Picwave | Privacy Policy | v1.0 | Effective 8 October 2026

1. Introduction & scope

1.1 This Privacy Policy explains how WERVIX LTD, trading as Picwave, processes personal data when you browse pic-wave.com, register an Account, purchase catalogue Digital Images or prepaid Generation Credits, create an AI-generated image or seek support. It also addresses security, payment-related verification and the handling of prompts, outputs and associated usage records.

1.2 The policy applies to visitors, registered account holders, customers, users whose personal data appears in submitted content, and individuals communicating with our support team. A separate Cookie Policy describes cookies and browser storage. This notice is provided under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1.3 For data which another party independently determines how to process, such as a bank handling a payment card, that party may act as its own controller. External links and independently operated services have their own policies. We do not claim to control processing undertaken by third parties outside our instructions or contractual relationship.

2. Data controller & contact

2.1 The controller responsible for purposes and means of Picwave account, order and customer-support processing is WERVIX LTD, company number 17499009. Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Write to info@pic-wave.com with the subject line Privacy Request for personal-data enquiries.

2.2 This address is the primary privacy contact; a title such as data protection officer is not used to suggest an appointment that has not been established. An individual may contact our privacy function without first opening an Account. We may request proportionate identity verification before disclosing personal data or actioning a sensitive request.

2.3 Where we process information as a service provider on documented instructions for a separate business customer, contractual processor terms may apply to that specific relationship. This Privacy Policy addresses our own customer-facing controller activities and does not alter another controller’s legal obligations.

3. Age position

3.1 Purchases and account-based AI generation are intended for people aged 18 or over. We do not knowingly market our paid products to children or seek to collect children’s personal data. A person under 18 must not create an Account or submit images or prompts to the generation facility.

3.2 If we learn that an Account belongs to a minor, we may suspend use, notify an appropriate guardian where lawful, preserve evidence necessary to safeguard the individual and delete information that we have no lawful reason to retain. Parents or guardians may report a concern to info@pic-wave.com.

3.3 Age eligibility does not authorise excessive collection of identity documents. Any age assurance, fraud screening or safeguarding process must use proportionate information, reasonable security and a transparent legal basis. We do not knowingly deploy personalised advertising based on profiles of minors.

4. Categories of personal data

4.1 Account data includes the email address, account identifier, password hash, authentication and security logs, locale, preferences and registration timestamps. Transaction information includes order references, amount, currency, product, credit-pack quantity, transaction status, checkout verification and refund or dispute references.

4.2 Generation data may include text prompts, voluntary reference materials, prompt parameters, generated files, timestamps, moderation flags and credit debit or restoration events. A prompt or uploaded image can itself contain personal data, including faces or sensitive information, even when the user intended the task to be creative rather than informational.

4.3 Technical and communications data include IP address, browser or device characteristics, session identifiers, cookie choices, page interactions, correspondence and support-ticket history. We do not require a physical delivery address for a solely digital download; billing information may be requested at checkout where necessary for tax, verification or compliance.

5. Sources of personal data

5.1 You provide data directly when registering, placing an Order, typing a prompt, uploading a reference file, changing preferences or contacting support. Our application creates transactional and technical records when it confirms delivery, credits tokens, processes a completed generation or responds to a security event.

5.2 We also receive limited payment status, chargeback, transaction identifier and fraud indicators from our payment service provider and related banks. A third-party authentication or analytics service may disclose relevant information when used and lawfully enabled, consistent with the consent choices and service configurations applicable at the time.

5.3 Where someone submits material portraying another person, we may indirectly receive that individual’s personal data. The submitting customer must have a lawful basis and necessary permission. We treat complaints about unauthorised processing seriously and may restrict access to relevant material pending assessment.

6. How we use personal data

6.1 We use account information to authenticate users, deliver purchased credits, enable downloads, restore balances after technical failures, maintain an order history and provide support. Prompts and reference material are processed to generate requested images and apply safety controls; moderation data is used to reduce unlawful or abusive outputs.

6.2 Transaction and device records support payment reconciliation, prevention of duplicate charges, chargeback evidence, fraud investigation, service security, audit and applicable tax and accounting requirements. We use support correspondence to answer enquiries, resolve rights complaints and improve documented handling procedures.

6.3 Subject to an appropriate lawful basis and any required cookie consent, aggregated measurement may help us evaluate website performance and identify defects. Promotional emails, non-essential tracking and any use of customer prompts to improve external models are distinct purposes requiring a lawful basis and relevant notices or choices.

7. Lawful bases for processing

7.1 Contract is the lawful basis where processing is necessary to provide an Account, process an Order, grant access to a download, allocate credits or produce requested output. Legal obligation applies to certain accounting, fraud reporting and data-protection compliance tasks. We use legitimate interests for proportionate service security, recovery of unpaid debts and defence of legal claims after balancing those interests against individual rights.

7.2 Consent is sought where required, particularly for non-essential cookies or electronic direct marketing that cannot rely on an applicable soft opt-in. Consent is specific, freely given and withdrawable without retroactively invalidating earlier lawful processing. Withdrawal will not affect strictly necessary contractual records or compliance processing undertaken on other valid bases.

7.3 The lawful bases depend on the particular purpose, not merely the data category. If we seek to process highly sensitive data included in a prompt, we must also identify any additional Article 9 condition where relevant; users should not upload special-category material unless it is essential and appropriate.

8. Payments & checkout

8.1 The checkout uses a payment processing provider that collects, authenticates and processes payment credentials through a secure payment flow. Picwave personnel do not ask for full card numbers, card verification values or online banking passwords by email. We retain order and processor transaction references to reconcile a purchase and assist with billing disputes.

8.2 The provider and financial institutions may act as independent controllers for certain anti-fraud, card-network and regulatory activities. They determine their own retention and verification requirements in those capacities. Please read any additional checkout notices displayed by the provider before you submit a payment.

8.3 For a disputed transaction, we may share appropriate order, token-balance and digital-delivery evidence with the authorised provider or scheme. We limit disclosures to what is proportionate for fraud prevention, payment verification, legal obligations and defence of the transaction.

9. Cookies & similar technologies

9.1 We use necessary cookies or comparable browser storage to support login sessions, cart state, secure ordering, language and consent records. Optional preference, analytics or advertising technologies are subject to applicable UK Privacy and Electronic Communications Regulations and UK GDPR requirements.

9.2 When consent is required, the banner should permit acceptance, rejection and category-level preferences before optional technologies run. The choice can be changed through cookie settings or relevant browser controls. A preference or analytics label alone does not make a technology exempt from prior consent.

9.3 Our Cookie Policy sets out cookie classes, the browser-observed technologies and their principal functions. Actual names, purposes and lifetimes may be updated when functionality changes. We review configurations and disclose material additions when required.

10. Sharing of personal data

10.1 We share only the information needed with hosting providers, payment processors, fraud-security vendors, email and support services, analytics partners where enabled, and the infrastructure providers required to run image-generation tasks. Each provider receives access appropriate to its function and contractual and legal role.

10.2 Service providers processing data on our behalf are subject to suitable data-processing obligations concerning instructions, confidentiality, security, subprocessors, breach notification and end-of-service return or deletion. They may not acquire unrestricted rights to monetise customer input merely because they provide the technical service.

10.3 We may disclose information to competent authorities, courts, legal advisers, payment schemes or insurers when a lawful requirement or properly assessed legitimate interest justifies it. We may transfer relevant records in a corporate reorganisation subject to lawful notice, safeguards and continuity of existing customer rights.

11. International transfers

11.1 Some service infrastructure, payments, support or AI-processing operations may involve processing outside the United Kingdom. Where a restricted transfer takes place, we apply a lawful transfer route such as UK adequacy regulations, the UK International Data Transfer Agreement or an appropriate UK Addendum to the EU Standard Contractual Clauses, with supplementary measures as necessary.

11.2 The destination, service provider and sensitivity of the data determine the required assessment. Access controls, encryption and contractual restrictions are used where proportionate. You may contact us to request information about the relevant transfer safeguards for your personal data.

11.3 Users should not assume that an overseas customer, cloud location or third-party link alone makes a service transfer compliant. Our assessment distinguishes our instructions to processors from transfers by independent controllers and is reviewed when the service’s vendor configuration changes.

12. Data retention

12.1 We keep personal data only for as long as reasonably needed for the stated purposes, subject to legal retention, actual disputes and defensible security needs. Account records ordinarily remain during the active relationship. On closure, unnecessary profile fields should be removed or anonymised, while minimum accounting and evidence records may be retained for applicable periods.

12.2 For this policy, order and associated tax records are retained for six years after the end of the relevant financial year, unless a longer lawful requirement or live dispute applies. Ordinary support correspondence is normally retained for 24 months after closure of the request; routine security logs generally for up to 12 months unless needed to investigate a specific event.

12.3 Prompt and generated-output history is retained in the customer Account while needed to provide the history function and may be removed through deletion processes, subject to necessary fraud, claim or legal holds. We do not promise immediate deletion from every backup; controlled backup cycles and lawful preservation may delay erasure.

13. Data security

13.1 We use proportionate technical and organisational measures, including access control, authentication, network protection, encryption in transit, logging and personnel confidentiality. Access to customer prompts, purchase records and support conversations should be role-based and reviewed against operational need.

13.2 No internet service can guarantee perfect security. We investigate credible incidents, contain affected access and notify regulators and individuals where the statutory thresholds for notification are met. Payment card security also depends on the external payment provider and the customer keeping credentials private.

13.3 Do not include passwords, full card details, official identity documents or unnecessary special-category personal information in prompts or support messages. Report suspected compromise via info@pic-wave.com; we may request a secure follow-up verification rather than collecting sensitive data in ordinary email.

14. Your privacy rights

14.1 Depending on applicable law and circumstances, individuals may request access to their personal data, rectification, erasure, restriction, portability and the right to object to processing based on legitimate interests or to direct marketing. Consent may be withdrawn without charge where consent is relied on.

14.2 To submit a request, contact info@pic-wave.com and describe the Account, affected information and remedy sought. We ordinarily respond within one month of receiving a valid request, subject to permitted extensions and exemptions. We may request only identity evidence reasonably necessary to prevent disclosure to an unauthorised person.

14.3 You can complain to the UK Information Commissioner’s Office (ICO), whose website is https://ico.org.uk, without first exhausting our complaint procedure. If you are in another jurisdiction, other competent data protection authorities may also have a role. Our response will explain any lawful reason why a particular request cannot be fully met.

15. Marketing communications

15.1 Where electronic marketing requires permission, we seek appropriate consent or rely only on a legally valid existing-customer soft opt-in with clear opt-out opportunities. Operational messages about receipts, password resets, credit allocations, fulfilment or fraud are not marketing merely because they are delivered by email.

15.2 Every marketing email will identify a practical unsubscribe route. A request to stop direct marketing will be honoured without changing access to purchased products. We maintain a minimal suppression record to avoid resubscribing a person contrary to their expressed choice.

15.3 If personalised advertising technologies are introduced, their use will be assessed independently of email marketing and placed behind the appropriate consent mechanism. We do not knowingly target under-18 users using behavioural advertising.

16. Automated decision-making & profiling

16.1 Automated checks may help identify abnormal transaction patterns, unsafe prompts, duplicate requests or suspicious logins. Such tools can generate risk signals, but a signal is not necessarily proof of wrongdoing and may lead to a request for verification or a temporary protective action.

16.2 We do not intend to make solely automated decisions producing legal or similarly significant effects on individuals without satisfying the specific requirements and safeguards of applicable law. Where such a decision occurs under a permitted basis, individuals may request relevant information and available human review.

16.3 Prompt moderation and transaction fraud detection are separate from processing customer images for delivery. We seek to minimise unnecessary profiling and ensure measures are appropriate to the risk rather than using arbitrary or discriminatory criteria.

17. Third-party services & links

17.1 The website may link to external creative resources, social networks, payment interfaces or other websites. Those parties may process information under their own policies. A link is not a representation that the external site is owned by WERVIX LTD or operates under this Privacy Policy.

17.2 Our processors may use subcontractors to support hosting, cloud infrastructure or image generation under appropriate contractual protections. Material changes in vendors, international transfer arrangements or functions should be reflected in privacy disclosures and the company’s data inventory.

17.3 If you follow a third-party link, review the destination address before entering personal information. Avoid submitting confidential content into an external prompt interface unless its identity, terms and privacy treatment are clear.

18. Changes to this policy

18.1 We review this Privacy Policy when data flows, laws, service features or material suppliers change. The version and effective date appear at the beginning of the document. Material changes affecting reasonable expectations will be communicated through an appropriate website notice, account message or direct communication where required.

18.2 An updated Privacy Policy does not create a retrospective lawful basis for previous processing or override rights that arose earlier. Where processing depends on consent, a materially different purpose may require fresh consent before that new processing begins.

18.3 We keep a practical record of revisions and assess the consequences of service migrations or controller changes, including the need for notices and any independent rights request concerning earlier processing.

19. How to contact us / submit a request

19.1 For privacy and data-rights enquiries, email info@pic-wave.com with the subject Privacy Request or write to WERVIX LTD at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Include sufficient information to identify the relevant Account without sending a password or full card number.

19.2 A request may involve personal data in an uploaded reference image or generated history. Describe the item, approximate date, Account email and desired action so we can locate it proportionately. If a third party’s rights are involved, we may need to protect that person’s confidentiality during investigation.

19.3 This Privacy Policy is governed by applicable UK privacy laws; mandatory rights under other laws remain available where they apply. For statutory complaints and independent guidance the UK supervisory authority is the Information Commissioner’s Office at https://ico.org.uk.

Schedule 1 – Practical Retention Guide

If you order a digital image, we retain transaction details for receipt, delivery support and accounting. The image itself can remain accessible in your order history while that feature is provided; a privacy deletion request may result in restricted historical access where legally appropriate.

If you close your Account, request information about your credits and download records before closing. We may remove inactive profile and generation history while retaining a narrowly scoped financial record that cannot lawfully be erased at once.

A routine support case is normally kept for up to 24 months after it is resolved so that a recurring fault or refund dispute can be understood. Security incidents, litigation, chargebacks and tax matters may require a properly documented exception to the ordinary retention period.

For rights requests, specify your account email, whether the request concerns a prompt, generated image, invoice, technical log or marketing preference, and the action required. We will provide a response within the statutory period or explain any permitted extension.

Picwave | Privacy Policy | v1.0 | Effective 8 October 2026. Published on the website and subject to update; the current published version governs transactions made after it takes effect, subject always to mandatory rights.