The ProblemProductPricingBlogGet Started
Legal

Privacy Policy

Last updated

ABNI AI LTD · Company number 17088144
Registered office: The Old Ale House High Street, Shirrell Heath, Southampton, England, SO32 2JN
Data Officer: Emma Humphrey · DSR & privacy queries: privacy@abni.ai

1. Introduction

Abni provides software that helps creative and marketing teams generate and manage brand-compliant content.

This Privacy Policy explains how we handle personal data when you use Abni, interact with us, or access our services.

We take data protection seriously and aim to be clear about what we do and don’t do.

2. Who we are

Abni is the provider of the platform and is responsible for handling your personal data in accordance with applicable data protection laws, including UK GDPR.

3. The data we collect

We collect and process different types of data depending on how you use Abni.

Account and contact data

  • name
  • email address
  • company
  • role

Usage data

  • activity within the platform
  • interaction with features
  • generation and usage patterns

Content data

  • prompts you submit
  • brand materials you upload
  • generated outputs

This may include personal data if you choose to include it in your content.

Billing data

  • billing contact details
  • subscription information
  • payment records (processed via Stripe)

Technical data

  • IP address
  • device/browser information
  • system logs

Cookies

The abni.ai marketing site does not use analytics, advertising or tracking cookies, and contains no forms.

The Abni app uses an essential session cookie to keep you signed in. It is HTTP-only and scoped to your workspace, and is not used for advertising or cross-site tracking. Because these cookies are strictly necessary to provide the service, no consent banner is required. If we introduce analytics or marketing cookies in future, we will update this policy and ask for consent first.

4. How we use data

We use data to:

  • provide and operate the platform
  • generate and process outputs
  • manage accounts and billing
  • improve performance and reliability
  • maintain security
  • communicate with you

We do not sell your data or use it to train AI models, whether ours or third parties’.

5. AI processing

Abni uses third-party AI providers to generate and process content. The providers and services we use as AI sub-processors are:

  • Google Cloud (Google LLC):
    • Vertex AI — Gemini 3.x for prompt building and visual auditing; Imagen 4 Ultra for image generation. Data sent: user prompts, uploaded images, generated outputs.
    • Document AI — PDF parsing for brand guideline uploads. Data sent: PDFs you upload.
    • Retention: none. Google approved a Zero Data Retention exception for Abni on 14 May 2026, so prompts and generated content sent to Google are not retained in abuse-monitoring logs.
  • Anthropic (Anthropic PBC):
    • Claude API — used by non-critical agents. Data sent: prompts and outputs.
    • Retention: 30 days standard; up to 2 years if content is flagged for abuse review.
  • KIE.ai (US-based):
    • Image generation. Data sent: prompts and reference images.
    • Retention: KIE.ai’s privacy policy specifies retention only for account-level information (email retained while the account is active) and does not state a retention window for prompts or generated images. Zero Data Retention is not offered.
  • FAL.ai (Features & Labels Inc., US-based):
    • Image generation. Data sent: prompts and reference images.
    • Retention: FAL.ai’s privacy policy states that personal data is retained “for as long as necessary to carry out the purposes for which we originally collected it” and does not specify a retention window for prompts or generated images. Their policy includes contractual clauses for transfers from the UK/EEA. Zero Data Retention is not offered.

Zero Data Retention (ZDR) is configured with Google Cloud, our primary AI provider. Google approved a prompt-logging exception for Abni on 14 May 2026, so prompts, uploaded images and generated outputs processed by Vertex AI and Document AI are not retained for abuse monitoring.

ZDR is not available from our other AI sub-processors. Inputs and outputs sent to Anthropic, KIE.ai or FAL.ai may be retained for the periods described above for abuse monitoring and service-quality purposes.

We do not train AI models — ours or any third party’s — on your data.

You remain responsible for reviewing outputs before use.

We process data based on:

  • Contract — to provide the service.
  • Legitimate interests — to operate and improve the platform.
  • Legal obligations — for example, tax and accounting.
  • Consent — where required.

7. Data sharing

We share data only where necessary to provide the service. This includes:

  • Hosting providers — AWS
  • AI providers — Anthropic, Google, KIE.ai, FAL.ai
  • Billing providers — Stripe

We do not sell or trade personal data.

If you are a business client, our Data Processing Agreement sets out how we process personal data on your behalf.

8. International transfers

Several of the sub-processors listed in Section 5 are based outside the UK and EEA, primarily in the United States. Where personal data is transferred internationally, we rely on the following safeguards:

  • Standard Contractual Clauses (SCCs) — the European Commission’s 2021 modules, used for transfers from the EEA.
  • UK International Data Transfer Agreement (IDTA), or the SCCs combined with the UK Addendum, for transfers from the UK.
  • Where a sub-processor offers them, equivalent contractual clauses set out in their own data-processing terms.

We assess each sub-processor for adequacy of these safeguards before sending personal data, and we keep our sub-processor list under review. If you would like a copy of the safeguards in place for a specific provider, contact privacy@abni.ai.

9. Data retention and deletion

We retain data only as long as necessary.

  • active data is retained while your account is active
  • data from inactive or cancelled accounts is retained for up to 12 months, then deleted (see our Terms)
  • billing records may be retained for legal reasons (e.g. tax)
  • you can request deletion at any time

Deletion process

When you request deletion we use a staged process:

  1. Data is disabled immediately — sign-in stops working, API keys are revoked and your content is hidden.
  2. A short grace period, during which you can cancel the request and restore your account.
  3. Permanent deletion from our live systems. Copies in backups are removed when those backups expire on their normal rotation — our database point-in-time recovery window is 35 days, so backup copies expire within roughly five weeks.

What gets deleted

  • user data
  • uploaded content
  • generated outputs
  • usage records (where permitted)

To request deletion, email privacy@abni.ai.

10. Your rights

You have the right to:

  • access your data
  • correct your data
  • request deletion
  • restrict or object to processing
  • request portability
  • withdraw consent at any time, where we rely on consent

To exercise these rights, contact us at privacy@abni.ai.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ico.org.uk). We’d welcome the chance to address any concerns first — please contact us at privacy@abni.ai.

11. Security

We use appropriate technical and organisational measures to protect your data, including:

  • encryption
  • access controls
  • secure infrastructure

For a full overview of our security posture, see our Security Overview.

12. Changes

We may update this policy from time to time. Changes are posted on this page and the effective date updated.

13. If we contacted you about Abni

This section is for people at creative agencies who received a personal email from us (usually from Emma, our co-founder) showing images we made in the style of their agency’s work. It explains how we found you and what we hold.

What we hold about you

  • your name, job title and the agency you work for
  • your work email address, and the result of checking that it can receive email
  • your agency’s name, website, location and its entry on the Companies House register
  • links to your public professional profiles (for example LinkedIn) and to articles, talks or posts you have published
  • for each fact above, the public page it came from and the short passage we relied on, so we can show where it came from
  • a record of the emails we sent you, and whether you asked us not to contact you

We do not buy contact lists or use data brokers.

Where it came from

All of it comes from public sources: your agency’s own website, the Companies House register, public professional profiles, and articles found through ordinary web search. We check each fact against the page it came from before we keep it. To check that an email address can receive email, we use an email-verification service, which sees only the address.

Your agency’s images

To show you what Abni can do, we look at one image from your agency’s public website and learn its visual style. We then make new images in that style. These are new pictures, not copies, and they were not made from or for any of your clients. Your original image is permanently deleted from our systems as soon as the style has been learned, usually within minutes. We never use your images to train AI models. Anything we show our own team from your website is displayed straight from your site and not stored by us.

Why we can contact you

We rely on our legitimate interests in telling creative agencies about a product that is directly relevant to their work, and we have assessed that this is balanced against your interests. We only contact senior people at UK limited companies and partnerships, at their work address, about their work. Every email includes a one-click way to tell us not to contact you again. We use a simple score, based on the facts above, to decide who might find Abni useful. It has no legal or similarly significant effect on you, and you can object to it.

Who processes it for us

  • Amazon Web Services (hosting and storage, in Stockholm, Sweden)
  • Google (our AI models and our email accounts)
  • our email-verification provider

Where data is processed outside the UK, the safeguards described in section 8 apply.

How long we keep it

If we don’t hear from you, we delete the research about you 12 months after we last contacted you. If you ask us not to contact you, we delete it and keep only your email address and agency domain on a do-not-contact list, so we never contact you again. If you open the studio we set up for you, your account is covered by the rest of this policy.

Your choices

  • Stop all contact: use the link at the bottom of any of our emails, or email privacy@abni.ai.
  • See, correct or delete what we hold: email privacy@abni.ai and we’ll reply within one month.
  • Complain: you can contact the Information Commissioner’s Office at ico.org.uk.

Contact

Privacy queries: privacy@abni.ai
General queries: team@abni.ai
Security disclosures: security@abni.ai