Imitation AI

Privacy Policy

Last updated: July 2026

1. Introduction

Imitation AI ("we", "our", "us") operates https://imitation.works. This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the GDPR.

Controller:
Marjan Milosavljević
Rotenhofg. 60, 1100 Vienna, Austria
Email: [email protected]

2. Data We Collect

2.1 Account Data

  • Email address
  • Name (if provided)
  • Profile information from external sign-in providers

2.2 Usage Data

  • Projects, boards, and prompts you create
  • AI model preferences
  • Log data (IP address, browser type, access times)

2.3 Payment Data

  • Processed by our payment provider (card numbers are stored solely by the payment provider)
  • Billing address and transaction history

3. How We Use Your Data

  • To provide and maintain our service
  • To process payments and subscriptions
  • To send service-related communications
  • To improve our platform
  • To comply with legal obligations

3a. Legal Basis

We process your data based on:

  • Performance of a contract (Art. 6(1)(b) GDPR): account creation, service delivery, payment processing
  • Legitimate interest (Art. 6(1)(f) GDPR): security, fraud prevention, service improvement

4. Data Processors & Third Parties

  • AI service providers: Routing and execution of AI requests. All providers are configured with Zero Data Retention.
  • Hosting and infrastructure: Authentication, database, and application servers. Hosted in the EU. Fully self-hosted and self-managed.
  • Payment processing: Processing of payments and subscriptions. Card numbers are stored solely by the payment provider.
  • Authentication services: Optional sign-in through external providers.
  • Network and security: Traffic protection and content delivery.

AI Processing Notice: When you use our AI features, your prompts are sent to AI providers for processing. All providers are configured with Zero Data Retention. Each prompt is used only to generate your response and is discarded afterward.

5. International Data Transfers

Some service providers operate outside the European Union. Data transfers to third countries are conducted on the basis of EU Standard Contractual Clauses (Art. 46 GDPR).

6. Data Retention

  • Account data: Until you delete your account
  • Usage data: Until you delete your account
  • Payment records: 7 years (legal requirement)
  • Server logs: 30 days

7. Your Rights (GDPR)

You have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Erase your data
  • Restrict processing
  • Data portability
  • Object to processing
  • Withdraw consent at any time

To exercise these rights, contact: [email protected]

8. Data Security

  • SSL/TLS encryption
  • Data stored in EU data centers
  • Regular security updates
  • Access controls

9. Cookies

We use essential cookies only, strictly for core functionality.

10. Children's Privacy

Our service is intended for users aged 16 and older.

11. Changes to This Policy

We may update this Privacy Policy.

12. Contact

Marjan Milosavljević
Email: [email protected]

Supervisory Authority:
Austrian Data Protection Authority (Datenschutzbehörde)
Barichgasse 40-42, 1030 Vienna
https://www.dsb.gv.at