Privacy Policy

Recraft Inc.

Last modified: 20 October 2026

Effective as of: 20 October 2026 (new accounts) / 3 November 2026 (existing accounts)

1. Introduction

1.1 Scope. This Privacy Policy ("Policy") applies to your use of the www.recraft.ai website and all related services, including, without limitation, any features, content, other websites, or applications offered from time to time by Recraft, Inc. ("Recraft", "we", "us", or "our") in connection therewith (collectively "Services") that link to this Policy, including any acquisition, landing or checkout pages we operate, whether hosted on a recraft.ai domain or hosted on our behalf by a third-party provider on another domain. Your use of the Services in any manner is subject to this Policy and to Recraft's Terms of Service, which may be found at https://www.recraft.ai/legal/terms ("Terms"). This Policy is a separate document and does not form part of the Terms.

1.2 Who is responsible. Recraft, Inc., 450 Townsend St, Ste 100, San Francisco, CA 94107, United States, is the controller of the personal information described in this Policy. Recraft AI Limited, our United Kingdom subsidiary, is an establishment through which we carry out our activities. Personnel employed by Recraft AI Limited process personal information on behalf of, and under the instruction of, Recraft Inc.

1.3 What this Policy does not cover. This Policy does not apply to personal information we process about job applicants and candidates. That processing is described in our Applicant Privacy Policy, available at https://www.recraft.ai/hiring-privacy. It also does not apply to personal information we process about influencers, creators, and other individuals we contact for marketing outreach, which is described in our Outreach Privacy Policy, available at https://www.recraft.ai/legal/outreach-privacy. This Policy also does not apply where we process personal information governed by our Recraft Data Processing Addendum, available at https://www.recraft.ai/legal/dpa, or by the data protection terms of any other written agreement we have entered into with a customer.

1.4 Our Approach. We do not operate an advertising-funded business model. We do not sell your personal information for money. We do use a limited number of analytics, attribution, advertising, and security services in order to run and improve the Services, as described in Sections 3 and 5.

1.5 Personal Information. Our commitment to privacy and data protection is reflected in this Policy which describes how we collect and process "personal information" that identifies you, like your name or email address. Any other information besides this is "non-personal information". If we store personal information with non-personal information, we will consider that combination to be personal information. In this Policy, "personal information" has the same meaning as "personal data" under the EU and UK General Data Protection Regulations.

1.6 Third-party services. Third-party services that we integrate with the Services are governed under their own respective privacy policies.

1.7 Defined terms. Some capitalized terms in this Policy, including “Assets”, “Free Tier” and “Group Workspace” have the meaning given to them in the Terms.

2. Information Gathering

2.1 Information you provide to us. We collect information about you when you directly provide it to us. We collect your name and contact information, including your email address, as part of the creation of your account. If you make a purchase through the Services or pay for a paid subscription, our payment processor collects your card and financial account details on our behalf, and we receive limited billing information from them, such as your billing name, billing address, and card brand and last four digits.

Uploads and generated Assets. We collect the photos, documents, or other files you send to us in connection with delivering the Services, including via upload, email, or chat. Images and files you upload are stored in your account so that you can use them again until your account is deleted, other than where they are retained for the purposes described in Section 4.

Acquisition and landing pages. If you answer questions on one of our acquisition or landing pages, we collect your answers, together with your email address. If you make a purchase on those pages, we may also collect your postal code and the billing details described above. These pages may be hosted on our behalf by a third-party provider, and are covered by this Policy.

Communications with us. We also collect the content of your communications with us, including support tickets, chat messages, screenshots and attachments you send when you ask for help, and your responses if you take part in a survey or product interview.

Age check. When you create an account we may ask you to confirm your date of birth in order to check that you meet our minimum age requirement. We do not store the date of birth you enter. We store only a record of whether the check was passed.

2.2 Information we collect automatically. We collect information about you automatically through our products and services. When you visit our websites, our web servers log your Internet Protocol (IP) address and information about your device, including device identifiers, device type, operating system, browser, and other software including type, version, language, settings, and configuration. Depending on your device and app settings, we collect geolocation data when you use our Services. We log your activity on our website, including the URL of the website from which you came to our websites, pages you viewed on our website, how long you spent on a page, access times, and other details about your use of and actions on our website. We also collect information about which web elements or objects you interact with on our Service, metadata about your activity on the Service, changes in your user state, and the duration of your use of our Service.

Mobile applications. If you use our mobile applications, we and our attribution providers may collect device and advertising identifiers, IP address, device and application version information, and information about installs and in-app events, so that we can measure and improve the performance of our marketing. Where we use advertising identifiers for this purpose, we do so in accordance with the tracking permission you give through your device settings, which you can change at any time.

Plugins, extensions, and MCP. If you use a Recraft plugin, browser extension, or our Model Context Protocol (MCP) server, we process the limited information from the host application or browser environment that is needed to deliver a generated asset into that environment. Depending on the integration, this may include the page or document you have open, the elements you select, and images of the page. If you access our Services through a third-party integration, such as an MCP (Model Context Protocol) connector or similar agent-based integration, that third party’s privacy policy governs any personal information it collects or processes before your request reaches us. Once your request reaches Recraft, this Policy governs our handling of your personal information.

Session recording. We may also use session recording to understand how you move through and interact with our web pages, including clicks, scrolling, mouse movement and, where it is not masked, text you enter into fields on the page, such as a prompt, so that we can find and fix usability problems. Session recording sits in the performance and analytics category, so it is only used where you have consented to that category. We do not record sessions on our sign-in pages or on our payment provider’s pages.

2.3 Information we receive from others. We collect information about you when someone else tells us such information. We may collect information about you from third-party applications and services, including without limitation social networks or other services you choose to connect or interact with through the Services. We may also collect information about you from third parties that collect or provide data in connection with work they do on our behalf, for example companies that determine your device's location based on its IP address. If you are a business contact, we may also collect your name, job title, work email address, professional profile URL and company information from publicly available sources and from third-party data enrichment providers, so that we can contact you about our products.

2.4 Information we infer. We try to understand more about you based on information you have given to us or we receive from someone else. We infer new information from other data we collect, including using automated means to generate information about your likely preferences or other characteristics. For example, we infer your general geographic location based on your IP address. We might group users into segments based on how the Services are used. We use those segments, which are linked to your account identifier, to personalize your experience of the Services and to test improvements to them.

2.5 Contractors and annotators. If you provide services to Recraft as an independent contractor or annotator, whether sourced through a third-party platform or directly, we may collect device-level signals from your sessions, including device information, IP address and browser data, for the purposes of fraud prevention and quality assurance. This processing is based on our legitimate interests in protecting our business and ensuring the quality of our data. We use third-party fraud-prevention services to help with this analysis. You can exercise the rights described in this Policy by contacting help@recraft.ai.

3. Cookies and Similar Technologies

3.1 Technologies we use. We and our service providers use cookies and similar technologies, including browser storage, pixels and software development kits in our mobile applications, to operate the Services, remember your preferences, understand how the Services are used, and protect against fraud and abuse. We group these technologies into four categories: essential, functional, performance and analytics, and marketing. Our Cookie Statement, available at https://www.recraft.ai/legal/cookies, describes each category and the specific technologies in use.

3.2 Consent. Where the law requires your consent before non-essential cookies are set, we ask for it through a banner when you first visit and do not set those cookies until you have made a choice. This applies if you are in the European Economic Area, the United Kingdom, California, Brazil, Quebec, Canada, China, South Africa or Thailand. Elsewhere, non-essential technologies may be used when you arrive, and you can opt out at any time as described in Section 3.3.

3.3 Changing your choices. You can change your choices at any time. If you are signed in, you can update your cookie preferences in your account settings. If you are not signed in, you can use the "Manage cookies" link in the footer of our website.

3.4 Where your choices apply. Your cookie preferences apply on recraft.ai and its subdomains, and on any other website or application we operate that links to this Statement.

3.5 Browser signals. We honor recognized browser opt-out signals, including Global Privacy Control, where they are enabled in your browser.

3.6 Advertising and measurement partners. If you consent to marketing technologies, we share information about your activity on our websites, such as signing up or making a purchase, with advertising partners, from your browser or from our servers. This may include a hashed version of your email address, account and purchase details, your IP address and device information. Partners use it to measure and target our advertising, including to reach people similar to our customers, and for their own advertising purposes. We and Meta are joint controllers for collecting and sending this information to Meta. After that, each partner is responsible for its own use under its own privacy policy. You can change your choice at any time (Section 3.3), but we cannot recall information already sent. Our Cookie Statement lists our partners.

4. Artificial Intelligence Features

4.1 AI Input and AI Output. Information you submit for processing by our Services such as prompts, uploaded files, data, and related context ("AI Input"), and the AI-generated responses and output ("AI Output"), will be collected and processed by us and our trusted AI service providers we use to support those features. See the current list of external AI model providers at https://www.recraft.ai/subprocessors. AI Input includes prompts and reference material you submit to generate or edit images and video, the content of your conversations with our chat interface and design agent, and voice input where you use it.

4.2 Prompts. We do not ask you to include personal information in your prompts. If you choose to include personal information, that information is processed in order to produce the output you have requested. Where session recording is in use, the text you enter, including prompts, may also be captured as described in Section 2.2.

4.3 Chat and design agent. If you use our chat interface or design agent, the content of your conversation and any reference images you upload are sent to third-party large language model providers so that a response can be generated. The agent only takes actions you have approved.

4.4 Voice input. If you use voice input, your speech is sent to a speech to text provider and converted into text. The audio is transient and is retained only for as long as the transcription takes. The resulting transcript is then handled in the same way as a prompt you have typed.

4.5 Training by our providers. We shall not use and shall not permit our third-party AI service providers or any other data processor or contractor of ours to train, fine-tune, or otherwise improve any machine learning or artificial intelligence models using your AI Input or AI Output or any other data, unless you have affirmatively authorized and configured the Services to permit such use. Our external image and video model providers, and the providers supporting our chat and voice features, operate under zero data retention or equivalent contractual terms that prohibit training on your AI Input or AI Output.

4.6 Training on our own models. We may use such information, including content you submit through our MCP server, to train Recraft's own proprietary AI models, but you may disallow such use of your information by opting out in your account profile settings. Content submitted through a Group Workspace subscription, or through our API, is not used to train Recraft's models, and no opt-out is needed for that content.

4.7 Community gallery. Assets generated on the Free Tier are owned by Recraft and may be displayed in our community gallery. Where an asset has been made available in the community gallery, it may remain available there after your account is deleted. We do not generally remove assets from the community gallery on request, except where we are required to do so by law, including where a valid notice is submitted under our Take It Down Policy or the copyright notice procedure as described in the Terms, or where removal is necessary to meet a data protection obligation such as a valid erasure request from an EEA, UK, or Swiss user. Outside of those circumstances, any removal is at our discretion.

5. Information Use

5.1 Providing the Services. We use personal information to provide you with the Services, to improve and develop them, to communicate with you, to provide customer support, and to operate, secure, monitor and troubleshoot the Services, including error logging and backups.

5.2 Safety, legal, and financial purposes. We also use personal information to check that you meet our minimum age requirement; to screen prompts, uploads and generated content against our content rules, to investigate reports and to take enforcement action; to detect, investigate and prevent fraud, abuse and other prohibited activity; to process payments, subscriptions and taxes and to send financial, billing and tax-related notices, using the billing contact details held by our payment processor where we do not hold a contact address for your Recraft account; and to comply with our legal obligations, to establish, exercise or defend legal claims, and for corporate governance and record-keeping.

5.3 Product development and communications. We also use personal information to send you product news, style updates, invitations to test new features and requests for feedback; to identify and contact prospective business customers and partners; to carry out user research with participants who have agreed to take part; to train and improve Recraft's own artificial intelligence models, subject to Section 4; to measure, optimize and target our advertising, including by sharing purchase information with advertising partners as described in Section 3.6, where you have consented; and to promote the Services, including through our community gallery and our own websites and social media channels.

6. Legal Bases for Processing

6.1 Legal bases. If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases.

6.2 Performance of our contract with you. Creating and administering your account and providing the Services, including generating and editing Assets, chat and design agent features and voice input; subscriptions, billing and taxes; and customer support.

6.3 Compliance with a legal obligation. Checking that you meet our minimum age requirement; financial and tax reporting; and content moderation, enforcement and mandatory reporting.

6.4 Our legitimate interests. We rely on our legitimate interests in: protecting the Services, our users and our business, for fraud detection and prevention, and for contractor and annotator fraud prevention and quality assurance; the security, reliability and continuity of the Services, for monitoring, error logging, testing and backups; the safety of the Services and the enforcement of our Terms, for content moderation and enforcement; understanding how the Services are used, for product and site analytics; personalizing your experience of the Services, for user segmentation, onboarding, and product experiments; measuring and improving our marketing, for mobile application attribution and campaign measurement; keeping you informed about the Services, for product news, feature invitations and feedback requests; developing our business, for business contact enrichment and sales outreach; developing and improving our models, for training Recraft's own artificial intelligence models, subject to the opt-out described in Section 4; operating our group efficiently, for administration between Recraft, Inc. and Recraft AI Limited; and protecting our legal position, for legal claims, corporate governance and instructing professional advisers. Where we rely on our legitimate interests, we have assessed those interests against your rights and freedoms. You can ask us for more information about that assessment, and you can object to the processing, as described in Section 15.

6.5 Your consent. We rely on your consent for: non-essential cookies and similar technologies, as described in Section 3; advertising, advertising optimization and campaign measurement using marketing cookies and similar technologies, as described in Section 3.6; user research interviews and usability sessions, including recordings that capture your image and voice; and marketing communications where required by local law. Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect processing already carried out.

7. Information Sharing

7.1 When we share. We share information about you when: (i) we have asked and received your consent to share it; (ii) it is needed, including to third-party service providers, to process or provide Services or products for or to you, but only if those entities agree to provide at least the same level of privacy protection as this Policy; (iii) it is necessary to comply with laws or to respond to lawful requests and legal process, provided that we will notify you unless we are legally prohibited from doing so, and we will only release personal information if we believe in good faith that it is legally required; (iv) we reasonably believe it is necessary to prevent harm to the rights, property, or safety of you or others; or (v) we undergo a corporate restructuring or change in our organizational structure or status.

7.2 Who we share with. We also share personal information: (i) with the service providers and subprocessors that process personal information on our behalf under written terms, including analytics and session recording providers on our websites. A current list of which is available at https://www.recraft.ai/subprocessors; (ii) with professional advisers, including our accountants, auditors, tax advisers and lawyers, where necessary for tax, accounting, corporate governance or legal purposes; (iii) with other companies in our corporate group, including Recraft AI Limited, for the administration and operation of the Services; (iv) with law enforcement authorities, regulators and reporting bodies where we are required or permitted to report content or activity, including child sexual abuse material and non-consensual intimate imagery. We may do so without prior notice to you where notice would be unlawful or would obstruct an investigation; and (v) with advertising and measurement partners, where you have consented to marketing technologies, as described in Section 3.6.

7.3 Promoting the Services. We may feature assets created using the Services, and the prompts associated with them, on our own websites, in our community gallery and on our own social media channels. We may also submit assets created using the Services to third-party platforms.

7.4 Links and integrations. Please note that some of the Services include integrations, references, or links to services provided by third parties whose privacy practices differ from ours. If you provide personal information to any of those third parties, or allow us to share personal information with them, that data is governed by their privacy statements.

7.5 Non-personal information. We may share non-personal information in accordance with applicable law.

8. International Data Transfers

8.1 Where we process. Recraft, Inc. is established in the United States, and Recraft AI Limited is established in the United Kingdom. Personal information we collect is processed in the United States and in other countries where we or our service providers operate. As part of our normal operations, your information may be stored in computers in countries outside of your home country. Irrespective of where your information resides, we will comply with applicable law and our commitments in this Policy.

8.2 Safeguards. Where personal information is transferred out of the European Economic Area, the United Kingdom or Switzerland, we rely on one or more of the following safeguards: (i) an adequacy decision, where the recipient is located in a country recognized as providing an adequate level of protection; (ii) the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum and the Swiss equivalent where applicable.

8.3 Our providers. The safeguard applicable to each of our service providers is identified in our subprocessors list at https://www.recraft.ai/subprocessors.

8.4 Contractors. Some of our contractors are located in other countries, including countries outside the European Economic Area and the United Kingdom. Those contractors access our systems remotely under contractual safeguards and confidentiality obligations, and do not store personal information locally. These remote-access arrangements are covered by the transfer safeguards described in Section 8.2.

8.5 More information. You can request further information about the safeguards we use by contacting help@recraft.ai.

9. Information Protection

9.1 Security measures. We implement physical, business, and technical security measures to safeguard your personal information. These include encryption of data in transit and at rest, role-based access control applied on a least privilege basis, single sign-on and multi-factor authentication, network and application firewalls, logging and monitoring, a documented incident response plan, annual third-party penetration testing and continuous vulnerability scanning. Our service providers are assessed before onboarding and are required to maintain standards no less protective than our own.

9.2 Security breaches. Where a security breach affecting your personal information occurs, we will notify you, and where applicable the relevant supervisory authority, in accordance with applicable law and without undue delay.

10. Data Retention

10.1 How long we keep information. We retain personal information for as long as necessary to provide the services and fulfill the transactions you have requested, comply with our legal obligations, resolve disputes, enforce our agreements, and other legitimate and lawful business purposes. Because these needs can vary for different data types in the context of different services, actual retention periods can vary significantly based on criteria such as user expectations or consent, the sensitivity of the data, the availability of automated controls that enable users to delete data, and our legal or contractual obligations.

10.2 Assets and uploads. Assets you generate remain in your account. Files you upload also remain in your account, so that you can use them again, until your account is deleted. Records that we are required to keep for tax, accounting, legal or regulatory reasons are retained for the period required by the relevant law.

10.3 Account deletion. When you delete your account, or ask our support team to do so, your personal information is deleted from our own systems promptly. Some of our service providers, and our routine encrypted backups, operate on their own deletion cycles and may take longer to complete deletion. If your account becomes inactive for twelve or more consecutive months, measured from your last login, it may also be deleted under the inactivity provisions of our Terms. We will endeavor to provide at least seven days’ prior notice. Assets made available in our community gallery are subject to Section 4.

10.4 Retention criteria. We keep each category of personal information are as follows: account and profile information, for as long as your account remains open or until you delete them; files you upload until your account is deleted; answers you give on our acquisition and landing pages, the associated session records and records of advertising events we send to our partners, for the period we need them to measure and improve our marketing; support communications, for as long as we need them to resolve your query and any related dispute; billing, payment and tax records, for the period required by applicable tax and accounting law; moderation and enforcement records, for as long as we need them to enforce our Terms and to meet any reporting obligation; security, error and access logs, for the period needed to investigate incidents and maintain the security of the Services; marketing contact details, until you unsubscribe or we no longer have a business reason to contact you; conversation AI Input and AI Output that is not saved as an Asset, including chat, design agent messages, and voice-derived transcripts, for as long as your account remains open; and content used to train our models, until it is anonymized in accordance with our Retention Policy.

11. Automated Decision Making

11.1 Automated systems we use. We use automated systems to screen prompts, uploaded files and generated content against our content rules, and to detect fraudulent, abusive or otherwise prohibited activity. These systems assess signals such as the content submitted, account information, device and network information, and patterns of activity. They may result in content being blocked, or in your account being restricted, suspended or terminated.

11.2 Human review. If your account is restricted or terminated and you believe this was an error, you can ask for a human review by contacting help@recraft.ai. We will review your request and respond within 15 business days. Section 15 of our Terms describes this process, and the further routes to redress available to users in the European Union and European Economic Area, in more detail.

11.3 Your rights. Where you have the right under applicable law not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, the human review described above is intended to satisfy that right. You can contact help@recraft.ai to request information about how a decision affecting your account was reached.

11.4 Recruitment. Automated processing used in recruitment is described in our Applicant Privacy Policy.

12. Other Information

12.1 Minimum age. We do not want your personal information if you are under 18 years old, and you are not allowed to provide it to us or use the Services if you are under 18 years old. If your child is under 18 years old, and you believe your child has provided us with personal information, please contact us to have such information removed. The Services are not directed to children.

13. Your Privacy Rights

13.1 Rights available to all users Wherever you are located, you can ask us: (i) to tell you what personal information we collect about you; (ii) whether we share it and with whom; and (iii) for access to it. We will not discriminate against you for exercising your privacy rights. We respond to requests in line with the laws that apply to you, and may decline or limit a request where those laws allow..

13.2 EEA, UK, and Swiss Users. Our lawful bases for collecting and processing personal information under the General Data Protection Regulation, the UK GDPR and the Swiss Federal Act on Data Protection (together, the “GDPR”) include performing our contract with you and providing our services. Section 6 sets out the legal basis on which we rely for each purpose. We receive technical and interaction data of users, which may include IP addresses, for legitimate purposes, including but not limited to improving the security and reliability of the Services, preventing abuse, and understanding where people learn about the Services. Where we ask for your consent to process your information, you can always withdraw such consent.

Additional GDPR rights. Under the GDPR, EEA, UK, and Swiss users have additional rights, including: (i) the right to request correction or erasure of personal information; (ii) the right to object to processing your personal information; (iii) the right to transfer or receive a copy of the personal information in a usable and portable format, when any automated processing of personal information is based on your consent or a contract with you; (iv) the right to request that we restrict the processing of your personal information; and (v) the rights to withdraw your consent to processing, when the processing is based on your consent. When we are processing data on behalf of another party that is the "data controller", you should direct any requests about your data to that party. You also have the right to lodge a complaint with a supervisory authority, but we encourage you to first contact us with any questions or concerns. Section 15 describes how to complain.

13.3 California Users. Under the California Consumer Privacy Act (the “CCPA”), California residents have additional rights, including: (i) the right to request that personal information about you be deleted, subject to several exceptions; (ii) the right to opt-out of the sale or sharing of personal information. Where you consent to marketing cookies, we share personal information with advertising partners for cross-context behavioral advertising. You can exercise this right by changing your cookie preferences as described in Section 3.3 or by enabling an opt-out preference signal in your browser; (iii) the right to correct inaccurate personal information; and (iv) the right to designate, in writing or through a power of attorney, an authorized agent to make requests on your behalf to exercise your rights under the CCPA. Before accepting such a request from an agent, we will require the agent to provide proof you have authorized it to act on your behalf, and we may need you to verify your identity directly with us. To provide or delete specific pieces of personal information, we will need to verify your identity to the degree of certainty required by law. We will verify your request by asking you to send it from the email address associated with your account or requiring you to provide information necessary to verify your account.

13.4 California notice at collection. In the twelve months preceding the date of this Policy we have collected the following categories of personal information: identifiers, including name, email address, account identifiers, IP address and device identifiers; commercial information, including subscription and transaction records; internet and network activity, including usage and interaction data; geolocation data, in general terms derived from IP address and, where you permit it, from your device; audio and visual information, including images and files you upload or generate, support screenshots, voice input and, where you agree to take part, research interview recordings; professional information, where you are a business contact; and inferences drawn from the above. The sources of that information, the purposes for which we use it, the categories of recipients and our retention approach are described in Sections 2, 5, 7 and 10. In the same period we disclosed each of these categories for business purposes to the recipients described in Section 7. Where users consented to marketing technologies, we also disclosed identifiers, commercial information and internet and network activity to advertising and measurement partners, who use that information for their own advertising measurement, optimization, and audience-building purposes.

13.5 Sensitive personal information. The sensitive personal information we collect is limited to your account log-in credentials and, where your device settings permit it, geolocation data. We use it only to provide and secure the Services. We do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA, and accordingly we do not offer a right to limit its use.

13.6 Other United States states. If you are in a US state with a comprehensive privacy law, you may have rights to access, correct and delete your personal information, to obtain a copy of it, and to opt out of targeted advertising, the sale of personal information and certain profiling. If we decline your request, you may appeal that decision by contacting help@recraft.ai. We use personal information for targeted advertising as described in Section 3.6, which may be treated as a sale under these laws. You can opt out as described in Section 3.3.

13.7 Other jurisdictions. Where local law gives you rights in relation to your personal information beyond those described in this Policy, we will honor those rights to the extent they apply to you.

14. Exercising Your Rights

14.1 To exercise the rights described above or if you have a question or concern, please contact us at help@recraft.ai and we will try to address or resolve it. We may need to verify your identity before we act on your request, and we will normally do so by asking you to contact us from the email address associated with your account. We do not charge a fee, and exercising your rights will not result in you receiving a lesser service. We will respond within the period required by applicable law. If we are unable to resolve your request, Section 15 explains how to complain.

15. Complaints

15.1 Contact us first. If you are unhappy with how we have handled your personal information, please contact us first at help@recraft.ai. We will acknowledge your complaint and respond substantively within 30 days.

15.2 United Kingdom. If you are in the United Kingdom and you remain dissatisfied, you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, or through ico.org.uk.

15.3 European Economic Area and Switzerland. If you are in the European Economic Area, you can complain to the supervisory authority in the country where you live or work. If you are in Switzerland, you can complain to the Federal Data Protection and Information Commissioner. Complaining to a supervisory authority does not affect any other legal remedy available to you.

16. EU and UK Representative

16.1 EU Representative. We have appointed Prighter EU Rep GmbH as our representative in the European Union under Article 27 of the GDPR. You can contact them at Schellinggasse 3/10, 1010 Vienna, Austria.

16.2 UK Representative. Recraft AI Limited, a UK subsidiary of Recraft, Inc., acts as Recraft’s establishment in the United Kingdom for purposes of the UK GDPR. You can contact Recraft AI Limited at 450 Townsend St, Ste 100, San Francisco, CA 94107 or at help@recraft.ai.

17. Changes

17.1 We may need to change this Policy and our notices from time to time. Any updates will be posted online with an effective date. Where we make material changes, we will take reasonable steps to notify you by any means we consider appropriate, which may include an in-app notice, a summary of the changes, an email, or another method reasonably likely to reach you. Continued use of the Services after the effective date of any changes constitutes acceptance of those changes.

18. Contact Us

18.1 You can get in touch by emailing us at help@recraft.ai. You can also write to us at Recraft, Inc., 450 Townsend St, Ste 100, San Francisco, CA 94107, United States.