Privacy Policy

We use the information we collect to:

• Provide, operate, and improve the Pak-LLM Services
• Authenticate your identity and secure your workspace
• Process AI queries, image generation queries (Pak-Image), and video animations (Pak-Video) by forwarding requests to our model endpoints — see §5
• Save and retrieve your conversation threads, generated media, and folder organization
• Enforce rate limits and protect against abuse, prompt injections, and synthetic deepfake violations
• Send service-related communications (not marketing, unless you opt in)
• Comply with legal obligations

Your conversation data is stored in a PostgreSQL database hosted via Neon (a serverless Postgres provider). Authentication is managed by Google Firebase. All data is transmitted over TLS 1.2+ encryption.

We implement the following security controls:

• HTTPS with HSTS (2-year, preload-eligible)
• Firebase ID token verification on every API request
• Row-level user isolation in the database (queries are always scoped to user_id)
• API rate limiting and input sanitization
• Content Security Policy (CSP) blocking unauthorized script execution

Despite these measures, no system is 100% secure. You use the Services at your own risk.

We retain your conversation threads and account data for as long as your account remains active. If you delete a conversation thread through the workspace interface, it is permanently deleted from our database. You may request full account deletion by contacting us — we will process such requests within 30 days.

Generated media (Pak-Image & Pak-Video): Images and videos generated and saved to your history are retained for as long as your account remains active or until you explicitly delete them via the workspace interface. Deleting a generated asset permanently removes it from our database. Starting photographs uploaded for Image-to-Video animation are processed transiently and are not stored beyond the duration of that generation request.

Server logs are retained for up to 30 days for security purposes, then automatically purged.

Subject to applicable law, you have the right to:

• Access — Request a copy of the personal data we hold about you
• Rectification — Request correction of inaccurate data
• Erasure — Request deletion of your account and associated data
• Portability — Export your conversations via the in-app export feature (PDF, DOCX, Markdown)
• Objection — Object to processing of your data for certain purposes

To exercise these rights, contact us at info@sbf-consultancy.net.

Our infrastructure providers (Vercel, Firebase, Neon, Render) may store or process data in data centres outside Pakistan (e.g., US, EU). Specifically:

• Image and video generation prompts are forwarded to our Render-hosted inference backend (Oregon, USA) and to Hugging Face servers for model inference. Prompts are processed transiently and are not retained by these providers.
• Starting photographs uploaded for Image-to-Video generation are transmitted to the Render backend for the duration of that request only and are not stored.

We take appropriate contractual and technical measures to ensure such transfers comply with applicable privacy laws, including Pakistan's PDPA.

The Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that a minor has provided us with personal data, we will promptly delete it.

We may update this Privacy Policy periodically. The "Last updated" date at the top will reflect changes. For material changes, we will notify registered users via email or an in-app notice.