Privacy Policy

Mongol AI ("Mongol AI", "we", "us" or "our") operates the website mongolai.app and provides AI-assisted photo restoration and image generation services (together, the "Service"). This Policy applies to all personal information we process when you visit the website, create an account, purchase credits or otherwise use the Service.

By using the Service you acknowledge that you have read this Policy. If you do not agree with it, please do not use the Service. This Policy should be read together with our Terms of Service.

Account information

When you register with an email address and password, we collect your name, email address and a securely hashed version of your password. We never store passwords in readable form.

Information received from third-party sign-in providers

If you choose to sign in with Google or Facebook, the provider shares with us, with your consent, the following information only:

• your name;
• your email address;
• your profile picture; and
• a unique account identifier issued by the provider.

We do not receive your Google or Facebook password, your friends or contacts list, or your posts, and we do not publish anything to your account.

Images and content you submit

We collect the photographs you upload, the text instructions you provide, and the images generated for you by the Service.

Payment information

Payments are processed by QPay. We receive the invoice identifier, amount, status and time of each transaction. We do not receive or store your bank card or bank account details.

Technical and usage information

We automatically collect limited technical information, including IP address, browser and device type, language preference, pages viewed, and server logs required to operate and secure the Service.

We use personal information only for the following purposes:

• to create, authenticate and maintain your account;
• to provide the Service, including processing the images you submit and delivering the results to you;
• to process payments, maintain credit balances and issue refunds;
• to respond to enquiries and provide customer support;
• to monitor, secure and improve the Service, and to prevent fraud and abuse; and
• to comply with applicable legal, tax and accounting obligations.

We do not use your personal information for automated decision-making that produces legal effects, and we do not sell your personal information.

To generate results, the images and instructions you submit are transmitted to the application programming interface of our AI provider, OpenAI, L.L.C. Processing is fully automated. Our personnel do not review your images except where necessary to investigate a support request you have raised, a suspected violation of our Terms of Service, or a legal obligation.

We do not use your images to train our own models, for marketing, or for any purpose other than providing the Service to you. Under OpenAI's API terms in force at the effective date of this Policy, content submitted through the API is not used to train OpenAI's models by default.

Information we obtain through Facebook Login or Google Sign-In is used solely to verify your identity, create your account and sign you in. In particular, we:

• do not sell, license or rent this information to anyone;
• do not share it with advertisers, data brokers or advertising networks;
• do not use it to build profiles for advertising or to make decisions about eligibility, credit or employment; and
• request only the minimum permissions required for sign-in (public profile and email address).

You may revoke our access at any time. On Facebook, go to Settings and privacy, then Settings, then Apps and websites, and remove Mongol AI. On Google, go to your Google Account, then Security, then Your connections to third-party apps and services. Revoking access prevents future sign-in through that provider but does not by itself delete information already held by us; to have it deleted, follow the procedure in the section "Data Deletion" below.

We disclose personal information only to service providers that process it on our behalf and under our instructions, and only to the extent necessary to operate the Service:

• Amazon Web Services: storage of uploaded and generated images and job queuing (Singapore region);
• Microsoft Azure: hosting of the image-processing system;
• OpenAI: AI image processing;
• Neon: managed database hosting;
• Vercel: website hosting and aggregated, cookieless usage analytics;
• QPay: payment processing; and
• Google and Meta Platforms: authentication, where you choose to sign in through them.

We may also disclose information where required by law, court order or a lawful request from a public authority; where necessary to protect the rights, property or safety of Mongol AI, our users or the public; or in connection with a merger, acquisition or transfer of our business, in which case the recipient will be bound by this Policy.

We retain personal information only for as long as necessary for the purposes described in this Policy:

• account information is retained for as long as your account remains active;
• uploaded and generated images are retained in your account so that you can access them, until they are deleted or until you request deletion;
• payment and transaction records are retained for the period required by applicable tax and accounting law; and
• server logs are retained for a limited period for security and troubleshooting purposes.

When information is no longer required, it is deleted or irreversibly anonymised.

You may request deletion of your account and all personal information associated with it at any time, regardless of whether you registered by email, Google or Facebook. To do so:

1. Send an email to privacy@mongolai.app from the email address associated with your account, with the subject line "Data Deletion Request".
2. If you signed in with Facebook or Google, state which provider you used. We may ask you to confirm your identity before acting on the request.
3. We will delete your account, profile information, provider account identifiers, uploaded photographs and generated images within 30 days, and will confirm completion by email.

Transaction records that we are legally required to keep for tax and accounting purposes are retained for the statutory period and are not used for any other purpose. Information that has been irreversibly anonymised may also be retained.

Removing Mongol AI from your Facebook or Google account settings does not automatically delete information we hold. Please submit a deletion request as described above.

Subject to applicable law, including the Law of Mongolia on Personal Data Protection and, where it applies, the EU General Data Protection Regulation, you have the right to:

• access the personal information we hold about you;
• have inaccurate or incomplete information corrected;
• have your information deleted;
• restrict or object to certain processing;
• withdraw consent at any time, without affecting processing carried out before withdrawal;
• receive your information in a structured, commonly used format; and
• lodge a complaint with the competent data protection authority.

To exercise any of these rights, contact privacy@mongolai.app. We respond to all requests within 30 days.

We use only cookies that are strictly necessary to operate the Service: a session cookie that keeps you signed in and a preference cookie that stores your language. Our analytics are provided by Vercel Analytics, which does not use cookies and does not identify individual visitors. We do not use advertising or cross-site tracking cookies.

You can block or delete cookies in your browser settings; doing so will prevent you from signing in.

Our service providers operate infrastructure outside Mongolia, including in Singapore, the European Union and the United States. By using the Service you understand that your information will be transferred to and processed in those jurisdictions. We engage only providers that offer contractual commitments to protect personal information to a standard consistent with this Policy.

We maintain technical and organisational measures appropriate to the nature of the information we process, including encryption of data in transit (TLS), hashing of passwords, time-limited signed links for access to stored images, and restriction of administrative access to authorised personnel.

No method of transmission or storage is completely secure. If we become aware of a breach affecting your personal information, we will notify you and the competent authorities as required by law.

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact privacy@mongolai.app and we will delete it.

We may amend this Policy from time to time. The amended version will be published on this page with a revised effective date. Where changes are material, we will give registered users notice by email or through the Service before they take effect.

Questions, requests and complaints concerning this Policy or our handling of personal information should be addressed to:

• Privacy enquiries and data deletion requests: privacy@mongolai.app
• General support: support@mongolai.app
• Website: https://mongolai.app