Privacy Policy

1. Who we are

MithoLens is an AI-powered food photography enhancement service operated in Australia. Our platform allows food-service businesses to transform smartphone photos into professional studio-quality images using artificial intelligence.

For the purposes of this Privacy Policy, the entity responsible for your personal information is MithoLens, a registered business name of an individual sole trader, ABN 60 154 345 006, of Homebush West, New South Wales, Australia. Enquiries about your personal information should be directed to us at the contact details in Section 14.

2. Information we collect

Account information

• First and last name
• Email address
• Phone number
• Business name (café / restaurant)
• Hashed password (we never store your password in plain text)

Usage and transactional information

• Credit balance, purchases, and usage history
• Your billing name and address, which you enter at checkout with our payment provider (Stripe). Stripe holds them; we do not store them
• Generation settings chosen (background, resolution, aspect ratio)
• Timestamps and approximate IP addresses of requests
• Account activity logs (sign-in, generation events)

Your business and brand

• Your brand kit: brand name, logo, colours, font style, and the style details you choose
• Images you upload for brand analysis (for example your logo, menu, a recent post, or photos of your venue). They are sent to our AI provider to suggest your brand style, and are not kept afterwards
• The wording, prices and dates you put on flyers
• If you create a venue page: your venue's name, tagline and social media links. A venue page is public: anyone with its link or QR code can see it

Content you upload

• Food photographs you submit for AI enhancement
• AI-generated output images stored in your library

We do not collect payment card details directly — payments are processed by our third-party payment provider (Stripe) which holds its own PCI-DSS certification.

3. How we collect information

We collect information in the following ways:

• Directly from you — when you create an account, fill in your profile, upload images, or contact us.
• Automatically — when you use the Service, our servers log IP addresses, request timestamps, and feature usage to support security and debugging.
• From third parties — authentication events and session tokens are managed by our authentication provider (Supabase / AWS). If you choose to sign in with Google, Google shares your name, email address and profile picture with us.

4. Why we collect information

We collect and use your personal information only for purposes that are permitted by law and for which you would reasonably expect it to be used, including:

• Creating and managing your account
• Providing the AI photo-enhancement service
• Processing credit purchases and maintaining your credit balance
• Communicating service-related notices (account verification, password resets, low-credit warnings)
• Detecting and preventing fraud, abuse, or unauthorised access
• Complying with legal obligations under Australian law
• Improving the quality and reliability of our Service

We will not use your personal information for a secondary purpose unless you have consented, the secondary purpose is directly related to the primary purpose, or we are required or authorised by law to do so.

5. Disclosure of your information

We do not sell, rent, or trade your personal information. We may disclose your information to:

• Service providers — the hosting, storage, database, email, payment, analytics and error-monitoring providers we rely on to run the service, each bound by data processing terms. They are named individually on our Sub-processors page.
• AI and image-generation providers — we use third-party artificial intelligence and image-generation service providers to process prompts, images and other content submitted by users for the purpose of providing our image-generation services. Content is sent as API requests under paid commercial terms which provide that it is not used to train their models. These providers are also named on our Sub-processors page.
• Law enforcement and regulators — if required by Australian law, court order, or to protect our legal rights.
• Business successors — in the event of a merger, acquisition, or sale of assets, subject to the same privacy obligations.

6. Overseas disclosure

Yes. Our providers operate outside Australia, so your personal information is disclosed to and processed by overseas recipients. The countries in which those recipients are likely to be located are:

• United States — hosting, storage, database, email, payment processing, analytics, error monitoring, and AI and image-generation providers
• Singapore — database and authentication hosting

Where a provider runs a global network, your information may be processed in other countries on that network. Each provider, what it handles, and where it processes your information is listed on our Sub-processors page, which we keep current.

Before disclosing your personal information overseas, we take reasonable steps to ensure the recipient does not breach the APPs in relation to that information, including relying on the provider's data processing terms.

7. Storage and security

We take reasonable steps to protect your personal information from misuse, interference, loss, and from unauthorised access, modification, or disclosure. Measures include:

• Passwords are hashed using industry-standard algorithms (bcrypt via Supabase Auth)
• All data transmitted between your browser and our server uses TLS encryption (HTTPS)
• Access to user data is restricted to authenticated sessions using short-lived JWT tokens
• Images are stored in private, access-controlled cloud storage (Cloudflare R2) accessible only via time-limited signed URLs
• Every data request is authorisation-checked in our application layer; database row-level security policies provide an additional safeguard for direct client access
• Administrative access is restricted to designated administrator accounts, and administrative actions are audit-logged

No internet transmission or electronic storage is 100% secure. If you believe your account security has been compromised, please contact us immediately.

8. Your photos and generated images

AI-generated images created by the Service are stored in your private library. They are accessible only to you via your authenticated account. We do not use your food images for advertising, model training (under our current third-party agreements), or any purpose other than delivering the Service to you.

Photos you upload to the food studio or flyer studio are used to create your image and are not kept afterwards. The exception is a photo our automated safety check flags as inappropriate, which is kept for review and deleted within 180 days. The logo in your brand kit is kept until you replace it, delete the brand kit, or close your account.

You may delete images from your library at any time. When you do, they are permanently removed from our storage.

9. Cookies and analytics

MithoLens does not set cookies. Your browser stores these items for us, each only once you do something that needs it:

• Your sign-in session (local storage), saved when you log in and removed when you log out. The Service cannot work without it.
• Whether you closed the brand kit reminder in the flyer studio (session storage), so it is not shown again. Your browser clears it when you close the tab.

We use Vercel Web Analytics to count visits to our pages. It does not use cookies. For each page view it receives the page address, the referring page, your browser and device type, and your country (worked out from your IP address).

We do not currently use third-party advertising cookies or cross-site tracking technologies. If this changes, we will update this policy and, where required, obtain your consent.

Some browsers send a “Do Not Track” signal. We do not respond to it, because we do not track you across other websites and no third party tracks you across websites through our Service.

10. Your rights

Under the Privacy Act 1988 (Cth), you have the right to:

• Access the personal information we hold about you
• Correct personal information that is inaccurate, out of date, incomplete, or misleading
• Request deletion of your personal information, subject to our legal obligations to retain certain records
• Opt out of direct marketing communications (see Section 12)
• Objection about how we handle your personal information (see Section 14)

You can do some of this yourself in Settings: correct your name, business name and phone number, and download a copy of the information we hold about you with “Download my data” (under Privacy & security). To change your email address, or for anything else, contact us.

To exercise these rights, contact us using the details in Section 14. We will respond within 30 days. We will not charge a fee for access requests unless they are clearly excessive or repetitive.

11. Retention and deletion

We retain your personal information only for as long as necessary to fulfil the purposes described in this policy, or as required by law. When you close your account:

• Your account, profile, brand kits, venue page, credit history and library images are permanently deleted, and you are signed out on every device
• Our payment provider (Stripe) keeps its own records of your payments, including your name, email address and billing address, under its own legal obligations
• The activity and error records in our database are deleted within 180 days of being made, and the IP addresses in them are anonymised after 90 days. Records of actions our administrators took on your account are deleted within 365 days

12. Direct marketing

We may send you service-related emails (e.g., account verification, credit balance alerts, receipts). These are not marketing communications and cannot be opted out of while your account is active.

If we send promotional communications, we will do so in accordance with the Spam Act 2003 (Cth). Every promotional email will include a clearly visible unsubscribe mechanism. You may also contact us directly to opt out of marketing at any time.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. We will post the updated policy on our website with a revised “Last updated” date. If a change is material (for example, a new purpose for your information, or a new kind of provider we share it with), we will also email you or show a prominent notice on the Service at least 14 days before it takes effect, unless the law requires it sooner. Your continued use of the Service after a change takes effect constitutes acceptance of the updated policy.

14. Complaints and contact

If you have questions, concerns, or a complaint about how we handle your personal information, please contact us:

We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.