1. Introduction
This Privacy Policy describes how Fiesta Labs Inc. collects, uses, and protects the personal information of users of AI Fiesta. Fiesta Labs Inc. is the data controller for the processing described here.
By using AI Fiesta and its features, you consent to the collection and use of your data as outlined here.
2. What We Collect, Why, and For How Long
This section sets out the information you have a right to be given: the categories of personal data we collect, what we do with each, the lawful basis we rely on, and how long we keep it.
| Category of data | Purpose of processing | Lawful basis | Retention |
|---|---|---|---|
| Account information - name, email, phone number, password credentials. | Creating and securing your account, authenticating you, and sending service communications. | Performance of our contract with you (Art. 6(1)(b) GDPR). | For the life of your account. Deleting your account revokes your sessions and marks the record deleted; we keep it no longer than we need to and then erase or anonymize it, except where law requires us to keep it. |
| Billing and payment details - subscription plan, transaction records. Card data is handled by our payment processors; we do not store full card numbers. | Taking payment, managing subscriptions and renewals, issuing refunds, and preventing payment fraud. | Performance of our contract (Art. 6(1)(b)); compliance with a legal obligation for tax and accounting records (Art. 6(1)(c)). | Transaction records are kept for the period required by applicable tax and accounting law, then deleted. |
| Content you submit - prompts, uploaded files, and the AI responses generated for you. | Generating responses, keeping your chat history available to you, and moderating content for safety and policy compliance. | Performance of our contract (Art. 6(1)(b)); our legitimate interest in platform safety and abuse prevention (Art. 6(1)(f)). | Retained while your account is active. Deleting a chat or your account removes the content from your account; we then keep it no longer than we need to for safety, billing, and legal purposes before erasing or anonymizing it. |
| Usage data - tokens consumed, features used, request counts and timestamps. | Enforcing plan allocations and rate limits, billing, capacity planning, and improving the service. | Performance of our contract (Art. 6(1)(b)); our legitimate interest in running and improving the service (Art. 6(1)(f)). | Kept while the account is active and for as long as needed to resolve billing and usage disputes, then aggregated or deleted. |
| Technical data - IP address, browser and device information, error and diagnostic logs. | Delivering the service, securing it against abuse and fraud, and diagnosing faults. | Our legitimate interest in the security, integrity, and reliability of the service (Art. 6(1)(f)). | Retained for a short operational window appropriate to the log, then deleted or aggregated. |
| Website analytics - Google Analytics and Tag Manager cookies. See the Cookies Policy for the full list. | Measuring how the site is used so we can improve it. These are set only if you accept analytics cookies. | Your consent (Art. 6(1)(a)), which you may withdraw at any time. | For the lifetime stated per cookie in the Cookies Policy. Your consent choice itself is kept for 12 months. |
| Product analytics, error reports, and referral attribution - PostHog, Sentry, and referral identifiers. These run regardless of your analytics-cookie choice. | Operating feature flags that control how the product behaves for your account, diagnosing crashes, and attributing your signup to the partner who referred you. | Our legitimate interest in operating, debugging, and accounting for the service (Art. 6(1)(f)). | For the lifetime stated per cookie or identifier in the Cookies Policy. |
Where a retention period is expressed as a criterion rather than a fixed term, we keep the data only as long as that criterion applies, and review it periodically.
3. Where Your Data Comes From
Almost all of the personal data we hold is collected directly from you - when you create an account, subscribe to a plan, or use the product. We also receive limited data that does not come from you directly:
- From our payment processors (TagMango, Stripe, Cashfree, Razorpay, Apple): confirmation of payment and your subscription status.
- From sign-in providers you choose to use: your name and email address as held by that provider.
- From referral and affiliate partners: the fact that you arrived through a particular referral link.
4. Who We Share Your Data With
We share personal data with the following categories of recipients, only to the extent each needs it:
- AI model providers (OpenAI, Anthropic, Google, xAI and others) - to generate responses to your prompts.
- Payment processors (TagMango Inc / TagMango Pvt Ltd, Stripe, Cashfree, Razorpay, Apple) - to take payment and manage subscriptions.
- Hosting and infrastructure providers (Cloudflare and our data-store hosts) - to run the service.
- Analytics and monitoring providers (Google, PostHog, Sentry) - for website analytics, product analytics, feature flags, and error monitoring. Google Analytics runs only with your consent; PostHog and Sentry run on our legitimate interest, as the Cookies Policy explains.
- Referral and attribution partners (Dub Technologies) - to attribute referrals.
- Authorities and advisers - where we are legally required to disclose, or need to establish or defend legal claims.
The Data Processing Addendum lists our sub-processors and their locations. Where personal data is transferred outside the EEA or UK, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.
We do not sell your personal data.
5. Automated Decision-Making and Profiling
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing, and we do not profile you for those purposes.
AI Fiesta does use automated processing in two ordinary ways: the AI models generate responses to your prompts, and automated checks screen content and usage patterns for abuse, fraud, and policy violations. Where such a check restricts or suspends your account, you can contact us to have a person review the decision and to contest it.
6. Data Security
We implement encryption, access controls, and secure data storage. However, no system is 100% secure.
7. Your Data Subject Rights (GDPR / CCPA)
Wherever you are, you may ask us to access, correct, update, delete, or restrict the processing of your personal data, and to receive a copy of it in a portable format. Where processing is based on your consent, you have the right to withdraw that consent at any time - for cookies, via the "Cookie preferences" control in the footer; for anything else, by emailing dpo@aifiesta.ai. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.
If You Are in the European Economic Area (EEA):
Under the General Data Protection Regulation (GDPR), you have the right to:
- Be informed about how we collect and use your personal data - set out in sections 2 to 5 above.
- Access, correct, update, or request deletion of your personal information.
- Object to the processing of your personal data and request data portability.
- Withdraw consent at any time (where processing is based on consent).
- Lodge a complaint with your local Data Protection Authority if you believe your rights have been violated.
If You Are a California Resident:
Under the California Consumer Privacy Act (CCPA), you have the right to:
- Request disclosure of the categories and specific pieces of personal information we have collected about you.
- Request deletion of your personal information, subject to certain legal exceptions.
- Opt-out of the sale of your personal information (note: AI Fiesta does not sell personal data).
- Be free from discrimination for exercising your privacy rights.
To exercise any of these rights, contact us at: dpo@aifiesta.ai with the subject line "Privacy Request."
8. How Quickly We Respond
Under the GDPR, we respond to a rights request without undue delay and in any event within one month of receiving it. Where a request is complex, or where you have made a number of requests, we may extend that period by a further two months - three months in total. If we need an extension we will tell you within the first month, and explain why.
Under the CCPA, we respond to a verifiable consumer request within 45 days of receiving it. Where reasonably necessary we may extend that period by a further 45 days - 90 days in total - and will notify you of the extension and the reason for it within the first 45 days.
If we cannot act on your request, we will tell you why, and let you know that you may complain to a supervisory authority and seek a judicial remedy.
9. Cookies and Tracking Technologies
AI Fiesta uses cookies and similar technologies. Essential cookies are always active; analytics cookies are set only with your consent, which you can give or withdraw at any time via the "Cookie preferences" control in the footer. See our Cookies Policy for the full list of cookies and their purposes.
10. Age & Parental Consent
- AI Fiesta is not directed towards children under the minimum digital consent age in their country (13 in the US; 16 in the EU unless lowered by law).
- By using this platform, you confirm that you meet the legal minimum age in your jurisdiction or have obtained verifiable parental consent.
- We do not knowingly collect personal data from children under these ages without consent. If we discover that such data has been provided, we will delete it promptly.
11. Third-Party Content and Links
AI responses may contain third-party information. We are not responsible for the accuracy or legality of third-party outputs.
12. Changes to Privacy Policy
We may update this policy from time to time. Continued use of AI Fiesta after updates means you accept the revised policy.
13. Contact Us
For questions, support, or legal notices, contact:
- support@aifiesta.ai
- Data Protection Officer: Mehul Saraogi - dpo@aifiesta.ai
- Fiesta Labs Inc., 1 Chestnut Hill Plaza #1088, Newark, DE 19713, Delaware, USA