Privacy Policy

Effective date: 23 June 2026 · Version 2.2

This Privacy Policy explains how we process personal data when you use Interstitial AI. We have written it to satisfy Articles 13 and 14 of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and applicable German data-protection law.

The policy is long because the Service depends on a number of subprocessors, and we want you to know who handles your data and where. If you only have time to read one section, read Section 4.

1. Controller

The controller for the processing described in this policy is:

Interstitial AI GbR Fraunhoferstraße 39, 80469 Munich, Germany Email: support@interstitial-ai.com Phone: +49 178 5398360

Represented by Linus Grimminger, Hans Onneken, and Jacob Piazolo.

We have not appointed a Data Protection Officer because we are not required to under § 38 BDSG. For data-protection enquiries please write to support@interstitial-ai.com.

The supervisory authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany. You can lodge a complaint with the BayLDA at any time.

2. Purposes and legal bases

We process personal data only for the purposes set out below, on the legal basis set out next to each one.

2.1 Operating your account

We process your email address, password hash, name, language preference, and account metadata to register you, log you in, allow multi-factor authentication, and let you manage your account.

Legal basis: Article 6(1)(b) GDPR (performance of the contract with you).

2.2 Providing the Service

We process the Inputs you submit (images, prompts, CAD and BIM files, scenes, layers, masks, project metadata) and the Outputs we produce, to operate the editor and the generation pipelines you request.

Legal basis: Article 6(1)(b) GDPR.

2.3 Billing and tax records

We process your billing details (handled by Stripe, see Section 4), subscription status, payment history, and invoice data to bill you and to comply with our legal record-keeping duties.

Legal basis: Article 6(1)(b) GDPR for billing; Article 6(1)(c) GDPR in conjunction with § 257 HGB and § 147 AO for the retention of invoice records.

2.4 Fraud prevention and abuse detection

At signup, and at certain risk-relevant moments, we process device fingerprint signals (via FingerprintJS), an IP-derived country code (via the local geoip-country library), CAPTCHA tokens (via Cloudflare Turnstile), the user-agent string, and a one-way hash of the phone number you provide to detect duplicate-account attempts and known fraud patterns.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is in protecting the Service, our users, and our model providers against abuse, account farming, payment fraud, and platform manipulation. We have carried out a balancing test and concluded that the processing is proportionate: the signals collected are limited to what is needed for fraud detection, the data is hashed where possible, and the impact on you is the possibility of being asked to verify in additional ways.

You can object to this processing under Section 6.6 below.

2.5 Service security and integrity

We process error traces (via Sentry), authentication tokens, and rate-limiting metadata to keep the Service secure, reliable, and available.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is in maintaining the security and reliability of the Service.

2.6 Sending transactional and marketing email

We send transactional email (verification codes, password resets, billing notifications, account changes, organisation invitations) on the basis of Article 6(1)(b) GDPR.

If you opted in to the newsletter at signup or in your settings, we send marketing email on the basis of your consent under Article 6(1)(a) GDPR. You can withdraw consent at any time, with effect for the future, by clicking the unsubscribe link in any marketing email or by writing to support@interstitial-ai.com.

2.7 Defending legal claims

Where claims are brought against us or by us, we may process personal data necessary to establish, exercise, or defend those claims.

Legal basis: Article 6(1)(f) GDPR; Article 6(1)(c) GDPR where statutory retention periods apply.

2.8 Domain authorisation for organisation invites

If you accept an invitation to a Studio (organisation account), we process the email-domain match between your account and the Studio domain.

Legal basis: Article 6(1)(b) GDPR.

2.9 Public cancellation flow under § 312k BGB

To operate the public cancellation page at interstitial-ai.com/cancel, we process the email address you submit, the optional name, the cancellation type and grounds (where applicable), the desired termination date you pick, and a one-time hashed magic-link token bound to your submission. We use those data to verify the submission, look up the matching account, and execute the cancellation against Stripe.

Legal basis: Article 6(1)(b) GDPR (necessary to perform the contract with you, because the public cancel-button is the channel through which you exercise the cancellation right we owe you under § 312k BGB).

3. Categories of personal data we collect

We do not knowingly collect special categories of personal data within the meaning of Article 9 GDPR. You must not upload such data through the Service unless this is strictly necessary and lawful for your processing. The segmentation and people-render features merely depict or generate persons; they do not perform biometric identification within the meaning of Article 4(14) GDPR.

4. Recipients and subprocessors

We use the subprocessors below to operate the Service. Each one acts under a written processor agreement with us (or a customer DPA we accept by default), and each one is bound to our instructions.

4.1 AI model providers

For models that originate from entities outside the European Economic Area, we name the originating entity and country in the model picker via an information notice. The processing on the inference side runs at the subprocessor named above, not at the originating entity. Specifically:

• Seedream 4, Seedream 4.5, and Seedance 2.0 were developed by ByteDance (Cayman Islands / People’s Republic of China). Inference on Replicate runs at Replicate’s infrastructure in the United States. We have no contractual visibility into whether ByteDance receives inference logs from Replicate.
• Kling v2.5 Turbo Pro and Kling v3 were developed by Kuaishou Technology (Cayman Islands / People’s Republic of China). The same inference-routing applies via Replicate.
• FLUX.2 (Pro / Dev / Klein / Max) was developed by Black Forest Labs GmbH (Freiburg, Germany), with onward operations at Black Forest Labs Inc. (USA). Inference on Replicate runs at Replicate’s infrastructure in the United States.
• Runway Gen-4 Turbo was developed by Runway AI, Inc. (USA). Inference on Replicate runs at Replicate’s infrastructure in the United States.
• Meta SAM 2 segmentation was developed by Meta Platforms, Inc. (USA). Inference on Replicate runs at Replicate’s infrastructure in the United States.

For World Labs, we have activated the available opt-out for our account so that your Inputs are not used for the provider’s own training purposes. Should a provider nonetheless use Inputs for its own purposes, it would in that respect act as an independent controller (Article 28(10) GDPR); our arrangement is designed for this case.

4.2 Hosting and storage

The Firebase Auth point matters: even though most of our user data sits in EU regions, the authentication layer is operated by Google in the United States. The operator is Google LLC, which is certified under the EU-US Data Privacy Framework; this transfer is therefore based primarily on adequacy decision (EU) 2023/1795 (Article 45 GDPR), backed by the Google Cloud Data Processing Addendum, with the Standard Contractual Clauses running as a fallback should the Data Privacy Framework be annulled (an appeal against the adequacy decision is currently pending before the CJEU, C-703/25 P).

4.3 Communications

4.4 Payments

4.5 Fraud and abuse prevention

For fraud prevention we compute a device fingerprint directly in your browser at signup; only the resulting hash is transmitted to us. It is not shared with any third party.

The IP-to-country lookup at the backend uses the open-source geoip-country library running locally on our Cloud Functions; no IP data leaves our infrastructure for that purpose.

4.6 Error tracking

4.7 Are.na references

When you open the Are.na panel in the editor, the editor calls our backend, which proxies search and read calls to the Are.na API on our behalf using a single shared application token. Your personal data, including your email and Firebase UID, is not transmitted to Are.na as part of this flow.

4.8 Government bodies and law enforcement

We disclose personal data to government bodies, courts, or law enforcement only where we are legally required to do so or where disclosure is necessary to protect our legitimate interests, the legitimate interests of others, or the safety of a person.

5. International transfers

Where a recipient processes data outside the European Economic Area (EEA), we base the transfer — depending on the provider — on one of the following mechanisms:

• the EU-US Data Privacy Framework (adequacy decision (EU) 2023/1795, Article 45 GDPR) for the following certified US recipients: Google LLC (including Firebase Authentication, the US portions of Cloud Logging, and any US Vertex AI fallbacks), Stripe, Inc., Cloudflare, Inc., Functional Software, Inc. (Sentry), and Plus Five Five, Inc. (Resend). Their DPF certification can be verified on the official list at dataprivacyframework.gov.
• the European Commission’s Standard Contractual Clauses (implementing decision (EU) 2021/914, Article 46(2)(c) GDPR), supplemented by a Transfer Impact Assessment (TIA) and additional safeguards for the US recipients not certified under the Data Privacy Framework: Replicate, LLC, OpenAI, L.L.C., and World Labs, Inc. Where we act as a processor for a business customer, we use Module 3 (processor-to-processor) of the Clauses; where we are ourselves the controller (consumer accounts), Module 2 (controller-to-processor).
• in rare, non-recurring individual cases only, and only where neither an adequacy decision nor Standard Contractual Clauses are exceptionally available, we base a transfer on your explicit consent under Article 49(1)(a) GDPR. This derogation is not a standing mechanism for ongoing operations.

The adequacy decision on the EU-US Data Privacy Framework was upheld by the General Court of the European Union by judgment of 3 September 2025 (T-553/23); an appeal against it is pending before the Court of Justice of the European Union (C-703/25 P). Should the Data Privacy Framework be annulled, we will base the affected transfers on the Standard Contractual Clauses together with a Transfer Impact Assessment as a fallback.

Section 4 states the applicable transfer mechanism for each provider.

For the ByteDance and Kuaishou models accessed via Replicate, the actual inference processing runs at Replicate’s United States infrastructure under Standard Contractual Clauses. The model originated from an entity in the People’s Republic of China, but the processing on which our access depends does not run on that entity’s systems based on Replicate’s published architecture. Where you would like to avoid this routing entirely, you can choose a different model in the model picker.

6. Your rights

You have the rights set out in Articles 15 to 22 GDPR.

6.1 Right of access (Article 15)

You can ask us to confirm whether we process personal data about you and to provide a copy of the data, together with the information set out in Article 15(1) and (2).

6.2 Right to rectification (Article 16)

You can ask us to correct inaccurate data and to complete incomplete data.

6.3 Right to erasure (Article 17)

You can ask us to delete your personal data where one of the grounds in Article 17(1) applies. You can also delete your account at any time from your account settings or by emailing support@interstitial-ai.com. Deletion is subject to retention obligations under Section 7.

6.4 Right to restriction (Article 18)

You can ask us to restrict processing of your data in the cases listed in Article 18(1), for example while we verify the accuracy of data after a rectification request.

6.5 Right to data portability (Article 20)

For data you provided to us and which we process by automated means on the basis of your consent or for the performance of a contract, you can ask us to provide it to you, or directly to another controller where technically feasible, in a structured, commonly used, machine-readable format.

On request, we export your data in a structured, commonly used, machine-readable format and support a switch to another provider; we do not charge a fee for this.

6.6 Right to object (Article 21)

For processing based on Article 6(1)(f), including the fraud-prevention processing in Section 2.4, you can object on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless the processing is needed to establish, exercise, or defend legal claims.

You can object at any time, free of charge, to processing for direct marketing purposes (the newsletter).

6.7 Right to withdraw consent (Article 7(3))

Where processing is based on consent, you can withdraw the consent at any time with effect for the future. The lawfulness of processing before the withdrawal is not affected.

6.8 Right to lodge a complaint (Article 77)

You can lodge a complaint with the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement. The supervisory authority for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 27, 91522 Ansbach, Germany.

6.9 How to exercise your rights

Email support@interstitial-ai.com. Where we have reasonable doubts about your identity, we may ask for additional information to verify it. We respond within one month, with the option to extend that period by two further months for complex requests under Article 12(3) GDPR.

7. Retention

We keep personal data only for as long as we need it for the purpose for which we collected it, or as long as the law requires us to. The table below lists the main categories.

After the retention period we delete or anonymise the data, unless we need to keep it longer to defend legal claims, in which case we restrict further processing under Article 18(1)(c).

8. Mandatory and voluntary data

To use the Service, you need to provide an email address, a password, and the data Stripe needs to take payment for paid Plans. The other fields in your profile are voluntary. If you do not provide the mandatory fields, we cannot register your account or take payment.

9. Automated decision-making (Article 22)

The signup and signin flow uses automated risk scoring based on the fraud signals listed in Section 2.4. The score combines the device fingerprint, the IP-derived country, the user-agent class, the phone-hash collision count, and the Turnstile token. Where the score crosses an internal threshold, signup is blocked.

The decision is automated within the meaning of Article 22(1) GDPR. We rely on Article 22(2)(a) GDPR: the decision is necessary for entering into the contract with you, because letting through known-fraudulent signups would harm the Service, other users, and our model providers.

We provide the safeguards required by Article 22(3) GDPR. You have the right to:

• request human intervention on the part of the controller;
• express your point of view; and
• contest the decision.

To exercise this right, email support@interstitial-ai.com with the email address you tried to register, the date and time of the attempt, and any context you would like us to consider. We respond as a rule within five business days, and in any event within the period set by Article 12(3) GDPR.

On request, we will also explain the factors decisive in your specific case, to the extent that no overriding rights of third parties or compelling security interests stand in the way. In particular, we cannot disclose the exact thresholds, weightings, and the precise operation of our fraud detection, because this would enable its circumvention; we will, however, inform you of the nature of the relevant data and the underlying logic.

9a. Use of artificial intelligence and labelling of generated content

The core of the Service is the automated processing of your Inputs (images, prompts, CAD/BIM data) by AI models to produce the Outputs you request. This processing is based on Article 6(1)(b) GDPR (performance of the contract) and does not constitute an automated decision with legal effect within the meaning of Article 22 GDPR; the fraud detection described in Section 9 is to be distinguished from it.

To the extent that we make generative AI features available under our own name, we are, with respect to those features, both a provider and a deployer of an AI system within the meaning of Regulation (EU) 2024/1689 (AI Act). The transparency and marking obligations of Article 50 of the AI Act apply from 2 August 2026. We mark the synthetic image and video outputs generated by our system, as far as technically feasible according to the relevant state of the art, in a machine-readable format as artificially generated or manipulated. Where you publish AI-generated content, you may, as a deployer, be subject to your own disclosure obligations (in particular for deepfakes under Article 50(4) of the AI Act); the applicable requirements are described in more detail in our Acceptable Use Policy (AUP).

10. Cookies and similar storage on your device

The Service stores small amounts of information on your device. The table below lists each storage event, what it is for, and the legal basis under § 25 TDDDG and the GDPR.

We do not use cookies or similar storage for analytics, marketing, advertising, or social media tracking. If we add any of those, we will introduce a TDDDG-compliant consent banner first.

11. Where we receive personal data from sources other than you

Some of the data we process about you we receive from sources other than you:

• Stripe sends us payment confirmations, subscription status updates, and invoice data via webhooks.
• Twilio returns the result of SMS verification and the number-type check.
• Cloudflare Turnstile returns the validation token result.
• Are.na returns public block and channel data when you query it through the editor; this data is about Are.na’s own users, not about you.
• Organisation owners may supply your email when they invite you to a Studio.

In each case we receive only the data we need for the purpose described above and we delete it on the schedule in Section 7.

12. Security (Article 32)

We protect personal data with appropriate technical and organisational measures, including:

• TLS encryption in transit;
• Encryption at rest in Cloudflare R2 and Firestore;
• Secrets stored in Google Cloud Secret Manager rather than in source control;
• Multi-factor authentication available on accounts;
• Role-based access controls within the team;
• Logging and alerting for security-relevant events;
• Periodic dependency upgrades and security review of third-party libraries.

13. Children

The Service is not intended for users under the age of 18. We do not knowingly collect personal data from anyone under 18. If you become aware that a minor has used the Service, please tell us at support@interstitial-ai.com and we will delete the data.

14. Changes to this Policy

We may update this Policy when our subprocessors change, when our processing changes, or when the law changes. The header carries a version number and an effective date. We notify you of material changes through the application or by email. The version of the Policy that applies at any given time is the version with the latest effective date that you have been able to access through the application.

Governing language version. This Policy is provided in German and English. In the event of any discrepancy or question of interpretation, the German version prevails; the English version is provided for your information only and is not binding. Mandatory consumer-protection provisions and other mandatory law applying in your favour remain unaffected.

15. Contact

For all matters covered in this Policy, write to support@interstitial-ai.com or to the postal address in Section 1.