Privacy Policy

Data controller and contact

The data controller for Dola AI is Wang Liao, an individual operator based in China, operating under the service brand Dola AI. References to “we”, “us” and “our” in this policy mean this controller.

Contact support@dolai.art with “Privacy request” in the subject, or Contact. Waffo transactions also follow Waffo's privacy policy.

Information processed

• Accounts: name/profile, email, password hashes, preferences, sessions and information authorized through third-party login.
• Creative material: prompts, negative prompts, reference images/audio, generated media, model/settings, task status and history. Photos and voices can identify people; upload only with valid rights/consent.
• Transactions: plan/pack, order reference, amount/currency, payment/subscription state, paid periods and credit ledger. We do not store full card numbers or card security codes.
• Safety/support: correspondence, reports, data-rights requests, rights declarations and prompt/output moderation decisions, including reviewer identity and decision reasons.
• Technical data: necessary cookies/session identifiers and device, IP, usage and error information processed by configured hosting/security services. Your browser may store drafts locally.

Purposes and legal bases

Account access, requested generation, result delivery, purchases, subscription/credit administration and support are processed to perform the service contract. Where applicable, security/fraud prevention and service reliability rely on legitimate interests subject to required balancing. Legal records and lawful authority requests rely on legal obligations. Optional processing that requires consent relies on that consent; it can be withdrawn. We do not treat this policy as blanket authorization for marketing.

Providers and disclosure

Cloudflare and configured database/storage providers host the service, private files and operational records. Requested prompts/settings and required reference images/audio are transmitted to the selected generation gateway/provider; routes may include fal.ai, APIMart, KIE or a configured gateway for third-party models. Provider availability and processing terms vary.

Waffo Pancake processes checkout/billing data and customer email as merchant of record. Waffo-enabled generation sends the final text prompt to Prompt Sift for safety screening; its documented text scanner is stateless and does not retain prompt text after responding. Images/audio are sent to the generation providers, not to this text-only scanner. Authentication, support and mail services process the information necessary for the option or conversation you use. Google login and embedded support services have their own policies.

We may disclose relevant information for legal requirements, safety investigations or protection of rights. We do not sell personal information. Private uploads are not automatically published. We do not promise that an independent AI provider never uses data for training unless established by the applicable arrangement.

Security, retention and transfers

We use HTTPS, password hashing, authenticated file ownership and restricted administrative access. No system guarantees absolute security. Do not email passwords or payment credentials.

Account/creative data remain as needed for service history until deletion or a valid deletion request, subject to investigation/legal exceptions. Transaction records can be retained for applicable accounting/tax duties. Support/safety records remain while a case is active and where necessary to establish/defend legal claims. Deleting an account/database record does not necessarily immediately erase payment-provider records or backups. Ask support for the applicable period for a specific record; we do not promise an automatic expiry that is not implemented.

Providers can process data outside your country. We use applicable contractual/legally recognized safeguards where required; this policy does not assert an unverified certification, data-residency guarantee or transfer agreement. Browser drafts can be removed by clearing site data, separately from server-side deletion.

Your data rights

Subject to applicable law and exceptions, you may request:

1. Information about what data is held and why.
2. Access to and a copy of your personal information.
3. Correction of inaccurate/incomplete information.
4. Deletion, subject to required retention.
5. Restriction of processing in applicable circumstances.
6. Data portability in a suitable machine-readable format where applicable.
7. Objection to eligible processing, including direct marketing.
8. Withdrawal of consent, without affecting prior lawful processing.

Use available profile/deletion settings or contact support from your account email, identifying the right and records concerned. Reasonable identity verification may be needed; do not email identity documents unless a secure, necessary process is arranged. Our target is response within 30 calendar days, or a shorter applicable statutory deadline. We explain any legally permitted extension. You may complain to your local data-protection authority; exercising lawful rights is not penalized.

Deletion may prevent delivery of related services and does not cancel renewal: cancel your subscription in Billing first. Necessary retained records will be explained where appropriate.

Cookies, age and changes

See Cookie Policy. Browser settings can clear local storage and restrict cookies; blocking necessary cookies may prevent login. The service is intended for adults aged 18 or older. Contact support about a child's personal data to arrange investigation/deletion. We update this page and communicate material changes through a service notice where appropriate.