12ui Privacy Policy

This policy applies to:

• visitors to 12ui.com;
• account holders who sign in to the Service;
• developers and users of the 12ui API, CLI, and agent skills;
• anonymous users of the public preview tier;
• individuals whose personal information appears in content uploaded to the Service, for example a name or email address visible in a screenshot;
• people who contact us for support, privacy, or other reasons.

Two roles apply. For personal information embedded in images, prompts, and other content a customer uploads (Customer Content), the customer decides why that content is processed, and we process it for the customer as a processor, service provider, or similar role - our Data Processing Addendum applies, and the customer's own privacy policy may also apply. For account, website, quota, security, and support information, we act as the controller.

Peter Industries Pty Ltd ABN 13 588 984 088, trading as 12ui, is based in Queensland, Australia.

Address: 12 Dulku Close, Port Douglas, QLD 4877, Australia Privacy contact: privacy@12ui.com Support contact: support@12ui.com

12ui turns design concepts and images into structured design output. Users can search a curated design reference corpus (/search), generate candidate design images from a text concept (/draft), extend a chosen design into additional screens (/branch), and convert a single image into a structured LayerDoc with derived exports such as responsive HTML and app code (/convert). The same capabilities are available through the API, CLI, and agent skills.

Signed-in users receive a daily free allowance and may add prepaid wallet credit for usage beyond it. Stripe processes Checkout, payment methods, receipts, refunds, and disputes. We operate the 12ui wallet and usage ledger, but do not receive full payment card numbers.

4.1 Account information

Sign-in is handled by the shared Just Every login service at login.justevery.com, which is operated within our own corporate group, not by a third party. When you create an account or sign in, we process your email address, a user identifier, and session records. Sign-in cookies are set on the .justevery.com domain.

4.2 Uploaded content and prompts

When you use the Service, we collect the images you upload (PNG, JPEG, or WebP), the text prompts and search queries you enter, and reference selections you make. Alongside each upload we record the account identifier, original filename, media type, byte size, pixel dimensions, processing status, cost, and timestamps.

Uploaded screenshots may incidentally contain personal information visible in the image, such as names, email addresses, or account details. This information is processed as part of the image to provide the Service. Do not deliberately submit sensitive or regulated information such as health data, payment card numbers, government identifiers, biometric templates, or children's data.

4.3 Generated artifacts

We store the outputs the Service generates for you - LayerDocs, generated and edited images, and exports - so you can retrieve them during the retention window described in section 10.

4.4 API keys

API keys are issued through device sign-in, scoped, and revocable. We store key identifiers, scopes, and associated usage records. Keys can be revoked at login.justevery.com or through the CLI. The CLI stores your credentials locally on your own machine.

4.5 Anonymous use and quota controls

Anonymous use is supported without an account. To enforce fair-use quotas, your browser generates a random visitor token (stored in your browser's localStorage) and we derive a salted hash of your IP address. Your raw IP address is passed to Cloudflare Turnstile for bot verification. We do not use these identifiers to build behavioural profiles.

4.6 Website, device, and usage information

Our infrastructure runs on Cloudflare. When you access the Service, we collect request metadata such as IP address, browser type, pages requested, timestamps, request identifiers, error details, diagnostic data, and security information. Application logs record request metadata and identifiers, not image content.

4.7 Cookies and local storage

We use session cookies only: the 12ui session cookie and the sign-in cookies described in section 4.1. We do not use advertising cookies, analytics or tracking cookies, or retargeting technologies. Your browser's localStorage holds the visitor token, your local conversion history, the pipeline collection tray, and prompt drafts; sessionStorage holds idempotency keys and your recently viewed Design Search results for the life of the browser tab. Apart from the visitor token, which accompanies your requests, this locally stored data stays on your device.

4.8 Billing and payment information

If you add wallet credit, we collect your 12ui account identifier, billing email, transaction amount and currency, Stripe customer and transaction identifiers, payment status, refunds or disputes, auto-recharge settings, wallet balance, and itemised 12ui usage ledger. Stripe collects and processes payment-card and other payment credentials under its own privacy terms. We receive limited card details from Stripe, such as brand, expiry, and last four digits, when needed to identify a saved method; we do not receive the full card number or security code.

4.9 Communications and support

If you contact us, we collect your contact details, message content, and attachments so we can respond and keep business records.

We use information to:

• provide, operate, maintain, and secure the Service;
• process uploaded images and prompts with AI models to generate the artifacts you request;
• enforce quotas, reserve and settle prepaid usage credit, process top-ups and refunds, verify that requests come from real users, and prevent fraud, abuse, and misuse;
• maintain durable usage and cost ledgers so paid model work is never repeated on retry;
• test and improve conversion quality, including through the internal evaluation corpus described in section 10;
• administer accounts, API keys, and support;
• debug, audit, and troubleshoot the Service;
• comply with law, enforce agreements, and protect rights;
• send service and security emails.

Third-party AI providers process uploaded content on our behalf to provide the Service: OpenAI performs image and document analysis, image generation, and image editing; fal.ai performs image segmentation, background removal, and object extraction (temporary derived image tiles on fal.ai expire within about one hour); and Google provides text embeddings for Design Corpus search queries. Stripe processes payments and related fraud signals. These providers are separate sub-processors that perform this processing on their own platforms; Cloudflare provides our hosting and infrastructure but does not perform AI inference. Our current sub-processors are listed at /subprocessors.

We do not authorise these providers to use Customer Content to train generally available models. We use Customer Content for our own quality improvement only as described in this policy and our Terms of Service.

AI outputs may be inaccurate. Generated designs and code are provided for your review, not as professional advice, and we do not use the Service to make decisions that produce legal or similarly significant effects about individuals.

We may disclose information to:

• service providers and sub-processors that provide hosting, storage, AI processing, payments, bot protection, and security services - see /subprocessors;
• professional advisors, insurers, auditors, and legal representatives;
• regulators, courts, law enforcement, government authorities, or other parties where required or permitted by law;
• parties involved in a merger, acquisition, financing, reorganisation, sale of assets, or similar corporate transaction;
• other parties with your consent or at your direction.

We do not use advertising or analytics trackers, we do not engage in retargeting, we do not send marketing email, and we do not sell or share personal information for advertising purposes.

Where GDPR or UK GDPR applies and we act as a controller, we rely on one or more of the following legal bases:

• contract, to provide the Service, accounts, and support;
• legitimate interests, to operate, secure, and improve the Service, prevent abuse, and communicate with users, where those interests are not overridden by individual rights;
• consent, for optional features where consent is required;
• legal obligations, to comply with tax, accounting, court, regulatory, and security obligations.

Where we process Customer Content as a processor, the customer is responsible for identifying the applicable legal basis for its processing.

We keep personal information only for as long as reasonably needed for the purposes described in this policy, unless a longer period is required or permitted by law. In general:

• conversion artifacts - uploaded images and generated outputs - are retained while they are needed to deliver, support, and secure your result, and are then removed by automated cleanup;
• uploaded images and generated outputs may be retained beyond that cleanup in an internal evaluation corpus we use to test and improve conversion quality; corpus copies are used for offline quality testing, are not published, and are not added to the Design Corpus, and we delete them on verified request to privacy@12ui.com;
• durable usage, wallet, payment, refund, dispute, and cost ledgers are retained for accounting, tax, fraud prevention, reconciliation, and audit purposes;
• logs, diagnostic records, and security records are retained for a limited period needed for troubleshooting, security, and abuse prevention;
• account and session records are retained by the Just Every login service while your account is active;
• de-identified and aggregated data may be retained for longer because it does not identify an individual.

We may create de-identified or aggregated data that does not identify an individual and use it to operate, improve, and benchmark the Service. We do not attempt to re-identify de-identified data except where permitted by law, such as to test our safeguards or investigate misuse.

12ui is based in Australia. We and our service providers process information in the United States, the European Union, Australia, and other countries where Cloudflare's network and our AI providers operate. These countries may have privacy laws different from those in your location. Where required, we use appropriate safeguards for international transfers, such as contractual protections, data processing agreements, standard contractual clauses, UK addenda, or other lawful transfer mechanisms.

We use reasonable administrative, technical, and organisational measures designed to protect personal information, including encryption in transit, a strict content security policy, HTTP Strict Transport Security, signed expiring artifact URLs, access controls, logging, and monitoring. CLI credentials are stored on your machine with restricted file permissions.

No method of transmission or storage is completely secure. You are responsible for keeping your account, API keys, devices, and exports secure.

Depending on your location, you may have rights to request access, correction, deletion, restriction, portability, objection, withdrawal of consent, or information about how your information is processed.

Australia

If Australian privacy law applies, you may request access to or correction of your personal information and may make a privacy complaint. We will respond within a reasonable time. If you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner.

EEA, UK, and Switzerland

Where GDPR, UK GDPR, or similar law applies and we act as controller, you may have rights to access, rectify, erase, restrict, object, port your data, withdraw consent, and lodge a complaint with a supervisory authority. Where we act as processor for a 12ui customer, we may refer your request to that customer.

California and other US states

Depending on applicable law, you may have rights to know, access, delete, correct, obtain a copy of, and limit certain uses of personal information, and not to be discriminated against for exercising privacy rights. We do not sell personal information, and we do not use personal information for targeted advertising. We honour legally recognised opt-out preference signals, including Global Privacy Control, where required and technically feasible; because we set no advertising or analytics cookies, there is nothing further for such signals to disable.

To exercise privacy rights, contact privacy@12ui.com. We may need to verify your identity before responding. If your request concerns personal information contained in another customer's Customer Content, we may ask you to contact that customer or forward the request to them. Authorised agents may submit requests where permitted by law; we may require proof of authorisation.

We send service and security emails only, such as account notices and security alerts. We do not send marketing email.

The Service is not directed to children, and customers must not use the Service to process children's personal information. If you believe a child has provided personal information to us, contact privacy@12ui.com.

Exports and generated documents may reference third-party services (for example, exported HTML may load fonts from the Google Fonts CDN when you open it), and our website may link to third-party sites. We are not responsible for their privacy practices. Review their privacy policies before using them.

We may update this Privacy Policy from time to time. The updated version will be posted on our website with a new "Last updated" date. If changes are material, we will take reasonable steps to notify affected users.

Peter Industries Pty Ltd ABN 13 588 984 088, trading as 12ui Address: 12 Dulku Close, Port Douglas, QLD 4877, Australia Privacy contact: privacy@12ui.com Support contact: support@12ui.com

We will respond to privacy complaints within a reasonable time. If you are in Australia and are not satisfied with our response, you may contact the Office of the Australian Information Commissioner. If you are in the EEA, UK, Switzerland, California, or another jurisdiction with privacy rights, you may have the right to contact your local regulator or attorney general.