Privacy Policy
Effective April 3, 2026
This Privacy Policy explains how Kvasir Media ("Company," "we," "us," or "our") collects, uses, stores, and shares information about you when you use Fornace Studio ("Service"). By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.
Privacy at a Glance
Data collected:
Account info, payment data, uploaded images, generated content, prompts, and usage logs.
Data sold?:
No. We do not sell your personal data.
Third-party AI:
Image generation uses third-party AI providers; we do not control their data practices.
Payments:
Processed by Stripe; we do not store card numbers.
Your rights:
Access, correction, deletion, portability, and opt-out rights available.
GDPR / CCPA:
Covered — see Sections 10 and 11.
Contact:
1. Information We Collect
1.1 Information You Provide
We collect information you provide directly to us, including:
Account information:
your name, email address, username, and password when you register for an account.
Profile information:
any optional profile details you choose to provide.
User Content:
images, files, and other materials you upload to the Service for processing.
Prompts and instructions:
text prompts and generation parameters you submit to the Service.
Communications:
messages you send to us, including support requests and feedback.
1.2 Information Collected Automatically
When you use the Service, we automatically collect certain technical information, including:
Log data:
IP address, browser type, operating system, referring URLs, pages visited, and timestamps.
Device information:
device type, unique device identifiers, and browser settings.
Usage data:
features used, generation requests made, credit consumption, and session duration.
Cookies and similar technologies:
we use cookies and similar tracking technologies to maintain session state, remember your preferences, and improve the Service. You can control cookies through your browser settings, though disabling them may affect Service functionality.
1.3 Information from Third Parties
We may receive information about you from third-party services, such as:
Payment processors:
Stripe, Inc. provides us with transaction confirmation and limited payment metadata (e.g., last four digits of card, billing country). We do not receive or store full card numbers.
Authentication providers:
if you sign in using a third-party identity provider (such as Google), we receive basic profile information as permitted by that provider.
2. How We Use Your Information
We use the information we collect for the following purposes:
To provide and operate the Service, including processing your generation requests, managing your account, and delivering features.
To process payments and manage subscriptions and credit balances.
To verify your age and eligibility for age-restricted features.
To communicate with you, including sending transactional emails (account confirmations, billing receipts, security alerts) and, where you have opted in, promotional communications.
To detect, investigate, and prevent fraud, abuse, and violations of our Terms of Service.
To comply with legal obligations and respond to lawful requests from authorities.
To improve and develop the Service, including analyzing usage patterns and diagnosing technical issues.
To enforce our Terms of Service and other policies.
3. User Content and Generated Content
3.1 User-Uploaded Content
Images and files you upload to the Service are stored securely and used solely to provide the generation features you request. We do not use your uploaded images to train our own AI models. Uploaded content is retained for as long as your account is active or as needed to provide the Service, and is deleted upon account termination subject to our retention policies described in Section 7.
3.2 Generated Content and Prompts
Text prompts and generated outputs are logged for operational purposes, including quality assurance, safety monitoring, and abuse prevention. We may review flagged content manually where required for safety or legal compliance.
3.3 Third-Party AI Processing
Your User Content and prompts are transmitted to third-party AI inference providers to generate outputs. We do not control how those providers process or retain data. Their handling of data is governed by their own privacy policies. We encourage you to review those policies. We select providers that represent reasonable data protection standards, but we cannot guarantee the data practices of third parties.
4. How We Share Your Information
We do not sell your personal data. We may share your information in the following limited circumstances:
4.1 Service Providers
We share information with trusted third-party vendors who assist us in operating the Service, including:
Cloud infrastructure and storage providers (e.g., Supabase, Cloudflare)
AI inference providers for image generation
Payment processors (Stripe, Inc.)
Content delivery networks
Email and communication service providers
These providers are contractually restricted from using your data for any purpose other than providing services to us.
4.2 Legal Requirements
We may disclose your information if required to do so by law or in good-faith belief that such disclosure is necessary to: (a) comply with a legal obligation or valid legal process; (b) protect the rights or safety of our users, the public, or the Company; or (c) detect or prevent fraud or security incidents.
4.3 Business Transfers
If we are involved in a merger, acquisition, financing, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Service before your data is transferred and becomes subject to a different privacy policy.
4.4 With Your Consent
We may share your information for other purposes with your explicit consent.
5. Cookies and Tracking Technologies
We use cookies and similar technologies for the following purposes:
Essential cookies:
required for the Service to function, including session management and authentication.
Preference cookies:
remember your settings and preferences across sessions.
Analytics cookies:
help us understand how the Service is used. We use PostHog, a product analytics platform, to collect anonymized usage data such as page views, feature interactions, and session recordings. PostHog may process data on servers outside your home country. You can opt out of PostHog analytics at any time through your account settings or by using a browser-level opt-out. For more information, see
.
You can configure your browser to refuse cookies or alert you when cookies are being set. Disabling essential cookies may prevent the Service from functioning correctly.
6. Data Security
We implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, loss, or alteration. These measures include encryption in transit (TLS), encryption at rest, access controls, and security monitoring.
However, no method of transmission or storage is completely secure. We cannot guarantee absolute security of your data. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users as required by applicable law.
7. Data Retention
We retain your personal data for as long as your account is active and as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention practices:
Account information:
retained for the duration of your account and deleted within 30 days of account termination upon request.
User Content (uploaded images):
retained while your account is active and deleted upon account termination or upon your request.
Generated content and prompts:
retained for up to 12 months for safety and abuse monitoring purposes, after which they are deleted or anonymized.
Payment records:
retained for at least 7 years as required by applicable tax and financial regulations.
Log data:
retained for up to 90 days for security and operational purposes.
8. Children's Privacy
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a person under 18, we will take prompt steps to delete that data and terminate the associated account. If you believe we have collected data from a minor, please contact us at dev@kvasir.media
9. International Data Transfers
We are based in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. Data protection laws in those countries may differ from those in your home country.
For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on appropriate legal mechanisms for international transfers, including Standard Contractual Clauses (SCCs) where applicable, to ensure your data receives adequate protection.
10. Your Rights Under GDPR (EEA, UK, and Switzerland)
Kvasir Media is the data controller for personal data processed through the Service. If you are located in the EEA, United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) and applicable national law:
Right of access:
you may request a copy of the personal data we hold about you.
Right to rectification:
you may request that we correct inaccurate or incomplete data.
Right to erasure:
you may request deletion of your personal data, subject to certain legal exceptions.
Right to restriction:
you may request that we restrict the processing of your data in certain circumstances.
Right to data portability:
you may request your data in a structured, machine-readable format.
Right to object:
you may object to processing based on our legitimate interests or for direct marketing.
Right to withdraw consent:
where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Our legal bases for processing your personal data under GDPR Article 6 include: (a) performance of a contract — to provide and operate the Service; (b) compliance with a legal obligation — e.g., financial record-keeping; (c) legitimate interests — security, fraud prevention, abuse detection, and service improvement, where those interests are not overridden by your rights; and (d) consent — for analytics tracking and optional features where we have obtained your explicit agreement. For special category data, we rely on your explicit consent under Article 9(2)(a).
To exercise any of these rights, contact us at dev@kvasir.media. We will respond within one month as required by GDPR. In complex cases we may extend this by a further two months and will notify you of any extension. You also have the right to lodge a complaint with your local supervisory authority — in the EU this is your national data protection authority; in the UK, the Information Commissioner's Office (ICO) at https://ico.org.uk.
11. Your Rights Under CCPA (California Residents)
If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights:
Right to know:
you may request disclosure of the categories and specific pieces of personal information we have collected about you, and how it is used and shared.
Right to delete:
you may request deletion of your personal information, subject to certain exceptions.
Right to opt out of sale:
we do not sell your personal information. You do not need to opt out.
Right to non-discrimination:
we will not discriminate against you for exercising your CCPA rights.
To exercise your rights, submit a verifiable consumer request to dev@kvasir.media. We will respond within 45 days as required by law.
12. Third-Party Links and Services
The Service may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Service.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on the Service at least 14 days before the changes take effect. Your continued use of the Service after the effective date of the revised Policy constitutes your acceptance of the changes.
We encourage you to review this Policy periodically to stay informed about how we protect your data.
14. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
Kvasir Media Privacy inquiries: dev@kvasir.media Website: https://fornace.studio/privacy
© 2026 Kvasir Media. All rights reserved.