Privacy Policy

1. Introduction

Gobostock is operated by TARNIVO LABS LLC, a New Mexico limited liability company ("Gobostock," "we," "our," or "us"). We are the controller of the personal information described here. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered image, video, audio, and design platform and marketplace (the "Service").

By using our Service, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password (stored only as a one-way hash), and profile details when you register
• Terms Acceptance: That you accepted the Terms of Use (including its 18+ requirement) and this Privacy Policy, how (the notice on the sign-up form or the one shown with Google sign-in), the version of the Terms, and when
• Payment Information: Your name, billing address, the plan you bought, payment status, and the tax charged, as Link and Stripe report them to us. Card and other payment method details are collected by Stripe or Link at checkout; we never see full card numbers
• Payout Information (contributors): Your payout country and, if Gobostock sends your payouts, the details you enter for them: account holder name and address, bank name and country, IBAN or account number, SWIFT/BIC, local bank code, and account currency, or your Wise or PayPal email address
• Tax Forms (contributors): For IRS Form W-8BEN, your name, country of citizenship, residence and mailing address, US and foreign tax identification numbers, date of birth, any treaty claim, and your electronic signature; for Forms W-8BEN-E and W-9, the signed form you upload and the name, address, tax identification numbers, and tax status we record from it
• Tax Statement Preference (contributors): Whether you agreed to receive annual tax statements electronically, and when
• Content and Prompts: Text prompts, images you upload for editing, content you create using our Service, and marketplace submissions (including files, titles, captions, tags, location or capture metadata, releases, and related listing materials)
• Voice Samples and Photos of People: Recordings you upload to create a custom voice, their transcripts, and reference photos you upload for characters, together with the consent you confirm for them (see Section 4)
• Communications: Messages you send to our support team or feedback you provide

2.2 Information Collected Automatically

• Usage Data: First-party usage logs of the pages you visit, the features you use, and your generation history, recorded by our own servers (we do not use third-party analytics or advertising trackers)
• Device Information: Browser type, operating system, and IP address
• Cookies: A sign-in cookie, a language preference, your cookie choice, a short-lived checkout cookie when you buy without an account, and an optional first-party acquisition cookie that records how you first reached us (see Section 9)
• Log Data: Server logs including access times, error reports, and the website that referred you
• Signature Records: When you sign a tax form electronically, the time of signing and one-way hashes of your IP address and browser identifier, kept as evidence of the signature
• Checkout Region: When you start a subscription or buy a license, your browser's time zone, used only to decide whether the EU, EEA, or UK right-of-withdrawal question applies to you. We keep the resulting region (EU/EEA/UK, elsewhere, or unknown) and your answer with the order and in the payment processor's checkout record, not the time zone itself
• Pricing Country: When you view plan prices or start a subscription, the country of your IP address, looked up in a country database on our own servers (your address is not sent anywhere for this). It decides the currency prices are shown and charged in, and whether Link or Gobostock sells your subscription. We keep that country and currency with the subscription's checkout record, not the IP address

2.3 Information from Third Parties

• Social Login: If you sign in with Google or other providers, we receive your name, email, and profile picture
• Link and Stripe: Transaction confirmations, the name and billing address entered at checkout, tax charged, and fraud prevention data
• Payout Partner: For contributors paid through Stripe, the status of identity, tax, and payout eligibility from Stripe Connect (Gobostock does not store bank account numbers or SSNs collected by Stripe)

3. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve our Service
• Process your transactions and manage your account
• Generate AI content based on your prompts and preferences
• Host, review, protect, license, package, and commercially distribute accepted marketplace assets under the Contributor Terms (licensing of creative works, not a sale of personal data)
• Send service-related communications (account updates, security alerts)
• Send marketing communications (with your consent, which you can withdraw anytime)
• Understand usage of our own Service, from our first-party logs, to improve it
• Learn which links and campaigns bring people to Gobostock, from the optional first-party acquisition cookie (Section 9)
• Detect and prevent fraud, abuse, and security threats
• Comply with legal obligations
• Verify identity, prevent fraud, meet sanctions, tax-withholding, and tax-reporting duties, and send contributor cash-outs through Stripe or, in other countries, by bank transfer, Wise, or PayPal

4. Your Content, Voices, and Likenesses

4.1 How your content reaches AI models

Gobostock does not train AI models on your prompts, uploads, generated content, voice samples, or reference photos. To produce what you ask for, we send your prompt and the inputs you choose to the third-party AI model provider that runs the selected model, reached through our AI infrastructure provider. They process those inputs to return the result under their agreements with us or our infrastructure provider. We do not sell your prompts or content as a personal-data product.

Marketplace licensing is a separate matter. Accepted marketplace assets are processed and commercially distributed under the Contributor Terms (including licensing to buyers, packaging, previews, and Gobostock product use). That commercial grant is not a sale of personal data; delisting and survival rules in the Contributor Terms apply. Model owners also restrict how generated outputs may be used, including for AI training; see the Terms of Use and Content License.

4.2 Voice samples and custom voices

When you create a custom voice, we collect the recording you upload (3 to 30 seconds), a transcript of it, the resulting voice profile and its preview, and a consent record: the version of the consent statement you confirmed, whether the voice is your own or you are authorized by its owner, the time, and one-way hashes of your IP address and browser identifier. Some laws treat a voice recording, or a representation derived from it, as biometric data.

• Purpose: only to transcribe the sample and synthesize speech in that voice when you ask for it. We do not use voices to identify or verify anyone, and we do not sell, lease, or trade them
• Consent: we process a voice sample only after you confirm that it is your own voice or that its owner has given you permission, and we keep the consent record as evidence of that
• Recipients: a speech-to-text provider (to transcribe the sample), the voice-synthesis model provider that creates and runs the voice, reached through our AI infrastructure provider, and our cloud storage provider. The sample is stored privately and shared with a model provider only through short-lived links
• Retention and deletion: you can delete a voice at any time; that deletes its sample and stops the voice being used. Audio you already generated with it stays in your library until you delete it. When your account is deleted, all voice samples, transcripts, previews, and voice profiles are deleted. In any case we do not keep a voice sample longer than three years after your last use of the Service. The consent record is kept while content made with the voice may be in use and for as long as we need it to answer a legal claim

4.3 Photos of people and characters

Reference photos you upload for characters or edits may show a person's face. We use them only to generate the images you ask for, send them to the image model provider that runs the selected model through short-lived private links, and never use them for facial recognition or to identify anyone. You must have the consent of anyone shown (see the Terms of Use). Reference photos are kept while the character is in your account and are deleted when your account is deleted; to have a single character's photos deleted sooner, contact us.

4.4 Automated content checks and staff review

Generated images and videos go through automated content checks. When a check flags an output as sexually explicit, we withhold it from you and keep it privately so that our staff can decide whether the flag was right. A reviewer sees the output, the prompt, the model used, and which account it belongs to, and every time a reviewer opens a withheld output is logged. An output flagged by mistake is released to your library. The others are deleted after review, or about 30 days after they were withheld, unless the law requires us to preserve and report them, for example apparent child sexual abuse material (see the Terms of Use, Section 6.2). We use withheld outputs only for this review and to enforce our rules, never to train models.

5. Information Sharing and Disclosure

We may share your information with:

5.1 Service Providers

We share personal information with service providers that process it on our behalf, under contracts that require them to protect it. By category of recipient:

• Cloud hosting, database, and object storage providers: everything we hold, as stored and processed on our infrastructure
• AI infrastructure and AI model providers: your prompts and the inputs you choose (uploads, reference images, voice samples) for the generation you request
• Speech-to-text and translation providers: voice samples and audio to transcribe, and prompt or listing text to translate
• Email delivery provider: your email address and the content of account and transactional emails
• Payment processor (Stripe): subscription, billing, and fraud-prevention data
• Payout partners (Stripe, banks, Wise, PayPal): contributor payout details for cash-outs
• Tax information-reporting service: contributor tax form data needed to file and deliver tax statements

In the United States, Stripe processes subscription payments for us as our payment processor. Everywhere else, subscriptions are sold through Link, the merchant-of-record service of Stripe. At checkout Link collects your contact details, billing address, and payment method, charges you, works out and collects any tax due, and sends your receipts and invoices. Link handles that information as an independent business under its own privacy policy, not on our instructions. Contributor cash-outs use Stripe or, in countries Stripe does not serve for payouts, a bank transfer, Wise, or PayPal. Stripe's privacy policy is available at stripe.com/privacy.

5.2 Payouts, identity verification, and tax forms

Payouts through Stripe (United States, United Kingdom, European Union, Norway, Liechtenstein, Canada, and Switzerland): Stripe collects legal name, country, date of birth, government ID, tax identification number, and bank account details as required for identity verification, sanctions screening, tax reporting, and sending money. Gobostock does not store bank account numbers or Social Security numbers collected through Stripe Connect. Gobostock may store connected-account identifiers and status (for example, whether payouts are enabled and whether requirements are due).

Payouts sent by Gobostock (other countries): the payout details you enter are encrypted before they are stored, and only masked details are shown back to you. An authorized Gobostock operator decrypts them only to review them or to send a payout you requested, and each access is logged. We share them only with the bank, Wise, or PayPal that carries the payout, and where the law requires.

Tax forms: as a US company, Gobostock must collect an IRS tax form (Form W-8BEN, W-8BEN-E, or W-9) before paying contributors, except US contributors paid through Stripe, whose tax details Stripe collects. We use it to decide whether US tax must be withheld and at what rate, and to file information returns such as Form 1042-S. Tax form data and uploaded forms are encrypted at rest; an authorized operator opens them only to review a form or meet a tax duty, and each opening is logged. We give tax form information to the IRS or other tax authorities where the law requires.

Tax withholding and reporting: we use your tax form, the billing country of each sale, and your payout history to work out any US tax to withhold from a cash-out, to pay it to the IRS, and to prepare Form 1042-S or Form 1099. We share your name, address, tax identification numbers, tax status, payment amounts, and tax withheld with the IRS and with a tax information-reporting service that files and delivers these forms for us under a data processing agreement. The IRS may exchange this information with the tax authority of your country of residence under a tax treaty or information-exchange agreement. If you do not provide a valid tax form, we cannot pay you; where US law allows payment without one, tax is withheld at the highest rate that applies.

Sanctions screening: before paying a contributor, and whenever the lists change, our own systems compare the names, addresses, and countries in your payout details and tax form with the sanctions lists published by the US Treasury Department's Office of Foreign Assets Control. No decision is made by the comparison alone: a possible match is reviewed by an authorized Gobostock operator, and payouts wait until that review is complete. Where US law requires, we block funds and report them to that office.

Tax forms and tax and transaction records are retained for at least 7 years for legal and tax compliance, and sanctions screening records for 10 years, consistent with Section 7. Payout details you replace, or that a change of payout country removes, are deleted; payout records keep only the masked details.

5.3 Legal Requirements

We may disclose your information if required by law, court order, or government request, or to protect our rights, safety, or property.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

5.5 With Your Consent

We may share information for other purposes with your explicit consent.

5.6 Other Users and the Public

Content you publish on the marketplace, with its title, description, tags, and your public username, is visible to everyone. Your private generations, uploads, voices, and characters are not.

5.7 Copyright Notices

When we remove material after a copyright notice, we send the person who posted it a copy of the notice so that they can respond. That copy may include the name and contact details of the person who sent it, so if you send us a notice, the person you complain about may see yours. A valid counter-notice, with the name, address, and contact details in it, is sent to the person who sent the original notice, as the DMCA requires. See our copyright policy.

We do NOT sell your personal information to advertisers or data brokers.

6. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption of data in transit (TLS/SSL)
• Encryption at rest for the files we store (your uploads, generations, and purchased media) and for our backups
• Encryption by our application, before storage, of the most sensitive fields: tax forms, payout details, and the identity details used for sanctions screening
• Passwords stored only as salted scrypt hashes, never in readable form
• Regular security audits and vulnerability assessments
• Access controls and authentication for internal systems
• Secure cloud infrastructure with reputable providers

7. Data Retention

We retain your information as follows:

• Account Data: Retained while your account is open. When you ask us to delete your account, we complete the deletion within 30 days (see Section 8)
• Private generated content: Stored while you have an active paid subscription, subject to fair-use limits. Even while you subscribe, unpublished generations are deleted automatically 13 months after they were created, so download anything you want to keep. After a paid plan ends, unpublished generations may be deleted. We generally aim to keep them for up to 90 days if you had at least 60 days of paid history; shorter subscriptions may be deleted sooner (typically after 14 days). Marketplace listings follow the Contributor Terms
• Uploads: Stored against your plan's upload allowance. After cancel, uploads and Design Studio assets may be deleted after about 7 days if paid tenure was under 60 days, or after 30–90 days for longer-tenured accounts
• Voice Samples and Reference Photos: As described in Section 4
• Withheld Outputs: Deleted after staff review, or about 30 days after they were withheld, unless the law requires us to preserve them (Section 4.4). The review decision is kept, without the output
• Transaction Records: Retained for 7 years for legal and tax compliance
• Tax Forms: Retained while they are in force and for at least 7 years after the form expires or is replaced, for legal and tax compliance
• Sanctions Screening Records: Retained for 10 years, as US sanctions recordkeeping rules require
• Security Audit Logs: Records of sign-ins and security events, with IP address and browser, retained for up to 7 years to investigate fraud and abuse
• Server Logs: Typically retained for 90 days
• Usage Logs: First-party records linked to your account are deleted when your account is deleted; records of visits by people who are not signed in carry only a pseudonymous identifier
• Acquisition Data: The acquisition cookie expires 90 days after your first visit; if you create an account, the copy saved with it is kept until the account is deleted

8. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and associated data
• Portability: Receive your data in a portable format
• Opt-Out: Unsubscribe from marketing emails
• Restriction: Request that we limit processing of your data

To exercise these rights, contact us at contact@gobostock.com. We will respond within 30 days. You can change your name, username, email address, and password yourself in Settings.

8.1 Deleting your account

Ask from Settings ("Delete account") or by email. We confirm the request by email and complete it within 30 days, then email you again. Deleting your account:

• cancels your subscription, so it does not renew;
• deletes your private generations, uploads, projects, voices, characters and reference photos, sign-in sessions, and login methods;
• removes your marketplace listings. Buyers keep the licenses they already bought, so the files behind purchased listings are kept to serve them;
• replaces your name, email address, and username with an anonymous placeholder.

We keep what the law requires or what others rely on: invoices, credit and earnings ledgers, payout, tax, and sanctions-screening records, purchase records, security audit logs, and your age and Terms confirmation, for the periods in Section 7. If you have creator earnings that have not been paid out, we contact you about them before deleting the account.

8.2 Getting a copy of your data

Email us from your account address. Within 30 days we send you a machine-readable (JSON) file with your profile, generation history (prompts, settings, and dates), credit transactions, marketplace listings, purchases, sales, and earnings, with download links for your stored files.

10. International Data Transfers

Gobostock is based in the United States, and your information is processed there. Depending on the feature you use, it is also transferred to the recipients listed in Section 5, which may process it in the United States, the European Union, or other countries where they operate:

• cloud hosting, database, storage, and email delivery providers;
• AI infrastructure, AI model, speech-to-text, and translation providers;
• payment processors, payout partners, and our tax information-reporting service;
• tax and other authorities, where the law requires.

For transfers from the EEA, UK, or Switzerland to countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum or Swiss amendments where they apply) or on the recipient's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. Contact us for a copy of the relevant safeguards.

11. Age Requirement and Children's Privacy

You must be at least 18 years old to create an account or use the Service, and you confirm this when you sign up. We do not knowingly collect personal information from anyone under 18. If we learn that an account belongs to someone under 18, we close it and delete its data. If you believe a person under 18 has given us personal information, please contact us immediately at contact@gobostock.com.

12. California Privacy Rights (CCPA)

California residents have additional rights under the CCPA:

• Right to know what personal information is collected and how it's used
• Right to delete personal information
• Right to opt out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising privacy rights

13. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), UK, or Switzerland, you have rights under GDPR including access, rectification, erasure, restriction, portability, and objection. Our legal bases for processing include consent, contract performance, legal obligations, and legitimate interests.

For contributors: we process payout details and earnings records to perform our contract with you (Article 6(1)(b)). We process tax forms, tax withholding and reporting data, and sanctions screening records to comply with the US tax and sanctions laws that apply to us as a US company, which is our legitimate interest (Article 6(1)(f)), and to comply with a legal obligation where the law of your country imposes the same duty (Article 6(1)(c)). We send tax statements electronically only with your consent (Article 6(1)(a)), which you can withdraw at any time in your earnings settings. Requests to erase tax or payment records are subject to the retention periods in Section 7.

Where a voice sample or reference photo counts as special-category (biometric) data, we process it on the basis of your explicit consent (Article 9(2)(a)), which you withdraw by deleting the voice or character or your account. We set the acquisition cookie only with your consent (Article 6(1)(a) and the ePrivacy rules on cookies), which you withdraw at any time under "Cookie settings". We use first-party usage logs on the basis of our legitimate interest in understanding how people find and use the Service (Article 6(1)(f)).

If you are in Türkiye, you have the rights listed in Article 11 of the Law on the Protection of Personal Data No. 6698 (KVKK), including to learn whether and how your data is processed and to whom it is transferred, and to ask for it to be corrected or deleted. Your data is transferred to and processed in the United States to provide the Service and to pay you.

You have the right to lodge a complaint with your local data protection authority.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last Updated" date. For material changes, we may also send you an email notification.

Your continued use of the Service after any changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: