Privacy policy

Tastebud runs the website at www.aitastebud.com and the Asset Studio inside it. When this page says “we”, it means us. We are the people who decide what happens to the data described here. For anything on this page, including a request to see or delete your data, write to admin@aitastebud.com and a person will answer.

You sign in to Tastebud with your Google account. We ask Google for the three basic sign-in permissions and nothing else: openid, email and profile. We do not ask for your Gmail, your Drive, your contacts or your calendar, and we cannot read them.

What Google gives us, and what each piece is for:

• Your email address, which is how we know an account is yours. It is the name your work is filed under.
• Your name, so the studio can address you rather than your address.
• Your profile photo, shown in the corner so you can see which account you are in.
• Your Google account id, which Google uses to tell us it is the same person signing in again.

We store this in our database on Supabase. Mixpanel, the tool we use to see how people move through the site, receives your name, email and profile photo so it can connect your visits to your account. When you sign up or pay, Meta receives your email in scrambled (hashed) form so it can tell which of our ads brought you. Nothing else from your Google account goes to any other company. We never sell it and never hand it to data brokers. We do not use it to train or improve any AI model, ours or anyone else’s. Nobody here reads it except when you ask us for help and we need it to find your account.

Tastebud’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy.

You can cut Tastebud off from your Google account at any time at myaccount.google.com/permissions. That stops the sign-in. It does not delete what is already here, so if you want the data gone as well, delete your account first.

• Your name, email address and profile photo from Google, as described above.
• What you tell us about your brand: its name, website, products, colours and fonts, and any notes you give the studio.
• Files you upload, such as product photos, logos and reference images.
• The images and text the studio makes for you, and the chat that led to them.
• Your plan, your credit balance and a record of your payments. Never your card number.
• Usage data from our analytics: the pages you visit, your browser and device, and your rough location.
• Which buttons you press on the website, and a recording of how you scroll and click through its pages. Anything you type into a box is hidden from the recording.
• If you book a call, the details you type into the booking form.
• Your email address, if you sign up for the newsletter or send us something through a form in the library. You do not need an account to do either.

Photographs of people. The model shoot lets you upload a photo of a person so the studio can put your product on someone who looks like them. Only upload a photo if you have the right to use that person’s likeness, and their permission where they would expect to be asked. We send the photo to our AI provider to do the work. We do not keep the file after the shoot, we do not build a face database, and we never use these photos to train anything.

• To run your account and the studio.
• To make images and copy that fit your brand.
• To take payments and keep track of your credits.
• To answer you when you write to us.
• To see which pages people use, so we can improve them.
• To see whether our ads on Facebook and Instagram work, and to show them to people likely to want Tastebud.

We do not sell your data. We never use what you upload or make here to train AI models.

We use a few services to run Tastebud. Each one gets only what it needs to do its job.

• Supabase runs sign-in and our database. This is where what Google tells us about you is kept.
• Vercel hosts the site and stores the images you upload and make.
• OpenAI, used directly and through Microsoft Azure, runs the AI that writes copy and makes your images. Your requests and uploads go to it to do that work. Under the terms we use it on, it does not train its models on them.
• Dodo Payments runs checkout, tax and invoices. Dodo is the merchant of record and holds your card details. We never see them.
• OpenRouter runs the live web search when the studio researches a brand on the open web. It receives the brand and the search, not your account.
• DataFast counts visits to the website.
• Mixpanel shows us how people use the website. When you are signed in it receives your name, email and profile photo, the pages you open, the buttons you press, what you make in the studio and what you buy, and a recording of your visit with anything you type hidden. It never gets your card details.
• Meta measures our ads on Facebook and Instagram. Its pixel sees which pages you visit here. When you sign up, start a checkout or pay, we also send it your email in scrambled (hashed) form, your browser and device details and Meta’s own cookie, so it can tell which ad brought you. It never gets your card details or anything you make here.
• Google handles sign-in, and sends the calendar invite if you book a call. Opening the studio also loads fonts from Google, which lets Google see your IP address.
• Resend sends emails about a call you booked, and one email a day after you sign up if you haven’t been back since.

Your images sit on public links. Every image the studio makes is stored at its own web address, and that address works for anyone who has it. The addresses are long and nobody can guess them, and your gallery is private to your account. But a link is not a lock. Treat an image link the way you would treat the image: if you paste it somewhere public, it is public.

Our database and the site run on servers in Singapore. The companies above are spread across other countries, mostly the United States, so using Tastebud means your data is sent there too. We only work with providers that commit to protecting it.

• Everything travels over an encrypted connection. The site refuses plain HTTP.
• Our database is encrypted on disk by Supabase, and is not open to the public internet.
• Sign-in is Google's. We never see, hold or store a password, because there is no password to store.
• Your card details never reach our servers. Dodo takes the payment and tells us only that it happened.
• Every request for your brands, images and credits is checked against your signed-in session, so one account can never read another's.
• Only the person who runs Tastebud can reach the database, and only to keep the service working or to answer you.

No service is perfect, and we will not pretend otherwise. If your data is ever caught up in a breach, we will tell you what happened and what to do about it, and we will tell you quickly rather than quietly.

We use a few cookies and similar browser storage. They keep you signed in and remember small choices, such as closing the cookie notice. Our analytics uses one to count visits. Mixpanel keeps an id in your browser's storage so it can connect one visit to the next. Meta's pixel sets one so we can measure our ads on Facebook and Instagram.

We keep your data while your account is open. When you delete your account it goes straight away, not on a schedule. Payment and cost records are the one exception: tax law requires us to keep them, so those rows stay with your name and email stripped out of them.

You can delete everything yourself. Open the account menu in the studio and choose Delete account. It removes your brands, your chats, every image you have made and your credit balance, and the image links stop working. It cannot be undone, so the studio asks you to type your email address first.

You can also ask for a copy of your data, or ask us to correct it. Email admin@aitastebud.com from the address you sign in with, and we will tell you when it is done. If you would rather we deleted your account by hand than press the button, ask and we will.

Tastebud is made for businesses and adults. It is not meant for anyone under 18.

If we change how we handle your data, we update this page and the date at the top. The terms of service and the refund policy sit beside it.