Privacy Policy

1. Information we collect

We collect personal information directly from you, generate it through your use of the Service, and receive limited categories of it from third parties such as payment processors and identity providers. We limit collection to what is necessary for the purposes identified in this Policy, and we collect it by fair and lawful means.

Account information. When you register, we collect your name, email address, organization name, password or single-sign-on credentials, and any profile details you choose to provide, and we record the issuance and expiry of any promotional credits Tein grants by hand against your account.

Email subscriptions. When you join the waitlist or subscribe to news, we collect your email address, the purposes you choose, and a record of the consent wording, form source and submission time. We also process delivery failures and unsubscribe requests to maintain your preferences. You do not need a paid subscription or a Tein account to withdraw marketing consent.

Billing and transaction information. When you top up prepaid compute credits or subscribe to Scale, our payment processor collects your payment card details; we receive only a tokenized reference, the transaction amount, your billing address, and applicable tax information, including GST/HST registration details where you provide them for invoicing. We do not store full payment card numbers. Tein is prepaid and pay-as-you-go: we hold a recurring billing mandate only where you enable automatic top ups or subscribe to Scale.

Usage Data. When you call the API at api.tein.ai or use the dashboard, we automatically log request metadata: the endpoints and models invoked, credit consumption, timestamps, request identifiers, latency and error data, IP address, and device and browser characteristics. "Usage Data" as used in this Policy means such telemetry, metadata, and derived analytics once they have been de-identified or aggregated so that they no longer identify you or any other individual and no longer reveal the content of your prompts or outputs; we maintain technical and organizational controls designed to prevent re-identification, and we do not attempt to re-identify Usage Data. Tein owns Usage Data, and its use is described in Section 2.

Content Data. We process the prompts, reference images, audio, and other inputs you submit, and the images, video, audio, and text the models generate for you. Content Data is handled as described in Section 3.

Creative mode applications and verification. The browser application collects your date of birth, country of operation, project or organization, intended use, audience, publication channels, attestations, typed legal name and drawn signature. These help us assess eligibility and responsible use. A declaration or signature alone is not independent verification of age, identity or another person's consent. Do not upload government identity documents or selfies to the project-description fields or email them to us. If a further age or identity check is necessary, we will explain its purpose, required information, provider, recipients, processing location and retention before collection. Any biometric check requires a separate, express consent process and an available non-biometric alternative where required by law. We do not require information that is unnecessary for the stated purpose.

Review and appeal materials. We may request information necessary to assess an access request, investigate a reported violation or review a disputed decision, such as an explanation of your project or evidence of rights and consent. We will explain how to provide sensitive evidence through an appropriate secure channel before requesting it. Access is limited to authorized personnel and service providers who need it for that purpose. Review evidence is not used to train generative models or sent to generation providers. We delete it when no longer needed, subject to the decision-record and lawful preservation requirements in Section 6.

2. How we use personal information

We identify the purposes for which personal information is collected at or before the time of collection, and we use it only for those purposes or for purposes a reasonable person would consider appropriate in the circumstances. Specifically, we use personal information to: create and administer your account; authenticate requests and protect API keys; deliver generations and operate the Service; meter credit consumption, process purchases, and issue tax-compliant invoices; detect, investigate, and prevent fraud, abuse, and violations of our Acceptable Use Policy; provide support and send service and security notices; improve platform reliability and performance; and comply with legal and regulatory obligations, including tax, sanctions-screening, and mandatory-reporting laws.

Where PIPEDA or provincial law requires consent, we obtain consent appropriate to the sensitivity of the information and the reasonable expectations of the individual: express consent for sensitive information and for uses a person would not reasonably expect, and implied consent for uses integral to providing the Service you have requested. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting us as described in Section 12; we will explain the consequences of withdrawal, which may include our inability to continue providing some or all of the Service. We do not make consent to unnecessary collection a condition of using the Service.

Customer Input and Output Content. By submitting inputs to the Service, you grant Tein a worldwide, non-exclusive, royalty-free licence to host, store, transmit, reproduce, process, and display your prompts, reference inputs, and generated outputs (together, "Customer Input and Output Content") solely as necessary to operate, provide, secure, and maintain the Services, consistent with the corresponding licence in our Terms of Service. This licence exists to run the platform (routing requests to model infrastructure, delivering and caching results, troubleshooting, and enforcing safety) and does not transfer ownership of your content to Tein. You own the outputs you generate, as set out in Section 11 of the Terms of Service.

Usage Data. Tein owns Usage Data: the telemetry, metadata, and derived analytics described in Section 1 that have been de-identified or aggregated so that they no longer identify any person and no longer reveal the content of prompts or outputs. We may use Usage Data for analytics, capacity planning, security, and service improvement, and retain it only as long as necessary. Removing direct identifiers does not by itself make data anonymous: information that can still identify someone remains protected by this Policy. Any longer retention of anonymized statistics must meet applicable legal anonymization requirements.

No training by Tein. Tein does not use your prompts, reference inputs, generated outputs or safety-review material to train, fine-tune or improve AI models. This applies to Standard and Creative mode. We do not authorize providers to train on your content on our behalf. Provider protections and their review status are described below. Where consent is the legal basis for a use of personal information, you may withdraw it as described in this Policy, subject to applicable retention duties.

Model provider no-training status. Ready means the model provider's applicable no-training terms have been confirmed for the listed model. The current Ready group includes Seedance, Seedream, Wan, Qwen, HappyHorse, Dola, Seed Audio, Seed 2.1 Turbo. Other models are Pending until their provider protections are confirmed. Pending does not mean a provider trains on customer data. It means our review is incomplete. A Pending model remains available; its status does not authorize training or waive your privacy rights.

The model API metadata separates model_provider_no_training from delivery_chain_review. The latter covers intermediaries, fallback providers, applicable account settings and agreements. A model maker's Ready status does not by itself confirm every intermediary's practices. An Official partner tag describes our authorized relationship with the maker. Neither label is a promise of zero retention or a security or legal certification. See the model API documentation for the status fields. We remain responsible for our obligations under applicable privacy law, including the assessment and contractual safeguards required for transfers outside Quebec.

3. Prompts, outputs & safety scanning

Inputs you submit are processed under the licence described in Section 2 for the purpose of operating, providing, securing, and maintaining the Service: they are transmitted to the model infrastructure you select, used to produce the requested output, and kept only for delivery, queueing, caching, troubleshooting, and the review described below. Your prompts, inputs, and outputs held by Tein follow our fourteen (14) day deletion schedule, or thirty (30) days for designated Creative mode endpoints, subject to the preservation exceptions in Section 6. Provider retention is separate, as explained there. You may ask us to delete them sooner, or to keep them for an investigation until one (1) month after the generation, by emailing privacy@tein.ai from your account email address before they are deleted; once they are deleted, we cannot investigate, recover, or re-check them. De-identified and aggregated Usage Data derived from your use of the Service is owned and used by Tein as described in Sections 1 and 2. You are responsible for ensuring that you have a lawful basis to include any personal information in your prompts or reference inputs, particularly information about third parties, and you should avoid submitting sensitive personal information unless doing so is necessary and lawful.

We may process prompts, reference inputs and generated outputs using automated safety checks and authorized human review to detect violations of law or our Acceptable Use Policy. Creative mode access does not remove safety restrictions, and content intended for sexual gratification is prohibited on every endpoint. Automated systems can make mistakes and do not establish the age or consent of a person depicted in content. Our safety review focuses in particular on any sexualization, exploitation, or harm of minors, non-consensual intimate imagery, human trafficking, and sexual violence. Content flagged by classifiers for suspected child-safety violations is escalated for human review by trained trust-and-safety personnel operating under strict confidentiality and access controls. Flagged material is handled as described below and is never used by Tein to train any model. Tein reserves the right to review requests made through the designated Creative mode endpoints, and its staff review them; Content Data from those endpoints is kept for thirty (30) days for that purpose, then permanently deleted. Using a real person's face or likeness without that person's documented consent may result in permanent termination, subject to review of factual errors, and reporting where required by law or otherwise lawfully justified.

Where we have reasonable grounds to suspect child sexual abuse material or related exploitation, we follow applicable preservation and reporting duties. The appropriate authority, information disclosed and retention period depend on the jurisdiction and legal basis. In Canada this may involve law enforcement or the Canadian Centre for Child Protection (Cybertip.ca); another authority may apply elsewhere. We disclose only what is required or otherwise lawfully justified. A content-policy violation is not, by itself, a basis to report a person to police. We do not treat a classifier result as proof of a crime.

4. Cookies & similar technologies

We use strictly necessary cookies to keep you signed in, secure your session, and remember essential preferences, and we use a limited set of first-party analytics cookies to understand how the Service is used in aggregate. We do not use cookies for cross-site behavioural advertising. You can manage non-essential cookies through our cookie controls where presented and through your browser settings, and we honour recognized opt-out preference signals such as Global Privacy Control. Disabling strictly necessary cookies may prevent parts of the Service from functioning.

5. Sharing & service providers

We do not sell personal information, and we do not disclose it to third parties for their own marketing purposes. We disclose personal information only in the following circumstances. First, to model infrastructure providers and any intermediaries needed to process your request and return the output. They receive the submitted content and technical request information; content you submit may itself identify you or another person. Their no-training review status is explained in Section 2, and their retention may differ from Tein's schedule. Second, to service providers who process it on our behalf (cloud and GPU infrastructure hosts, payment processors, email and support tooling, analytics providers, and identity-verification vendors), each bound by contract to confidentiality, comparable security safeguards, and use of the information solely to provide services to us; we remain accountable under PIPEDA for information transferred for processing. Third, to comply with applicable law, subpoenas, court orders, or lawful requests from government institutions, and to make the child-safety disclosures described in Section 3 and reports to law enforcement where required by law or otherwise lawfully justified concerning suspected unlawful use of a person's likeness. Fourth, to protect the rights, property, or safety of Tein, our users, or the public, including fraud prevention and enforcement of our Terms of Service. Fifth, in connection with a bona fide corporate transaction such as a merger, financing, or sale of assets, in which case the recipient will be bound to respect this Policy and applicable law.

6. Data retention

We retain personal information only as long as necessary to fulfil the purposes for which it was collected, to meet legal, tax, accounting, and audit obligations, and to establish or defend legal claims, after which we securely delete or anonymize it. Our standard schedules: account information is retained for the life of your account and up to twenty-four months after closure; billing and transaction records for seven years for tax and accounting purposes, subject to applicable legal requirements; API request logs containing IP addresses for up to twelve months before deletion or anonymization; and Content Data (your prompts, inputs, and outputs, including those shown in your gallery) for delivery and operational purposes in Tein's systems, permanently deleted fourteen (14) days after the generation, or thirty (30) days after a generation on the designated Creative mode endpoints. You may ask us to delete Content Data sooner, or to hold it for an investigation until one (1) month after the generation, by emailing privacy@tein.ai from your account email address before it is deleted; after deletion it cannot be recovered or investigated. Review and appeal materials (Section 1) are deleted when their purpose and applicable retention duties end. For information used to make a decision about a person that is subject to Quebec law, the applicable minimum is one year after the decision. Legal preservation duties may require longer retention; access remains restricted.

Provider retention may differ by model, service, account configuration and legal or safety obligations. No-training terms do not mean that no data is retained. Tein's fourteen and thirty day schedules do not describe every upstream provider's systems. Contact privacy@tein.ai for model-specific questions or deletion requests.

Notwithstanding the foregoing, content and records flagged for suspected child-safety or other serious legal violations are preserved for as long as required by law, by a preservation demand, or by an ongoing investigation, and credits, logs, and evidence associated with terminated accounts may be retained to enforce access blocking and prevent evasion through new accounts. Information that has been used to make a decision about you is retained long enough to allow you to access it and seek recourse.

7. Security & breach notification

We use technical and organizational safeguards proportionate to the sensitivity, quantity and uses of personal information, including access restrictions and secure transmission. No system is perfectly secure. Protect your account and API keys, use available account-security features, and report suspected vulnerabilities to security@tein.ai. Verification does not guarantee that an account is trustworthy or that submitted content is lawful.

For a confidentiality incident involving information subject to Quebec law, we assess the risk of serious injury and promptly notify the Commission d'accès à l'information and affected individuals when required. We take reasonable steps to reduce harm and prevent recurrence and keep an incident register. Where PIPEDA also applies, its separate reporting, notification and recordkeeping requirements apply. Notices and disclosures are made within the applicable legal time limits and subject to lawful exceptions.

8. Your rights: access, correction, deletion & complaints

Subject to limited exceptions prescribed by law, you have the right to be informed of the existence, use, and disclosure of your personal information; to access it; and to challenge its accuracy and completeness and have it amended as appropriate. You may also request deletion of personal information that is no longer necessary for the purposes described in this Policy, including deletion of Content Data before its scheduled deletion date, close your account at any time, and withdraw consent as described in Section 2. Quebec residents have additional rights under Law 25, including the right to request that computerized personal information be communicated in a structured, commonly used technological format, and rights to be informed about and to submit observations to a person able to review a decision based exclusively on automated processing. If we make such a decision, we will identify it as automated when notifying you. On request, we explain the personal information used and the main reasons, factors and parameters, subject to applicable law; you may request correction and human review through our Privacy Officer. Quebec law also provides conditional rights concerning cessation of dissemination and de-indexing or re-indexing of personal information.

To exercise any of these rights, contact our Privacy Officer using the details in Section 12. We will verify your identity before acting on a request and respond within thirty days (an extension is used only where the law applicable to your request permits it, with the required notice). If we refuse a request in whole or in part, we will explain the reasons and the exceptions relied upon. If you are not satisfied with our response, you may escalate your complaint to our Privacy Officer, who will investigate, and you have the right to complain to the Office of the Privacy Commissioner of Canada (1-800-282-1376, priv.gc.ca) or, where provincial law applies, to the Commission d'accès à l'information du Québec or the Information and Privacy Commissioners of Alberta or British Columbia.

9. Cross-border transfers

Tein is headquartered in Canada, but the Service relies on cloud and GPU infrastructure that may be located in other countries, and some of our service providers process personal information outside Canada, including in the United States and the European Union. When personal information is processed outside Canada, it is subject to the laws of those jurisdictions and may be accessible to their courts, law enforcement, and national-security authorities under lawful process. We use contractual and other means to ensure that personal information transferred outside Canada receives a comparable level of protection to that required under PIPEDA and applicable provincial law, and, for information subject to Quebec Law 25, a privacy impact assessment and the required written agreement must precede a transfer outside Quebec. A transfer may proceed only if the assessment establishes adequate protection. The assessment considers the sensitivity, purposes, safeguards and destination legal framework. Contact our Privacy Officer for information about our practices regarding transfers outside Canada.

10. Children's privacy

The Service is intended solely for adults. You must be at least 18 years of age (or the age of majority in your province or territory, if higher) to create an account, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a minor, we will delete it and close the associated account; if you believe a minor has provided us personal information, contact privacy@tein.ai immediately. For clarity, our privacy commitments in this Policy do not limit the safety measures described in Section 3: any attempt to create content that sexualizes, exploits, or harms minors results in immediate and permanent termination, lawful preservation of evidence, and reporting where required by law or otherwise lawfully justified, as further described in our Acceptable Use Policy.

11. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we do, we will revise the "Last updated" date above, and for material changes we will provide more prominent notice, such as email to account holders or an in-dashboard announcement, before the changes take effect. Where a change involves a new purpose for which consent is required, we will seek your consent before using your personal information for that purpose.

12. Contact us

Our Privacy Officer is responsible for privacy questions and complaints under this Policy and applicable Quebec and Canadian privacy law. For privacy questions, access or correction requests, requests to delete Content Data early or to hold it for an investigation (sent from your account email address), consent withdrawals, or complaints, contact: Privacy Officer, Endpoint Studios Inc. (Tein), 2300 Tupper Street, Montréal, Québec H3H 0B9, Canada, or email privacy@tein.ai. We will investigate all complaints and, if a complaint is justified, take appropriate measures, including amending our policies and practices. Please also review our Terms of Service and Acceptable Use Policy, which govern your use of the Service.