Privacy Policy

1. Data Controller

The individual operator identified at the top of this page is the data controller for Tracy Draw. Send privacy, data, security, and account requests to support@draw.leolovetracy.com. No separate Data Protection Officer is currently appointed.

2. Information We Collect

We collect only information needed to provide and protect Tracy Draw. The specific information depends on the features you use.

• Account and authentication information: email address, account identifier, display name if set, password hash or verification status, login sessions, account status, and invitation relationships.
• Creation content: prompts, reference images, generation settings, style choices, generated images, task records, and content saved to your asset history.
• Poster and avatar content: event name, time, location, guest name and title, guest photos, contact images or QR codes, logo choice, conversation messages, attachments, voice input, and recognized text.
• API information: API key identifier, prefix, suffix, hash or verification record, permissions, creation and revocation times, last-use time, and related request logs. We do not display the full API key again after creation.
• Credits and payments: credit balance and ledger, plan, order number, amount, currency, payment status, payment channel, refund status, and transaction time. Tracy Draw does not store full card numbers.
• Support information: emails, issue descriptions, attachments, transaction or task identifiers, and our records of handling a request.
• Technical and security information: request time, IP address or approximate country/region decision, browser and device information, errors, performance, access, and security logs. Payment-market routing does not save the source IP on the payment order.

3. How We Use Information

We process information to perform our service contract, pursue legitimate interests in protecting the Service and users, comply with legal obligations, or obtain consent where required.

• Create and protect accounts, authenticate access, manage API keys, and provide requested features.
• Send prompts, images, voice, and necessary settings to relevant providers to generate images, organize poster information, recognize speech, and return results.
• Process one-time payments, grant credits, record usage and credit returns, and investigate refunds and billing disputes.
• Store and display generation history and provide downloads, deletion handling, and customer support.
• Troubleshoot failures, monitor performance, prevent fraud, abuse, and security incidents, and comply with law.
• Send necessary login, billing, security, policy-change, and support communications.

4. Cookies, Local Storage, and Analytics

Tracy Draw uses cookies and browser storage needed to run the site, such as a language preference cookie and login token, theme, interface preferences, and pending payment state kept in local or session storage. These support authentication, interface restoration, and core functions.

You can clear this data through your browser, but you may need to sign in again or reset preferences. Tracy Draw currently uses no analytics SDK, advertising pixel, or marketing tracker and does not run targeted advertising. If non-essential analytics or marketing tools are added later, we will update this Policy first and provide choice or consent where required by law.

5. AI Content and Model Training

To complete a request you initiate, we send necessary prompts, reference images, attachments, voice, or generation settings to the selected third-party providers. Do not submit personal information, confidential material, or third-party content you are not authorized to process.

Tracy Draw itself does not use your inputs or outputs to train AI models. We ask providers to process only data needed for the requested service. A third party's own retention and training practices are governed by its terms, privacy policy, and applicable arrangements with us; we do not make absolute promises beyond those documents on its behalf.

6. Providers and Data Sharing

We do not sell personal information or use it for cross-context behavioral advertising. We disclose only data necessary for the purposes below, or when you consent, law requires disclosure, or disclosure is needed to protect rights and security.

• GRSAI and APIMart: receive prompts, reference images, settings, and task identifiers needed for image generation and return generated results.
• DeepSeek: processes Toastmasters poster conversations, requirement organization, text correction, and related text or attachment analysis.
• Alibaba Cloud DashScope: processes poster voice input, speech recognition, and necessary text-correction workflows.
• Alibaba Cloud OSS and hosting infrastructure: store uploads, generated results, and operational data, and provide content delivery and computing services.
• Waffo Pancake: provides hosted checkout for internationally routed orders and processes cards, Apple Pay, or Google Pay. Full card details do not pass through or remain on Tracy Draw servers.
• XorPay and WeChat Pay: process WeChat payments and payment status for mainland-China-routed orders.
• Email and support infrastructure: send verification and necessary service emails and receive customer service, refund, privacy, and security requests.
• Regulators, courts, or law enforcement: receive necessary information when required by applicable law or a valid order, or when needed to protect users, the public, or Service security.

7. Storage and International Processing

Tracy Draw and its providers may process data in China and other countries or regions needed to provide the Service. Your information may therefore be transferred to a jurisdiction with data-protection rules different from those where you live.

We limit the scope of transfers and use reasonable technical, access-control, and contractual measures. For a market that requires a specific cross-border mechanism, we will assess and implement the relevant requirement before formally opening that market and transfer. This Policy does not claim unverified certifications, adequacy decisions, or Standard Contractual Clause arrangements.

8. Retention

We retain information for the time needed to fulfill its purpose, resolve disputes, maintain security, and meet legal duties, and then delete or de-identify it. Confirmed deletion requests are processed from active systems. Backup or disaster-recovery copies may remain in a rotation cycle for up to 90 days and are access-restricted during that period.

• Account information: while the account is active and for up to 90 days after closure, unless law, security, or an unresolved dispute requires longer retention.
• Generated content, prompts, uploads, poster sessions, attachments, and voice content: until the relevant content is deleted at your request or the account is closed, then for up to 90 days.
• Order, payment, refund, and necessary financial records: seven years from the transaction for accounting, tax, refund, and dispute obligations.
• Customer support, privacy, and refund-request records: two years after the request is closed.
• Security, access, and failure logs: generally 12 months; information related to an active incident may remain until the investigation and legal duties are complete.
• API key records: until revocation or account closure; a minimal security audit record may remain for the security-log period.

9. Your Data Rights

Depending on applicable law, you may request information about processing, access or export personal information, correct inaccurate information, delete information, restrict or object to certain processing, obtain a portable copy, or withdraw consent-based processing. Withdrawal does not affect processing that was lawful before withdrawal.

Send a request from the email associated with your account to support@draw.leolovetracy.com and describe its scope. We may verify identity to prevent unauthorized access or deletion. We acknowledge the request within two business days and make a decision within five business days. Complex requests may take longer to complete; we will explain why, give an expected time, and comply with any final deadline required by applicable law.

Some information cannot be deleted immediately because of financial, anti-fraud, security, or other legal obligations. You may also complain to a competent data-protection, consumer-protection, or other regulator where you live.

10. Security and Incidents

We use reasonable measures proportionate to risk, including HTTPS transport, password hashing, API key protection, access controls, separation of payment data, logging, and backup controls. No internet service can guarantee absolute security, and you should protect your login credentials and API keys.

If a personal-information security incident may affect your rights, we will contain, investigate, and remediate it and notify affected users and competent authorities as required by applicable law.

11. Children

Tracy Draw is only for users aged 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor submitted information, contact the support email immediately so we can investigate and take appropriate deletion steps.

12. Marketing and Third-Party Links

Tracy Draw does not currently send marketing communications. Account verification, billing, security, policy-change, and support replies are necessary service communications. If we introduce marketing later, we will obtain consent where required and provide an easy opt-out.

The Service may link or redirect to third-party websites, payment pages, or services. A third party's own privacy policy applies to information it collects directly. We recommend reviewing that policy before use.

13. Policy Changes and Language

We may update this Policy. Material changes will generally be announced on the website or sent to the registered email at least 15 days before they take effect, and the date on this page will be updated. Urgent changes required by law, security, or abuse prevention may take effect immediately.

If the Chinese and English versions conflict, the English version controls unless mandatory law requires otherwise.

14. Contact Us

Send privacy, access, export, correction, deletion, account-closure, security, billing, and refund requests to support@draw.leolovetracy.com. Website: draw.leolovetracy.com.