Privacy Policy | AI Central Tools

1. Who We Are

AI Central Tools (AICT) operates aicentraltools.com, providing 332+ AI-powered tools in 18 languages. Contact: [email protected].

2. Data We Collect

Registration: email address, display name, registration date.
Subscription: Stripe processes billing; we store only Stripe Customer ID and subscription status.
Tool usage: the text you enter into a tool and the result are sent to our AI providers (see section 7) to generate the output. We keep your input and the result for up to 90 days to run the service, prevent abuse and, if you're signed in, show your history. This applies to anonymous visitors too: their runs are stored with a hashed IP address instead of an account. After 90 days they are deleted automatically. We don't sell them. Things you choose to keep, such as runs you star, prompts you save as favorites and outputs you save to a project, stay in your account until you delete them or your account is deleted.
Usage counters: daily tool use counts per user (WordPress user meta) to enforce free-tier limits.
Affiliate referrals: if you visit via a ?ref=CODE link we store the code server-side in a PHP session (no persistent tracking cookie is set; the standard PHPSESSID session cookie expires when you close the browser) and in your user meta after signup, for commission attribution.
Analytics: Google Analytics 4 with anonymised IP addresses.
Tool submissions: the tool details you send through /submit-tool/ and a contact e-mail address. We use the address to confirm that we received your submission, to send you our decision, to answer you, and to recognise further submissions from the same address (so that one decision e-mail covers a duplicate). To limit how many submissions and confirmation e-mails one address can cause in a day, we keep a keyed hash of it for 24 hours; we keep a keyed hash of your IP address for 24 hours to limit submissions per connection. The address is never shown publicly.

3. Cookies We Use

For the full inventory with retention and purpose, see our Cookie Policy. Summary:

wordpress_* / wp-settings-* — Essential. WordPress session and login cookies.
aict_consent / aict_consent_v1 — Essential. Records your cookie banner choice (accept / reject / partial).
aict_persona — Functional. Stores your onboarding persona so we tailor tool recommendations.
aict_subscribed, aict_exit_seen — Functional. Suppress newsletter / exit-intent popups after dismissal.
_ga, _ga_* — Analytics. Google Analytics 4 with anonymised IP addresses. Only set when you accept analytics in the cookie banner.
stripe_* — Functional. Stripe payment session cookies, set only during checkout.
PHPSESSID — Functional. Only set when you arrive via a referral link (?ref=CODE) to store the affiliate code server-side.
We do not set advertising or cross-site tracking cookies.

4. How We Use Your Data

To operate and personalise the service (usage limits, account features).
To process payments and manage subscriptions via Stripe.
To send transactional emails (receipts, account confirmation) via Brevo.
To send our newsletter if you have opted in (unsubscribe any time).
To measure and improve site performance via GA4 analytics.
To attribute affiliate commissions via server-side PHP session and user meta.

5. Legal Basis (GDPR)

Contract: processing necessary to provide the service, including reviewing a tool you submit (Art. 6(1)(b)).
Legitimate interests: analytics, fraud prevention, security, including limiting abuse of the submission form (Art. 6(1)(f)).
Consent: newsletter emails (withdraw at any time).
Legal obligation: accounting records for paid subscribers.

6. Data Retention

Account data: retained while active, deleted 90 days after account deletion. Stripe records: 7 years (accounting compliance). Affiliate referral logs: 36 months. Analytics: per Google retention policy. Tool submissions: the contact e-mail is deleted 12 months after a rejection or delisting and kept while a tool is listed; the 24-hour hashes expire by themselves. Tool inputs and results: up to 90 days, for signed-in users and anonymous visitors alike; things you choose to keep (starred runs, favorite prompts, saved outputs): until you delete them or your account is deleted.

7. Data Sharing

We share data with the sub-processors below (GDPR Art. 28), depending on the tools and plan tier you use — some are used only by specific tools or by higher tiers. EU-region where available; cross-border transfers to processors outside the EEA - currently in the United States and the People's Republic of China - rely on Standard Contractual Clauses.

Stripe (US/EU) - payment processing for subscriptions; we store only your Stripe Customer ID, never card data.
Brevo / Sendinblue (EU - France) - transactional and newsletter email delivery.
OpenAI (US) - AI text + audio generation (gpt-4o-mini fallback, Whisper for transcription, TTS for voice); inputs processed transiently and not retained for training (per OpenAI API data policy).
Anthropic Claude (US) - AI text generation on every plan, for selected long-form writing tools and for Czech, Slovak and Polish output; inputs processed transiently per Anthropic API data policy.
Google Gemini (US/EU) - AI text generation (Gemini 2.5); inputs processed per Google API terms. Google no longer provides our image generation.
Cerebras (US) - high-throughput inference for selected fast-mode text-generation tools; inputs processed transiently per Cerebras API data policy, not retained for training.
Groq (US) - low-latency inference for selected fast-mode text-generation tools; inputs processed transiently per Groq API data policy, not retained for training.
Mistral (EU - France) - OCR + document intelligence for the OCR Document Scanner, Batch OCR, PDF Summarizer, PDF-to-Slides and Contract Analyzer tools. Uploaded PDFs and images are sent to Mistral for text extraction; not retained for training.
Moonshot AI / Kimi (China) - AI text generation for code and structured-output tools; your prompt is sent to Moonshot AI for processing. Inputs are processed transiently and, per Moonshot's API terms, are not used for model training. This is a cross-border transfer to the People's Republic of China, which the European Commission has not recognised as providing an adequate level of data protection; the transfer relies on Standard Contractual Clauses and your consent to use the tool. Do not submit personal or confidential data to these tools if that transfer is not acceptable to you.
DeepSeek (China) - AI text generation for code and structured-output tools; your prompt is sent to DeepSeek for processing. Inputs are processed transiently and, per DeepSeek's API terms, are not used for model training. As above, this is a cross-border transfer to the People's Republic of China and carries the same caveat.
xAI / Grok (US) - AI text generation for questions about current events; your prompt is sent to xAI for processing. Inputs are processed transiently per the xAI API data policy and are not retained for training.
ElevenLabs (US) - premium voice synthesis (TTS) for Creator+ tier voice tools; text inputs processed per ElevenLabs API data policy, not retained for training.
Black Forest Labs (EU - Germany) - AI image generation (FLUX) for the image tools; your prompt is sent to their API and processed per their data policy, not retained for training.
fal.ai (US) - AI image generation fallback when the primary image provider is unavailable; your prompt is sent to their API and processed per their data policy.
Supabase (EU - Frankfurt) - Postgres + pgvector storage for the RAG chatbot knowledge base and tool-search index. Stores anonymised query embeddings, not the original prompts.
PostHog (EU Cloud - Frankfurt) - product analytics for behavioural events (page views, tool clicks, error rates). EU data residency; respects DNT and consent banner.
Langfuse (EU - Frankfurt) - LLM observability and prompt-quality tracing for engineering. Stores per-request metadata (token counts, latency, model name) and may include redacted prompt/response samples for evaluation. EU data residency.
Sentry (US) - application error monitoring. Captures stack traces, browser/user-agent metadata, and the URL where an error occurred. IP addresses are scrubbed; we do not forward tool inputs to Sentry. Cross-border transfer to the United States relies on Standard Contractual Clauses; retention 90 days by default.
Google Analytics 4 (US/EU) - aggregate site analytics with anonymised IP addresses.
Cloudflare (Global) - CDN, DDoS and WAF protection; HTTP request metadata cached. Also Workers AI, used as a fallback for multilingual embeddings and for AI image generation; prompts sent to it are processed per Cloudflare’s API terms.
Hetzner (EU - Germany / Finland) - underlying VPS hosting provider; also runs our self-hosted embedding model (bge-m3) used by the RAG chatbot and tool-search, so query embeddings are processed within the EU and not sent to a third-party embedding service.
AWIN (UK/EU) - affiliate-network tracking when you click out to partner-tool sponsored links (only after explicit consent).
Additional Data Processors (as of 2026-05-20)
Cerebras Systems (US) - LLM inference provider used for the majority of text-generation tools (qwen-3-235b model). Prompts and generated outputs are processed transiently and are not retained for training. Cross-border transfer to the United States relies on Standard Contractual Clauses (SCCs). Retention: per provider policy (typically <30 days for operational logs).
Sentry (US) - application error tracking and performance monitoring. Receives stack traces, browser/runtime metadata and request URLs; personally identifying values are scrubbed before transmission. Cross-border transfer to the United States relies on SCCs. Retention: 90 days by default.
Cloudflare R2 (Global / encrypted at rest) - object-storage backups of database snapshots and user-generated media. Stored objects are server-side encrypted (AES-256). Access is restricted to operations personnel for disaster recovery. Retention: rolling 30-day window for snapshots; 90 days for media archives.
For Data Subject Access Requests (DSAR) covering any processor above, contact [email protected].
We do not sell your personal data. Cross-border transfers to processors outside the EEA - currently in the United States and the People's Republic of China - rely on Standard Contractual Clauses (SCCs) and supplementary technical measures. The European Commission has issued no adequacy decision for the People's Republic of China.

8. Your Rights (GDPR)

Access a copy of your personal data.
Correct inaccurate data.
Request deletion of your account and data.
Withdraw consent for newsletter communications.
Lodge a complaint with your local data protection authority.
To exercise these rights: email [email protected].

9. Security

We implement HTTPS/TLS, Cloudflare DDoS and WAF protection, and access-controlled hosting. No internet transmission is 100% secure.

10. Children

AICT is not directed at children under 16. We do not knowingly collect their personal data.

11. Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated via email or site notice.

12. Contact

Privacy questions: [email protected]