uploads can include a real person’s face or voice. Our commitments:

• We do not use your content to identify anyone. We do not perform facial or voice recognition, we do not create or retain biometric templates or identifying profiles from content, and we never sell, lease, or trade biometric information.
• We do not draw health inferences from your content.
• Content depicting real people follows the shortened retention schedule in Section 9, and we maintain a security-incident response process covering it.
• You must have the depicted person’s documented written consent before uploading their likeness or voice — the Terms make this a condition of using WOOX, and the product will ask you to confirm it.

California disclosures. We respond to requests as described above, notify you of material changes as described in Section 14, and state our tracking positions in Section 12, including our response to Do Not Track signals. Third parties do not collect personal information about your activity over time and across different websites through WOOX, with one narrow exception: our payment processor collects device signals on payment surfaces for fraud prevention, which it may also do across other sites that use the same processor.

Storage WOOX uses on your device (cookies and similar storage). We keep first-party storage minimal and functional:

Payments. On payment surfaces, our payment processor sets cookies and collects device signals for payment-fraud prevention, under its own policies.

Analytics — cookieless by default, marketing pages only. We use a privacy-focused analytics service, hosted in the European Union, in cookieless mode, and only on our public marketing pages — analytics never runs inside the app. Unless you accept analytics through the consent banner, it stores nothing on your device and uses no persistent identifiers: visits are counted with a short-lived anonymous technique, with no personal identifiers, no advertising profiles, no autocapture, and Do Not Track honored. If you accept, analytics may additionally use first-party browser storage (never third-party cookies) so your sessions can be understood across visits.

Session replays. Around launches we may use session replays to see where pages confuse people. A replay runs only with your consent, given through the banner or the “Cookie settings” link in the footer, with form inputs masked. Rejecting or withdrawing consent stops replays immediately.

Managing your choice. On your first visit we show a consent banner with Accept and Reject presented with equal weight. Your choice is remembered on your device, and you can change it at any time with the “Cookie settings” link in the footer. You can also control cookies in your browser settings.

Do Not Track and opt-out signals. We do not track you across other websites and we do not sell or share personal information, so there is nothing for opt-out-preference signals to switch off; our analytics additionally honors Do Not Track. Deletion is available to everyone on request (Section 11).

WOOX is a business tool for adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us information, contact legal@woox.art and we will delete it and close the account.

We may update this policy as the product and our providers evolve. When we make a material change, we update the “Last updated” date, give notice — by email to workspace owners or a notice in the product or on the site — before the change takes effect, and record a new version. The version you accepted is stamped in our records when you create a workspace.

Privacy questions and requests: legal@woox.art. General questions: hello@woox.art. Postal mail is available at the notice address in our Terms of Service.