Privacy Policy

Effective date: 2025-10-22

This Privacy Policy explains how Bjorner Media AB ("Bjorner Media", "we", "us") processes personal data when you use TokenKit (the "Service"). We are the data controller for personal data we collect and process through the Service.

1. What we collect

Depending on how you use the Service, we may process:

• Account identifiers: user ID and email received from our identity provider (Kinde) when your account is created.
• API credentials and usage: API keys, rate-limit settings, timestamps, and usage counters.
• Billing and purchases: amounts, currency, Stripe payment IDs and related metadata. We do not receive or store full payment card numbers; Stripe processes payments.
• Content you provide: images (uploaded files or URLs), prompts, and related metadata (e.g., filenames, MIME types, sizes, aspect ratio). Outputs generated by the Service (e.g., images and style descriptions).
• Job and system logs: job IDs, status, timing, non-sensitive diagnostic messages.
• Communications: details you submit via contact endpoints (subject, email, message).
• Technical data: basic request metadata processed by our infrastructure (e.g., IP address and headers) to deliver the Service and enforce security.

2. How we use your data

We process data to:

• provide, operate, and improve the Service (create/edit images, manage jobs, store results);
• authenticate you and authorize API access;
• process payments, manage credits, and detect fraud;
• enforce rate limits and ensure Service stability;
• provide support and communicate with you;
• meet legal obligations and enforce our Terms.

We do not use your inputs or outputs to train our models unless you explicitly opt in.

3. Data flows and storage

• Temporary processing: uploaded/remote-fetched images are written to local temporary folders only for the duration of a job and are deleted after processing completes.
• Persistent storage: generated images and certain reference images are uploaded to Cloudflare R2 at static.tokenkit.co. We store resulting URLs and related records in our database (Neon). Unless otherwise specified, these URLs are public by possession of the link (unguessable). Do not upload sensitive content.
• Analysis and generation: for specific features we send images and prompts to subprocessors to provide the Service, including AWS Rekognition (face analysis), Google Generative AI, Replicate, BytePlus/ByteDance, and OpenAI. We transmit only what is necessary for the requested operation.
• Authentication: we verify frontend tokens against Kinde and store your user ID and email when an account is created.
• Rate limiting and API keys: Upstash (Redis) stores API key metadata and enforces request limits.
• Payments: Stripe processes payments; we store purchase records (amounts, payment IDs, metadata) and credit balances.

4. Legal bases (EEA/UK)

Where GDPR/UK GDPR applies, we rely on:

• Contract: to provide the Service you request;
• Legitimate interests: to secure, operate, and improve the Service, prevent abuse, and support customers (balanced against your rights);
• Legal obligations: to comply with tax, accounting, and regulatory requirements;
• Consent: where required (e.g., certain marketing communications) and where you choose to opt in.

5. Retention

• Temporary files: deleted after job completion.
• Generated content and job records: retained while your account is active and as needed to operate the Service, resolve disputes, and meet legal obligations.
• Billing records: retained as required by applicable tax and accounting laws.

You may request deletion of your account and associated personal data (see "Your rights"). Some records may be retained where required by law or for security/fraud prevention.

6. Subprocessors and recipients

We use trusted providers to deliver the Service:

• Authentication: Kinde (identity and tokens).
• Payments: Stripe (payment processing).
• Database: Neon (PostgreSQL).
• Cache and rate limiting: Upstash Redis.
• Object storage and hosting: Cloudflare R2 (image storage and delivery).
• Image/vision analysis: AWS Rekognition.
• Model inference: Google Generative AI, Replicate, BytePlus/ByteDance, OpenAI.

We share data with these providers only to the extent necessary to provide the Service. Some are located outside your country; see International transfers below.

7. International transfers

If we transfer personal data outside the EEA/UK (e.g., to the United States), we use appropriate safeguards such as Standard Contractual Clauses where required by law. By using the Service, you acknowledge these transfers.

8. Security

We use reasonable and appropriate technical and organizational measures, including TLS in transit, provider-managed encryption at rest, access controls, API key authentication, and rate limiting. No method of transmission or storage is 100% secure; you also play a role by keeping credentials confidential.

9. Your responsibilities

Only submit content you have the right to process. Do not upload sensitive or unlawful content. If you supply image URLs, the Service will fetch the content at those URLs to process your request.

10. Your rights

Depending on your location, you may have rights to request access, correction, deletion, restriction, portability, or to object to certain processing. To exercise rights, contact us at noah@tokenkit.co. We may need to verify your identity and your request's scope. You also have the right to lodge a complaint with your local data protection authority.

For California residents: we do not sell or share personal information for cross-context behavioral advertising as defined under the CCPA/CPRA.

11. Children

The Service is not directed to children under 13. If you are in the EEA/UK, you must be at least the applicable age of digital consent or have verifiable parental consent.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will indicate the effective date above and, if changes are material, provide additional notice. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact

• Data controller: Bjorner Media AB, Sweden
• Contact person: noah@tokenkit.co