Effective date: June 16, 2026
Ktlyst ("we", "us", "our") operates a web-based AI image generation platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information. By using Ktlyst you agree to the terms described here.
You provide: email address, password (or Google account ID), uploaded images, canvas content, notes, and support messages.
Collected automatically: usage data (features used, generation counts) and authentication cookies. Our error-monitoring is configured not to attach IP addresses, request headers, or cookies to error reports. Our infrastructure providers may process server access logs (which can include IP addresses) transiently on our behalf to operate and secure the service.
Third-party processors (sub-processors): We use the following service providers to operate Ktlyst:
Your prompts and uploaded reference images are sent to our AI providers (fal.ai and OpenAI) only to generate and analyze images at your request and return the result to you. We never use your content to train AI models, and we never sell it. OpenAI does not use data submitted through its API to train its models; fal.ai processes your content under its own terms and privacy policy to run the generation. We encourage you to review those providers' policies.
We do not sell your personal data for money. Note that under some U.S. state laws (e.g. California), enabling analytics cookies may be treated as a "sale" or "share" of personal information — see "California Privacy Rights" below for how to opt out.
Marketing emails (newsletter): We send product news and update emails only if you opt in. Consent is off by default; you can turn it on or off anytime in Settings, and every newsletter includes a one-click unsubscribe link. Opting out does not affect essential account emails (such as security and billing notices), which we send as part of providing the service.
For EEA users, we process personal data under: contract performance (to provide the service), legitimate interests (security, improvement), legal obligation, and consent where requested.
You have the right to access, correct, delete, port, or restrict your data. To exercise these rights, email privacy@ktlyst.art at any time. We will respond within 30 days. You may also delete your account from Settings; if you have an active paid subscription, cancel it first so billing stops. Deletion removes your personal data within 30 days — except for records we are legally required to retain, such as billing and transaction records (see "Data Retention" below).
If you are a California resident, you have the right to know what personal information we collect and how it is used, to access and delete it, to correct it, to opt out of any "sale" or "sharing," and to not be discriminated against for exercising these rights.
Categories collected: identifiers (email, account ID), commercial information (subscription and purchase records), internet activity (usage data, analytics), and user content you upload or generate. Sources and purposes are described in sections 2–3.
Do Not Sell or Share My Personal Information: We do not sell personal information for money. To the extent enabling analytics cookies constitutes a "sale" or "share," you can opt out by declining analytics in our cookie banner. We also honor the Global Privacy Control (GPC) browser signal: if your browser sends GPC, analytics is treated as declined automatically.
To exercise any of these rights, email privacy@ktlyst.art.
We retain your data while your account is active. Upon account deletion, your personal data — including canvases, notes, and images in our cloud storage — is removed within 30 days.
Exception — legally required records: Billing and transaction records (e.g. invoices and payment records held by our payment processor) are retained for the period required by applicable tax and accounting law, even after you delete your account. We rely on the GDPR "legal obligation" basis for this retention. Once the legal retention period expires, these records are deleted or anonymized.
Your data may be processed in the United States and other countries where our service providers operate. We rely on standard contractual clauses for transfers outside the EEA.
We use two kinds of cookies: essential cookies (authentication tokens — always on, required for the service to work) and analytics cookies (Google Analytics), which load only if you accept them via our cookie banner. We use no advertising cookies. You can decline analytics cookies and still use Ktlyst fully; your choice is remembered and can be changed anytime via the "Cookie preferences" link in the site footer. We also honor the Global Privacy Control (GPC) browser signal as an opt-out of analytics.
Ktlyst is not directed to children under 16. We do not knowingly collect data from children.
We use TLS encryption in transit and access controls on stored data. No internet transmission is 100% secure.
We may update this policy. Material changes will be notified by email or in-app notice.
Email: privacy@ktlyst.art
Operator: Legal Notice