Privacy Policy
Last updated September 15, 2026 · Showfolk is operated by Tribe Industries Inc.
1. Who we are
Showfolk is operated by Tribe Industries Inc. (“Tribe Industries”, “we”, “us” or “our”). We are the data controller for the personal data described in this policy. This policy explains what we collect when you use the Showfolk website and application (the “Service”), why we collect it, who we share it with and the choices you have. It applies alongside our Terms of Service.
The short version: we collect what we need to run your account, generate your ads and bill your plan. We do not sell your data, we do not show you third-party ads, and we do not use your uploads or outputs to train AI models.
2. What we collect
Account information
When you sign up we collect your name, email address and a password. Passwords are handled by Supabase, our authentication provider, and stored only as a salted hash; we never see them. If you sign in with Google, we receive your name, email address and Google profile image from Google, and Google records that you used its sign-in with us.
Brand kits and content you provide
Your brand kits and the work you do in the Service: business name and description, industry, tone, logos, product and lifestyle images, colors, font choices, website address if you import from it, headlines, sub-headlines, calls to action, instructions to the generator, collections and the outputs you generate and save.
Billing information
Payments are processed by Stripe. Stripe collects your card details, billing name and address, and shares with us your Stripe customer and subscription identifiers, your plan, its status and renewal date, and the last four digits and brand of your card so you can recognize it. We never receive or store your full card number.
Usage information
As you use the Service we record product events on our servers, such as sign-in, searches, filters used, ads viewed, generations started and completed, exports and plan changes, along with your account identifier, the time and general technical details such as browser type. Our hosting provider also keeps standard server logs that include your IP address, the pages requested and timestamps.
Removal requests and support
If you submit a removal request we collect your name, email, the company you represent, the ad concerned and your description of the claim. If you email us we keep the correspondence.
Information we do not collect
We do not collect precise location, government identifiers, financial account numbers or any special categories of personal data such as health or biometric information, and we ask you not to upload them.
3. How we use it
We use personal data for the following purposes. Where the law where you live, such as the GDPR, requires a legal basis for each purpose, it is shown in the last column.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and securing your account, signing you in | Account information, usage information | Performance of our contract with you |
| Storing brand kits, generating ads and keeping your outputs | Brand kits and content, usage information | Performance of our contract |
| Billing your subscription, tracking credits, sending receipts | Account and billing information | Performance of our contract; legal obligation to keep financial records |
| Answering support requests and removal requests | Account information, correspondence, removal-request details | Performance of our contract; legitimate interest in resolving disputes and honoring rights holders |
| Understanding how the Service is used and improving it | Usage information, aggregated content statistics | Legitimate interest in running and improving our product |
| Preventing abuse, enforcing our Terms and provider content policies | Usage information, content and outputs where abuse is suspected | Legitimate interest in keeping the Service safe and lawful |
| Sending service emails about your account, billing or changes to our terms | Account information | Performance of our contract; legal obligation |
| Sending product news, if you opt in | Account information | Consent, which you can withdraw at any time |
| Complying with law and responding to lawful requests | Whatever is relevant to the request | Legal obligation |
We do not make decisions about you using automated processing that has legal or similarly significant effects on you.
5. What our AI providers receive
Generating an ad means sending a request to an image model run by OpenAI, or by Google when OpenAI is unavailable. That request contains the reference ad you chose, the logo, colors, fonts, product image and description from your brand kit, and the headline, text and instructions you typed. It does not contain your name, email or billing details. Library ads are also sent to OpenAI to be tagged and described so they can be searched.
We use these providers through their business APIs. Under those terms they do not use content you send through the API to train their models, and they retain it only for a limited period for abuse monitoring, as described in their own policies. Requests that a provider’s safety systems decline are logged so we can investigate abuse. We do not train our own models on your content.
7. How long we keep it
- Account information: for as long as your account is open. When you close your account we delete it within 30 days.
- Brand kits, uploads, collections and outputs: until you delete them or close your account, after which they are deleted within 30 days. Copies may remain in encrypted backups for up to 90 days more.
- Billing records: Stripe and we keep invoices and transaction records for seven years to satisfy tax and accounting law, even after your account is closed.
- Usage events and server logs: up to 12 months, after which they are deleted or reduced to aggregate statistics that no longer identify you.
- Removal requests and copyright notices: for as long as needed to show how we handled them, typically for the life of the library record concerned.
- Support correspondence: up to 24 months after the matter is closed.
We may keep data longer where the law requires it or where it is needed to establish, exercise or defend legal claims.
8. Security
We protect your data with measures appropriate to its sensitivity. Data is encrypted in transit and at rest. Every customer table is protected by row-level security so that your data can only be read by your account. Uploads and outputs are stored in private buckets and served through short-lived signed links. Reference-library originals are never served to customers directly. Card details go straight to Stripe and never touch our systems. Access to production systems is limited to the people who need it. No system is perfectly secure, so if we learn of a breach affecting your personal data we will notify you and any regulators as the law requires.
9. Your rights and choices
Wherever you live, you can delete brand assets, collections and outputs inside the Service, manage your subscription and download invoices through the billing page, and export your outputs at any time. To change the name or email on your account, or to close it entirely, email us at support@showfolk.ai.
Depending on where you live you may also have legal rights to:
- access the personal data we hold about you and receive a copy in a portable format;
- correct data that is inaccurate or incomplete;
- delete your personal data;
- restrict or object to certain processing, including processing based on legitimate interests;
- withdraw consent where processing is based on consent;
- not be discriminated against for exercising your rights; and
- complain to a data-protection authority. In the European Economic Area or the United Kingdom you can complain to the authority where you live; we would appreciate the chance to address your concern first.
To exercise any of these rights, email support@showfolk.ai from the address on your account. We may ask for more information to verify your identity, and we will respond within the time the applicable law allows, normally within 30 days. If you live in California or another US state with a privacy law, you may use an authorized agent to make a request; we will ask the agent for proof of your written permission and may verify your identity directly. We do not sell or share personal data, so there is nothing to opt out of on that front.
10. International transfers
Tribe Industries Inc. is based in the United States and our providers process data there. If you use the Service from outside the United States, your data will be transferred to and processed in the United States, where privacy laws may differ from those in your country. For transfers from the European Economic Area, the United Kingdom and Switzerland we rely on the European Commission’s standard contractual clauses and the UK addendum with our providers, or on other mechanisms the law recognizes.
11. Children
The Service is for business use by adults. We do not knowingly collect personal data from anyone under 18, and we do not allow them to hold accounts. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy as the Service and the law change. If a change materially affects how we handle your data we will notify you by email or with a notice in the Service before it takes effect. The date at the top shows when the current version began to apply.
13. Contact
Tribe Industries Inc., operating Showfolk
2495 W Sunset Way, Layton, UT 84041, United States
Email: support@showfolk.ai
For removal of a library ad, use the removal request page.