Privacy policy

What we collect

• Account data: your email address and your sign-in sessions. Sign-in uses Better Auth with an email magic link (a link expires in 15 minutes; an admin sign-in code expires in 10 minutes). Each session stores the IP address and browser user agent of the device that signed in.
• Request form: when you use /request, we collect your name, email, optional phone, the service category, location (city, region and country when the form asks for them), timing, the details you write, your answers to the service questions, the consent text you agreed to, and a one-way hash of your IP address. We do not store your raw IP on the request.
• Contact form: your name, email, message, and a one-way hash of your IP address.
• Interview or story form, when you use it: your name, email, business, answers, any images you upload, the consent text, and a one-way hash of your IP address.
• Claim and listing data: what you send to claim, add or edit a listing, including photos and claim evidence you upload while signed in. Published details are public.
• Billing records: which plan a listing has, and Stripe's references to your customer and subscription. Card details go to Stripe and never reach our servers.
• Technical data: rate-limit counters (a hash of your IP address, held for the 60-second window of the limiter), records of account and listing changes, and the request logs Cloudflare keeps as our host (IP address, time and URL). We keep them to run and protect the site.

Listing data sources

Public listing data comes from these sources.

• Public tool lists (Public lists used for discovery only. No facts are taken from them; each listing's summary comes from the vendor's own site and its home country from the vendor's site or Wikidata.)
• Listing enrichment (source)
• Vendor websites, pricing pages and terms (Each listing has a one-line summary of what the vendor says the product does, based on its own website, plus its category, home country and the source for it. No prices, limits, features or terms are recorded per listing.)
• Wikidata (CC0-1.0)

ChatGPT app and MCP server

This site offers a ChatGPT app and an MCP server at https://aiimagegen.fyi/mcp. The ChatGPT app connects to that server with no sign-in. This policy applies to that use. The policy URL is https://aiimagegen.fyi/privacy.

The public tools and their inputs and outputs are listed below. Every result also carries source attribution and license notes, which a client should show.

A caller with a service token may also use write tools that change the directory. The ChatGPT app does not use those tools. Those calls are authenticated with a service token.

We do not keep a separate transcript of MCP tool calls in the site database. Cloudflare may log the HTTP request (IP address, time and path). Public reads are rate-limited to 300 requests per 60 seconds per client.

• search_listings: you may send search text (q), country, region, city, category, sort, limit and a cursor. It returns a page of published listings: slug, name, URL, place, categories, tier, map coordinates, completeness and public attributes, plus page metadata. It does not return owner emails, contact emails, claim data, internal ids or attributes marked not public.
• get_listing: you send the listing slug. It returns the same public fields plus description, street address, postal code, public phone, website, currency, language, a verified flag, source credit, and published and updated dates.
• list_places: no input. It returns countries, regions and cities that have listings, with counts and URLs.
• list_categories: no input. It returns the category tree with listing counts and URLs.
• get_stats: no input. It returns counts of published listings, places, categories and sources, and when the data last changed.
• list_sources: no input. It returns each import source's name, license, refresh and notes.
• list_courses: you may send a level and a limit. It returns published academy courses: title, summary, level, length, pass mark, attempt limit, certificate validity, lesson count, exam question count (not the questions), and URLs.
• get_course: you send the course slug. It returns that course plus objectives, lessons and FAQ. Exam questions and answers are never returned.

How we use it

We use data to show listings, handle requests, claims and edits, answer contact messages, sign you in, keep the site safe, bill paid plans and operate the ChatGPT app and MCP server.

Who sees it

We share data only with the services that run the site: Cloudflare for hosting, email delivery (Cloudflare Email Service), bot checks (Turnstile), rate limiting and request logs, Stripe for billing, Meta (Facebook) for ad measurement, only after ad consent and only in production and Reddit for ad measurement, only after ad consent and only in production. We do not sell personal data. Card details go to Stripe and never reach our servers.

When you submit a request and a match is found, we send that request to one matching listed business (or to the site operators, if this site delivers requests to the team). A business on a paid plan, or on its first free enquiry, receives your name, email, optional phone, message and answers. Otherwise the contact details stay hidden until the business unlocks the enquiry. Once shared, that business handles the copy it received under its own policy.

How long we keep it

We have no automatic deletion job for accounts, requests, leads, billing records, contact messages, interviews or audit records. We keep that data until you ask us to delete it, or until we no longer need it to run and protect the site.

Sign-in sessions last 30 days and refresh with use (the sliding window is 24 hours). Magic links expire after 15 minutes. Admin sign-in codes expire after 10 minutes.

Rate-limit counters last for a 60-second window. Abandoned or unfinished uploads are deleted after 24 hours. Stale interview images that were submitted but never used in a story are removed after 90 days.

Cloudflare, Stripe and any analytics or advertising vendors named above keep data under their own policies for the period they need to provide their service.

Cookies

Signing in sets a session cookie (Better Auth). Bot checks may set short-lived cookies.

In production, a Meta (Facebook) pixel and a Reddit pixel may load after you grant ad consent (the ad_consent cookie set to granted). Those tags may set their own cookies. An attribution cookie may then be kept for up to 90 days.

There is no in-page cookie banner on this site that sets the ad_consent cookie. The advertising and Clarity tags above therefore load only if that cookie is already set to granted. You can refuse or clear cookies in your browser. A browser that sends Global Privacy Control or Do Not Track is treated as opted out of purchase measurement.

Your choices

To see, correct or delete your data, or to opt out of further routing of a request, write to support@aiimagegen.fyi from the email address you used. We will also deactivate an account on request: a deactivated account cannot sign in. We may keep a record of the account and of claims for audit. We cannot erase a copy a listed business has already received.

A listed business can stop lead emails with the unsubscribe link in those messages.

You can refuse or clear cookies in your browser, and you can send Global Privacy Control or Do Not Track, as described under Cookies.

Children

This site is a directory of AI image tools. It is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has submitted data, write to support@aiimagegen.fyi and we will delete it.

Contact and last update

Questions about this policy: support@aiimagegen.fyi. This policy was last updated on 11 November 2026.