Privacy Policy
Last updated: June 2026
This Privacy Policy explains how Winthrope ("we", "us", or "our") collects, uses, shares, and protects your personal information when you use our platform at winthrope.co.uk (transitioning to winthrope.ai) and any related services (the "Service").
By using the Service you agree to the collection and use of information as described here. If you disagree, please stop using the Service.
1. Who We Are
Winthrope is an AI creative platform operated by an individual developer based in Sri Lanka. We are the data controller for the personal information you provide when using the Service.
For any privacy-related questions or requests, contact us at support@winthrope.com. We aim to respond within five business days.
2. Information We Collect
Account data
When you register, we collect your email address, display name, and a bcrypt-hashed version of your password. We never store your plain-text password.
Usage and generation data
We store the prompts you submit, the AI-generated outputs (image / video / poster URLs), your project files, your credit balance, and generation history. This is necessary to deliver the Service — without it we cannot show you your work.
Technical data
We log IP addresses, browser type, and request timestamps for security and operational purposes. This data is retained for 90 days.
Payment data
Payments are processed by Paddle, which acts as the Merchant of Record. We do not see or store your card number, billing address, or other payment credentials — these go directly to Paddle. We receive only a transaction confirmation and the amount charged.
3. How We Use Your Information
- Provide, operate, and improve the Service
- Authenticate your account and keep it secure
- Process credit purchases and apply them to your balance
- Send transactional emails (receipt, email verification, password reset) — no marketing without your consent
- Detect and prevent fraud, abuse, and security incidents
- Comply with legal obligations
Under UK GDPR and GDPR, our legal bases are: performance of a contract (delivering the Service to you), legitimate interests (security, fraud prevention, improving the platform), and legal obligation where applicable.
4. Third-Party Services & Sub-processors
We share data with third-party sub-processors only to the extent needed to operate the Service. These fall into two categories:
Infrastructure & Payments
Payment processing and Merchant of Record. Receives your email and payment details to process transactions.
Image CDN and storage. Hosts generated images and uploaded assets.
Frontend hosting. May process request metadata (IP, headers) to serve the web application.
AI Model Providers
Winthrope integrates with multiple third-party AI providers to power generation features (images, video, audio, posters, characters, and more). When you submit a generation job, your prompt text and any uploaded reference imagesare transmitted to the relevant provider's API to produce an output. We use our own API keys — your personal credentials are never shared with these providers.
Providers we currently use include (but are not limited to):
Primary inference gateway for image and video generation models.
Large language model inference for Storybloom and template analysis features.
Growing provider list: As we integrate additional AI models, new providers will be added to this list. We will update this page when we add a provider whose data processing is materially different from those already listed. Each AI provider operates under its own data processing terms and security practices.
We do not sell, rent, or trade your personal data to any third party for advertising or marketing purposes.
5. International Data Transfers
Winthrope is operated from Sri Lanka. Our sub-processors (listed above) are based in or may process data in the United States and other countries. Where data is transferred outside the UK or European Economic Area, we rely on those sub-processors' own transfer safeguards (Standard Contractual Clauses, adequacy decisions, or equivalent mechanisms).
6. Data Retention
- Account data — kept until you delete your account
- Generated content & projects — kept until you delete them or your account
- Server logs — retained for 90 days then purged
- Backups — purged within 30 days of account deletion
7. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access — request a copy of the data we hold about you
- Rectification — correct inaccurate data
- Erasure — ask us to delete your data ("right to be forgotten")
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interests
- Restriction — ask us to restrict processing while a dispute is resolved
To exercise any right, email support@winthrope.com with your request. UK and EU users may also lodge a complaint with their local supervisory authority (e.g. the ICO for UK residents at ico.org.uk).
8. Cookies & Local Storage
We do not use third-party tracking cookies or advertising cookies. Your authentication token is stored in your browser's localStorage (under the key wt_token) so you remain logged in between sessions. You can clear this at any time by signing out or clearing your browser storage.
9. Children's Privacy
The Service is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with personal data, please contact us immediately and we will delete it.
10. Changes to This Policy
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify you by email or a notice on the platform. Continued use of the Service after the updated policy takes effect constitutes your acceptance of the new terms.
11. Contact
For privacy questions, data requests, or complaints: