Privacy

1. Who holds your data

2. What we collect, and only this

When you join the early-access list, we store four things:

• Your email address. The only thing we ask for. There is no name field, no company field, no phone number.
• Which part of the page you signed up from. A short label like land-hero, so we know which pitch worked.
• How you arrived. The referring page and any campaign parameters in the link you followed.
• The time you signed up.

If you accept advertising cookies, Meta and Google each additionally receive what an advertising tag normally receives: your IP address, your browser, the pages you open on this site, and a conversion signal when you start a signup. That is described in section 5.

3. If you have an account

We hold your sign-in email and, if you add them, your name, phone number and picture. We also keep the record of your account: your plan, your credit balance and what you spent it on, and the version and date of the terms you accepted.

We use it to run your account, bill you, and write to you about it. Sign-in is handled by Google Firebase. We don’t send your details to the image or video models; they receive your images and the instructions you write, not who you are.

4. Why we’re allowed to hold it

For the list, because you gave it to us on purpose. The lawful basis for both your email and any advertising cookies is your consent, and consent you can take back at any time: for the email by writing to us, for the cookies by declining or clearing them. We do not claim legitimate interest for either.

For an account, because we need it to provide the service you signed up for, and to keep the records the law asks of us, such as invoices.

5. Cookies

Nothing that tracks you loads until you press Accept. Decline and neither advertising tag is ever requested.

• Meta Pixel (advertising, consent required). Set by Meta Platforms Ireland Ltd, which is an independent controller for what it collects. It tells us whether the people our ads reach are the people we meant to reach. See Meta’s privacy policy.
• Google Ads tag (advertising, consent required). Set by Google Ireland Ltd, an independent controller for what it collects. Same purpose as the Meta Pixel: it tells us whether the people our ads reach are the people we meant to reach. There is no Google Analytics property behind it. This measures ad conversions and nothing else. See Google’s privacy policy.
• Your cookie answer itself, kept in your browser’s local storage so we don’t ask again on every page. Never leaves your device.
• A preview cookie, only if someone sent you a preview link to the site before launch. It unlocks the site for your browser and does nothing else.

We count page views with Vercel Web Analytics, which sets no cookie, stores nothing on your device, and doesn’t identify you: it tells us how many visits a page had and where they came from. There is no session recorder and no heatmap tool. The two advertising networks named above are the only ones.

6. Who else touches it

Three companies, each processing on our instructions except where noted. Google, in two separate roles: Firebase, where the list is stored, in the United States and on our instructions; and Google Ads, only with your consent and as its own controller rather than ours. Vercel, which serves this site, keeps short-lived request logs and counts page views without cookies. Meta, for advertising, only with your consent, and as its own controller rather than ours. Where any of them moves data outside the EEA, it does so under the European Commission’s standard contractual clauses.

We do not sell your data, we do not share the list with anyone else, and we do not add you to a third party’s marketing.

7. How long we keep it

The list: until we open access and get in touch, and no more than 24 months after you sign up. If we haven’t launched by then, holding your address any longer is us keeping a list, not us keeping a promise, so we delete it.

An account: until you delete it, which you can do yourself from Settings. Invoices are kept for as long as tax law requires.

8. What you can make us do

You have the right to see what we hold, correct it, have it deleted, restrict what we do with it, object to it, take it elsewhere in a portable form, and withdraw consent. One email to privacy@bouqx.com covers all of them, and we answer within 30 days.

If we handle it badly you can complain to the Spanish data protection authority (AEPD) or, in the UK, the ICO. You don’t need to ask us first.

9. Changes