Legal
Legal CentrePrivacy Policy
This agreement is with Mofano Technologies Limited.
Company information1. Governing law and local rights
This version is governed by England and Wales law. Mandatory consumer and privacy protections in the country where you live remain protected.
Legal review: Confirm governing law, jurisdiction and mandatory consumer protections.2. Information we collect
Account information includes your name, email, sign in provider and profile details. Brand kits can contain your logo, colours, fonts, products and business information. We store your uploads, prompts, generated content and revision records so you can use your work again.
Payment records include verified amount, currency, pack or plan, credits, payment method and reference through Flutterwave. Hosted checkout collects payment credentials. Usage and device records include feature activity, timestamps, browser and security diagnostics. We also store support messages and browser consent choices.
3. Purposes and legal bases
| Purpose | Information | Basis where applicable |
|---|---|---|
| Account and access | Email, profile and session information | Performing our contract |
| Creative requests | Brand kit, uploads, prompts and outputs | Performing our contract |
| Payments and receipts | Verified payment, credits and billing country | Contract and applicable legal obligations |
| Security and abuse prevention | Usage, device and security events | Legitimate interests and legal obligations where applicable |
| Support | Messages and account details needed to help | Contract or legitimate interests |
| Optional browser choices | Preference and consent records | Consent where required |
4. AI processing
Prompts, selected brand information and reference uploads are sent to relevant AI services to produce and revise your requested content. Some processing also supports safety checks and quality checks. The reviewed application contains no Mofano model training job using customer prompts or uploads.
This source review does not prove every provider retention or training practice. We do not promise that all providers disable training or retain nothing. Ask support for current provider terms before uploading confidential or sensitive information.
See Subprocessors for the service inventory.
Legal review: Confirm no own-model training operationally and obtain provider retention, training settings and agreements.6. International processing
Processing locations depend on the services used. Specific regions and contractual transfer mechanisms are not verified in this app inventory. Ask support for the current locations and safeguards relevant to your use. Where applicable law requires a transfer safeguard, the responsible company must put it in place before relying on that transfer.
Legal review: Verify regions, adequacy, SCCs, UK transfer documents and local transfer requirements before legal launch.7. Retention and deletion
Account and creative records support an active account until you delete them. Recoverable Studio assets, projects and brand items marked deleted are eligible for automated cleanup after 30 days. This is not a guarantee that every backup or external provider copy is removed on that date.
Account deletion requests removal of account records and associated uploaded files. Payment records may be needed for legal or accounting duties. Exact statutory, backup, support and provider retention periods need confirmation from the responsible company; we do not claim an unverified fixed period.
Legal review: Confirm schedules for all data categories and retained payment records; audit deletion coverage and backup handling.8. Security
The app uses authenticated account requests, access policies and secure web connections. Avoid uploading information you do not have permission to use. Report a suspected breach to support. We do not claim security certification, guaranteed encryption arrangements or independent audits not confirmed for the service.
9. Your rights and account controls
Depending on your law, you may request access, correction, deletion, restriction, portability, object to processing, withdraw consent or complain to a regulator. We verify identity and respond within the period the applicable law requires. Withdrawing consent does not undo earlier lawful processing.
Download data exports the account categories currently available in that feature, not every possible record. For additional information or a full rights request, contact support.
Download data and Delete account are together in your account deletion controls. Correct your profile.
Legal review: Confirm scope, identity verification, deadlines and exceptions by region.10. Children
The minimum is 16, or the higher local age of digital consent. If a child below that age supplied information, contact support so we can investigate and apply the appropriate deletion or protection measures.
Legal review: Confirm children rules and age assurance requirements.11. EEA and United Kingdom
Under the EU GDPR or UK GDPR, relevant rights include access, rectification, erasure, restriction, objection and portability. You may withdraw consent and complain to your data protection authority, including the UK Information Commissioner where applicable. Our basis table explains proposed purposes; international safeguards still require verified agreements.
Legal review: Confirm controller representation, GDPR scope and regulator details.12. United States
California CCPA and CPRA and similar state laws may provide rights to know or access, correct, delete and receive data, and to opt out of sale, advertising sharing or certain profiling. We do not sell or share personal information for advertising. We do not discriminate for using a protected privacy right. Contact support for requests or an authorised agent request, subject to verification.
Legal review: Confirm thresholds, notices, sensitive data and appeal obligations for applicable US states.13. Other regional rights
| Region | Relevant law and rights, where applicable |
|---|---|
| Brazil | LGPD: confirmation, access, correction, deletion, portability and consent rights. |
| Canada | PIPEDA and applicable provincial laws: access, correction and complaints. |
| South Africa | POPIA: access, correction, objection and complaints to the Information Regulator. |
| Nigeria | NDPA: access, correction, deletion, objection and complaints to the Nigeria Data Protection Commission. |
| Kenya | Data Protection Act: access, correction, deletion and complaints to the Office of the Data Protection Commissioner. |
| Uganda | Data Protection and Privacy Act: access, correction and complaints to the Personal Data Protection Office. |
| India | DPDP Act, as brought into force: access summaries, correction, erasure, grievance and other applicable rights. |
| Australia | Privacy Act, where applicable: access, correction and complaints including to the OAIC. |
14. Questions and changes
Questions? support@mofano.ai
Material changes to Terms or Privacy appear in a notice in the app. Review the date and change log on each policy.
Change log
23 October 2026: reorganised global policies, company selection, credit rules, privacy disclosures and consent choices.