Terms & policies

1. Introduction

Awesomic Inc. ("Awesomic", "us", "we", or "our") operates the websites awesomic.com and awesomic.io, the web application app.awesomic.io, and Awesomic Studio at studio.awesomic.com (together, the "Service"). This Privacy Policy explains how we collect, use, safeguard and disclose information that results from your use of the Service.

We use your data to provide and improve the Service. By using the Service, you acknowledge the practices described in this Policy.

This Privacy Policy does not constitute, create, or form part of any contract or warranty between you and Awesomic. It is provided for informational purposes under applicable privacy laws and regulations. Please check the Awesomic Terms of Service for the meaning of capitalised terms not defined in this Privacy Policy.

Where Awesomic has entered into a separate Master Services Agreement, Data Processing Agreement or equivalent enterprise agreement with a customer, and that agreement expressly governs the processing of the customer's data (including its use for AI training), the terms of that agreement prevail over this Privacy Policy to the extent of any conflict.

2. Definitions

SERVICE means the websites, applications and services described in Section 1, operated by Awesomic Inc.

PERSONAL DATA means data about a living individual who can be identified from those data (or from those and other information either in our possession or likely to come into our possession).

USAGE DATA is data collected automatically, either generated by the use of the Service or from Service infrastructure itself (for example, the duration of a page visit).

PROCESSING means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

COOKIES are small files stored on your device (computer or mobile device).

DATA CONTROLLER means a natural or legal person who (alone or jointly with others) determines the purposes for which and the manner in which any personal data are processed. For the purpose of this Privacy Policy, we are a Data Controller of your data.

DATA PROCESSORS (OR SERVICE PROVIDERS) means any natural or legal person who processes data on behalf of the Data Controller. We may use the services of various Service Providers to process your data more effectively.

DATA SUBJECT is any living individual who is the subject of Personal Data.

THE USER is the individual using our Service. The User corresponds to the Data Subject.

USER CONTENT means any data, designs, files, briefs, messages, comments, images and other materials submitted by or generated on behalf of a User through the use of the Service, including design deliverables produced by Awesomic talent.

DE-IDENTIFIED DATA means User Content from which all direct and indirect identifiers of natural persons — including names, email addresses, postal addresses, phone numbers, account credentials, payment details, facial images and other biometric identifiers, government or employee identification numbers, and free-text references that could reasonably identify a natural person — have been removed or irreversibly altered, such that the data cannot reasonably be linked to an identified or identifiable natural person or household. De-identified Data may retain non-personal elements of the work, such as design layouts, styles, colour palettes, typography and general task descriptions. Company names, trademarks and brand assets are not personal data; their use is governed by the Awesomic Terms of Service and any applicable customer agreement.

AI MODELS means artificial intelligence and machine learning models, including generative models, that Awesomic trains, fine-tunes, develops or improves, including derivative models and their outputs.

TRAINING DATA means De-identified Data used for training, fine-tuning, evaluating or improving AI Models, or included in datasets licensed to third parties.

AI PROVIDERS means third-party providers of AI model services (such as large language and image-generation models) that Awesomic uses to power AI-assisted features of the Service.

3. Information Collection and Use

We collect several different types of information for various purposes to provide and improve our Service to you.

4. Types and Sources of Data Collected

Sources of personal data

When acting as a controller, we obtain personal data from the following sources:

• Directly from you: for example, when you register a user account, communicate with us through the Service, fill in the demo form, contact customer support, or exercise your data-subject rights.
• Automatically through your use of the Service: for example, through cookies that record data about the use of our website.
• Third-party sources: from third parties whose services we use for remarketing.

Personal Data we process about you

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you ("Personal Data"). Personal Data may include, but is not limited to:

• Account data: first name, last name, email address, automatically assigned user ID.
• Authentication data: passwords.
• Compliance information: data-subject consent records, Data Subject Access Request (DSAR) records, tax records, accounting data.
• Communication data: data contained in correspondence with us.
• Contact information: name, email address, phone number.
• Financial data: billing information.
• Legal and administrative records: correspondence related to disputes, claim details, court documentation, internal investigation notes.
• Marketing data: data needed to support our marketing campaigns.
• Media content: images, user feedback.
• Support communications data: subject line, request category, message content and attached files.
• Task-specific data: design, task description, task timing and estimation.
• User Content: as defined in Section 2.
• Data collected via cookies: tracking data such as event data (page views, user actions on websites and applications).

CCPA/CPRA categories of personal information collected. For purposes of Cal. Civ. Code § 1798.130(a)(5)(B), the categories of personal information we have collected in the preceding 12 months map to the data types above as follows: (A) identifiers (account data, contact information, usage data, cookie identifiers); (B) categories described in Cal. Civ. Code § 1798.80(e) (account data, contact information, financial data); (C) commercial information (task-specific data, billing information); (D) internet or other electronic network activity information (usage data, cookie data); (E) geolocation data (approximate, derived from IP address); (F) audio, electronic, visual or similar information (media content, User Content); (G) professional or employment-related information (limited, where voluntarily provided); (H) inferences drawn from the above to create a profile reflecting preferences and behaviour; and (I) sensitive personal information (account log-in combined with password).

Usage Data

We collect information that your browser sends whenever you visit our Service or access it through a mobile device ("Usage Data"). Usage Data may include your device's Internet Protocol (IP) address, browser type and version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, mobile device type and operating system, and other diagnostic data.

Cookies and tracking technologies

We use cookies and similar tracking technologies (beacons, tags and scripts) to track activity on our Service and hold certain information. Cookies are files with a small amount of data that may include an anonymous unique identifier. Where required by law (including for visitors from the EU, EEA and UK), non-essential cookies are set only after you give consent through our cookie banner, and you can change your choice at any time via the "Cookie settings" link in the footer. You can also instruct your browser to refuse all cookies; however, some portions of the Service may then not function.

Examples of cookies we use:

• Session cookies: to operate the Service.
• Preference cookies: to remember your preferences and settings.
• Security cookies: for security purposes.
• Analytics cookies: to understand how the Service is used.
• Advertising cookies: to serve you advertisements that may be relevant to you and your interests.

5. Use of Data and Legal Bases

We use the data we collect for the purposes below. Where the GDPR or UK GDPR applies, the legal basis for each purpose is shown. Uses relating to artificial intelligence are described in Section 5A.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may request a summary of the relevant assessment by contacting [email protected], and you have the right to object at any time (Section 11).

5A. Artificial Intelligence and Machine Learning

5A.1 AI-assisted features

Parts of the Service — including Awesomic Studio — use artificial intelligence to generate, edit or suggest design content and to assist with briefs, communication and project management. To provide these features, the prompts, files and other User Content you submit to an AI feature are processed by us and by our AI Providers, listed in Section 8.5. We contract with AI Providers on business terms under which they act as our processors, may use your data only to provide the service to us, and are prohibited from using your data to train their own models. The current list of AI Providers is published at awesomic.com/sub-processors.

5A.2 Training Awesomic AI Models

We may train, fine-tune and improve our own AI Models using Training Data derived from User Content — such as design deliverables, briefs, feedback and revision history — after that content has gone through our documented de-identification process (Section 5A.3). Training takes place on infrastructure we control, hosted by our cloud provider listed in Section 8.5. We do this to improve the quality, speed and consistency of design work delivered through the Service and to develop new AI-powered products. We do not train our AI Models on identifiable personal data, on authentication data, or on financial data.

Customers in Europe. We do not use User Content of customers whose account is located in the European Economic Area, the United Kingdom or Switzerland as Training Data or in De-identified Datasets. This exclusion is applied automatically based on your account's billing country.

Existing content. We notified customers of this Section 5A on September 18, 2026. User Content created before that date will not be used as Training Data before October 18, 2026, and only where you have not opted out by then (Section 5A.5).

Legal basis. Because User Content of EEA, UK and Swiss customers is excluded, AI training does not involve personal data subject to the GDPR or UK GDPR. Where personal data of individuals protected by those laws is nevertheless present in the User Content of other customers (for example, a European contact referenced in a brief), the processing required to de-identify it is based on our legitimate interests in developing and improving our products, documented in a Legitimate Interests Assessment. Once de-identified in accordance with Section 5A.3, the resulting Training Data is no longer personal data. You may object to the de-identification and training of your User Content at any time (Section 5A.5).

5A.3 De-identification and de-identified datasets

Before any User Content is used as Training Data or included in a dataset licensed to a third party, we apply a documented de-identification process designed to remove the identifiers listed in the definition of De-identified Data, including identifiers of third parties referenced in your User Content. The process combines automated detection with human review of samples and is reviewed periodically. For datasets licensed to third parties, we additionally remove customer company names, logos and other brand assets before release; these may be retained in Training Data used solely to train Awesomic's own AI Models.

We may license De-identified Data as standalone datasets to third parties, including AI developers, research institutions and commercial partners, for AI and machine-learning training and other commercial purposes. Awesomic publicly commits (i) to maintain and use De-identified Data only in de-identified form, (ii) not to attempt to re-identify it, except to test the effectiveness of our de-identification, and (iii) to contractually prohibit every recipient from attempting to re-identify it or from using it to identify any individual. De-identified Data is not "personal information" or "personal data" under applicable privacy laws, and its licensing is not a sale or sharing of personal information.

5A.4 Third-party content in your User Content

User Content you submit may contain personal data of other people (for example, photographs, testimonials or contact details of your customers or team). You are responsible for having the right to share that content with us. We apply the same de-identification process to third-party personal data before any use for AI training.

5A.5 Your choices

You may opt out of the use of your User Content for AI training and de-identified datasets at any time using the AI Training toggle in your account settings (Settings → Legal Center), or by emailing [email protected]. Opting out takes effect prospectively from the moment it is activated: User Content created after that time will not be used as Training Data. Opting out, and deleting your account or data, does not affect AI Models that have already been trained or datasets that have already been aggregated before that time, because De-identified Data cannot be traced back to you or to your account. Opting out does not affect AI-assisted features (Section 5A.1), which you may simply choose not to use.

5A.6 Enterprise agreements

Where a customer has a separate Master Services Agreement, Data Processing Agreement or equivalent agreement with Awesomic that governs AI training or dataset use, that agreement prevails over this Section 5A.

5A.7 Automated decision-making

The Service uses automated processing, including AI, to match your tasks with suitable talent (AI matching) and to generate or structure design briefs from your inputs (AI brief). These features do not produce legal or similarly significant effects for you: you can review, edit or reject any AI-generated brief before work starts, and you may request a different talent match at any time through the Service or by contacting support, in which case a member of our team will review the match. Information for talent about how tasks are allocated is provided in the Awesomic talent terms.

6. Retention of Data

We retain your Personal Data only for as long as necessary for the purposes set out in this Privacy Policy, and to the extent necessary to comply with our legal obligations, resolve disputes and enforce our agreements and policies. Usage Data is generally retained for a shorter period, except where it is used to strengthen security or improve functionality, or where we are legally required to retain it longer.

User Content selected for AI training is de-identified no earlier than 30 days after the related task is marked complete — so that any opt-out you activate in that period is honoured — and identifiable copies are never stored in the training environment. Training Data, being de-identified, may be retained indefinitely.

7. Transfer of Data

Your information, including Personal Data, may be transferred to and maintained on computers located outside of your state, province, country or other governmental jurisdiction where data-protection laws may differ from those of your jurisdiction. If you are located outside the United States and choose to provide information to us, we transfer the data, including Personal Data, to the United States and process it there.

Where transfers are subject to EEA or UK data-protection law, we transfer personal data only where: (a) the European Commission or the UK Government has decided that the destination country ensures an adequate level of protection; or (b) appropriate safeguards are in place — in particular the Standard Contractual Clauses adopted by the European Commission and, for the UK, the International Data Transfer Addendum — together with supplementary technical and organisational measures (such as encryption and strict access controls) and enforceable rights and effective remedies for you; or (c) a specific exception applies under applicable law. If we cannot rely on any of these mechanisms, we will not transfer your personal data unless an alternative lawful mechanism is available and reflected in an update to this Policy. Please contact us for further information on the specific mechanism used.

Awesomic will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy, and no transfer of your Personal Data will take place to an organisation or country unless adequate controls are in place.

8. Disclosure of Data

8.1. Disclosure for law enforcement

Under certain circumstances, we may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities.

8.2. Business transactions

If we or our subsidiaries are involved in a merger, acquisition or asset sale, your Personal Data may be transferred.

8.3. Other cases

We may also disclose your information: to our subsidiaries and affiliates; to contractors, service providers and other third parties we use to support our business; to fulfil the purpose for which you provide it; with your consent, for the purpose of including your company's logo on our website; for any other purpose disclosed by us when you provide the information; and if we believe disclosure is necessary or appropriate to protect the rights, property or safety of Awesomic, our customers or others.

8.4. Sale and sharing of personal information

Awesomic does not sell personal information for money. We "share" personal information (within the meaning of Cal. Civ. Code § 1798.140(ah)) with advertising and remarketing partners through cookies and pixels for cross-context behavioural advertising; you may opt out as described in Section 12. The licensing of De-identified Data described in Section 5A.3 does not involve personal information.

8.5. Categories of third parties and sub-processors

The categories of third parties to whom we disclose personal information are: (i) advertising and remarketing partners (Google, Meta, X, Pinterest); (ii) analytics providers (Google Analytics, Cloudflare Analytics); (iii) cloud hosting and infrastructure providers; (iv) AI Providers that power AI-assisted features; (v) payment processors (Stripe); (vi) communications providers (Plivo); (vii) professional advisors (legal, accounting, tax and audit); and (viii) governmental, regulatory or judicial authorities where legally required. Recipients of De-identified Data (Section 5A.3) do not receive personal information.

We engage the following sub-processors to process personal data on our behalf. Each is bound by a data-processing agreement imposing confidentiality, security and, where required, Standard Contractual Clauses. The current and complete list — including all AI Providers — is maintained at awesomic.com/sub-processors, where you can subscribe to change notifications. The principal sub-processors are:

‍

9. Mobile Data and SMS Communications

We will not share, sell or rent your mobile phone number or SMS opt-in consent with third parties, affiliates or partners for their own marketing or promotional purposes. We share this information only with trusted service providers, specifically Plivo, strictly for the purpose of transmitting Awesomic's own marketing, promotional and account-related SMS communications to you.

10. Security of Data

The security of your data is important to us, but no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

11. Your Data Protection Rights

In certain circumstances, you have the following rights regarding your Personal Data:

• the right to access, update or delete the information we hold about you;
• the right of rectification, if your information is inaccurate or incomplete;
• the right to object to our processing of your Personal Data, including processing based on legitimate interests such as AI training (Section 5A.5);
• the right to request that we restrict the processing of your Personal Data;
• the right to data portability — to receive a copy of your Personal Data in a structured, machine-readable and commonly used format;
• the right to withdraw consent at any time where we rely on your consent.

We may ask you to verify your identity before responding to such requests, and we may not be able to provide the Service without some necessary data. Please note that objection, restriction or deletion does not affect AI Models already trained or De-identified Data already aggregated before your request, as explained in Section 5A.5.

To exercise these rights, email us at [email protected]. You can also delete your personal data through the Service: Settings → Profile → Legal Center → Delete Personal Data. If you are in the EU or EEA, you have the right to lodge a complaint with your local Data Protection Authority; if you are in the UK, with the Information Commissioner's Office (ico.org.uk).

12. California Privacy Rights

CalOPPA

In accordance with the California Online Privacy Protection Act: our Privacy Policy link includes the word "Privacy" and can easily be found on our home page; users will be notified of privacy-policy changes as described in Section 20; and users can change their personal information through account settings or by emailing [email protected].

CCPA / CPRA rights

Right to know: what categories of personal information we collect, the purposes for which we use it (including AI training as described in Section 5A), and whether it is disclosed to third parties.

Right to opt out of AI training: you may opt out of the use of your User Content for AI training at any time via the AI Training toggle in your account settings or by contacting [email protected].

Right to limit use of sensitive personal information: if you believe your User Content contains sensitive personal information and wish to limit its use, contact [email protected] or use the opt-out toggle.

Right to deletion: email [email protected] or use Settings → Profile → Legal Center → Delete Personal Data.

Right to opt out of sale or sharing (Cal. Civ. Code § 1798.120): you may direct us not to sell or share your personal information at any time, without creating an account, by: clicking the "Do Not Sell or Share My Personal Information" link in our website footer and within the Service; enabling the opt-out toggle in Settings; emailing [email protected] with the subject line "CCPA Opt-Out"; or enabling Global Privacy Control in your browser (below). Following an opt-out, we will wait at least twelve months before asking you to authorise the sale or sharing of your personal information again.

Right to non-discrimination: we will not discriminate against you for exercising any of these rights.

Global Privacy Control

We recognise the Global Privacy Control (GPC) browser signal as a valid request to opt out of the sale or sharing of personal information and of targeted advertising. When we detect a GPC signal, we disable advertising and remarketing cookies for that browser; if you are logged in, we also apply the opt-out to your account. Because GPC is browser-based, you need to enable it on each browser and device you use. We do not respond to the older "Do Not Track" signal, for which no industry standard exists.

12A. Other US State Privacy Rights

If you are a resident of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia or another US state with a comprehensive privacy law, you may have the right to:

1. confirm whether we process your personal data and access it;
2. correct inaccuracies in your personal data;
3. delete your personal data;
4. obtain a portable copy of your personal data;
5. opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects;
6. not be discriminated against for exercising these rights.

You may exercise these rights by emailing [email protected], through Settings → Legal Center, or via the "Do Not Sell or Share My Personal Information" link. We will respond within 45 days, extendable once by a further 45 days where reasonably necessary. If we deny your request, you may appeal by replying to our response with the subject line "Privacy Appeal"; we will respond to your appeal within 45 days (60 days for Colorado residents). If your appeal is denied, you may contact your state Attorney General.

12B. United Kingdom

If you are in the United Kingdom, references in this Policy to the GDPR include the UK GDPR and the Data Protection Act 2018. Transfers of personal data from the UK to the United States are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or another mechanism recognised under UK law. You have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk).

13. Service Providers

We may employ third-party companies and individuals to facilitate our Service ("Service Providers"), to provide the Service on our behalf, to perform Service-related services or to assist us in analysing how our Service is used. These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

14. Analytics

We may use third-party Service Providers to monitor and analyze the use of our Service.

Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our Service; this data is shared with other Google services, and Google may use it to contextualise and personalise the ads of its own advertising network. See Google's Privacy Terms (https://policies.google.com/privacy) and its data-safeguarding policy (https://support.google.com/analytics/answer/6004245). You can opt out through the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout).

Cloudflare Analytics is a web analytics service operated by Cloudflare, Inc. Privacy policy: https://www.cloudflare.com/privacypolicy.

15. Development Tools

GitHub, provided by GitHub, Inc., is a development platform we use to host and review code, manage projects and build software. Privacy statement: https://help.github.com/en/articles/github-privacy-statement.

16. Behavioural Remarketing

We use remarketing services to advertise on third-party websites to you after you have visited our Service. We and our third-party vendors use cookies to inform, optimise and serve ads based on your past visits, subject to your cookie consent and the opt-outs described in Section 12.

Google Ads: opt out and customise ads at http://www.google.com/settings/ads. X (Twitter): https://support.twitter.com/articles/20170405. Meta (Facebook): https://www.facebook.com/help/568137493302217; Meta adheres to the Digital Advertising Alliance's Self-Regulatory Principles — you can also opt out via http://www.aboutads.info/choices/ (USA), http://youradchoices.ca/ (Canada) or http://www.youronlinechoices.eu/ (Europe). Pinterest: http://help.pinterest.com/en/articles/personalization-and-data.

17. Payments

We may provide paid products and services within the Service and use third-party payment processors. We do not store or collect your payment card details; that information is provided directly to our payment processors, whose use of your personal information is governed by their own privacy policies. Our payment processors adhere to the PCI-DSS standards managed by the PCI Security Standards Council. We work with Stripe (https://stripe.com/us/privacy).

18. Links to Other Sites

Our Service may contain links to sites not operated by us. We strongly advise you to review the privacy policy of every site you visit. We have no control over, and assume no responsibility for, the content, privacy policies or practices of any third-party sites or services.

19. Children's Privacy

Our Service is not intended for use by anyone under the age of 18 ("Children"). We do not knowingly collect personally identifiable information from Children. If you become aware that a Child has provided us with Personal Data, please contact us; if we learn that we have collected Personal Data from a Child without verification of parental consent, we will take steps to remove that information from our servers.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated Policy on this page and update the "Effective date" at the top. Changes that do not materially affect your rights take effect when posted.

Where a change materially expands how we use personal data we have already collected — for example, a new purpose of processing — we will notify you at least 30 days before the change takes effect by email to the address on your account and/or by a prominent notice in the Service, and we will not apply the new purpose to previously collected data until that notice period has ended and you have had the opportunity to exercise any applicable opt-out. Your continued use of the Service after the effective date constitutes acknowledgement of the updated Policy.

21. Contact Us

If you have any questions about this Privacy Policy, please contact us by email at [email protected] or [email protected], or by post at Awesomic Inc., 1111B S Governors Ave, Dover, DE 19904, United States.