Back to home

Privacy Policy

Last updated: 20 August 2026

1. Data Controller

NOCTURNA NETWORK LTD (Company Number 16846806, VAT 506869363), registered at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, is the data controller for personal data processed via IgnisGen.

Contact: ignisgen@ignisgen.com

2. Data We Collect

  • Account data: email, hashed password, account creation date
  • Payment data: processed by Stripe (we do NOT store card details). We store transaction IDs and pack purchases.
  • Usage data: themes generated, generation timestamps, credit balance, IP address, user agent
  • Content: prompts, brand briefs, uploaded logos and base themes
  • Technical: cookies (session token, CSRF), logs (for security)

3. Purposes and Legal Basis (Art. 6 GDPR)

  • Service delivery (contract): account management, theme generation, downloads
  • Payment processing (contract): Stripe transactions
  • Security and fraud prevention (legitimate interest)
  • Service improvement (legitimate interest): anonymized usage analytics
  • Legal compliance (legal obligation): tax records, chargeback handling

4. Retention

  • Account data: retained while account is active + 12 months after deletion
  • Payment records: 10 years (UK VAT law)
  • Generated themes: kept 30 days after generation, then payloads retained for regeneration (max 10 versions per theme)
  • Uploaded assets: 30 days after theme deletion
  • Logs: 90 days

5. Third-Party Processors

  • Stripe (payments, USA/EU) — SCC compliant
  • Anthropic (Claude) (AI generation, USA) — GDPR-compliant
  • Google (Gemini nano-banana) (image generation, USA) — GDPR-compliant
  • Emergent (hosting) — infrastructure provider
  • MongoDB Atlas (database) — GDPR-compliant
  • Resend (transactional email, USA/EU) — sends password reset emails only, no marketing.
  • Plausible Analytics (EU-hosted, cookie-less analytics) — no personal data, no cookies.

Uploaded content and prompts may be sent to Anthropic/Google for AI processing. These providers do NOT retain data for training.

6. International Transfers

Data may be transferred outside the UK/EEA to the United States. Transfers are protected via Standard Contractual Clauses (SCCs).

7. Your Rights (GDPR / UK GDPR)

You have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Delete your account and data ("right to erasure")
  • Data portability (export account data)
  • Object to processing
  • Restrict processing
  • Withdraw consent (where applicable)
  • Lodge a complaint with the ICO (Information Commissioner's Office, UK) or your local supervisory authority

To exercise rights: email ignisgen@ignisgen.com. We respond within 30 days.

8. Cookies

See our Cookie Policy at /cookies.

9. Security

  • Passwords hashed with bcrypt
  • HTTPS enforced (TLS 1.2+)
  • Session cookies httpOnly + Secure
  • Rate limiting on sensitive endpoints
  • Regular security reviews

10. Children

The Service is not intended for children under 18. We do not knowingly collect data from minors.

11. Changes

Material changes to this policy will be notified via email 30 days before taking effect.

12. Contact

Data Protection Officer: ignisgen@ignisgen.com
NOCTURNA NETWORK LTD, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, UK