Privacy notice

Last updated: November 9, 2026

Confetti is provided by Asteria Labs, Inc. (“Asteria”, “we”, “us”). This notice explains how we collect, use and share personal information when you use Confetti, and the choices available to you.

Information we collect

We collect information you provide when you create an account, use our services or contact us. This includes your account and profile details, preferences, prompts, conversations, uploaded media and files, generated outputs, feedback and support messages. If you place an order, we also collect payment, delivery and order information. Stripe processes your payments; we do not store your card details in our project database.

We also collect information about how you use Confetti, including feature activity, generation results, credit usage, device and network information, referral information and diagnostic records. Some information is stored on your device, such as preferences, drafts and pending requests. Files you attach may be uploaded before you send a message.

How we use information

We use information to provide and personalize Confetti, generate and store designs, process payments and orders, respond to requests, communicate with you, improve our services, and prevent fraud and abuse. We also use it to meet legal obligations and resolve disputes.

Authorized members of our team may review content to check model quality, diagnose failures, provide support and protect the service. Access is limited to staff who need it for these purposes. We also study eligible prompts and conversations to understand how people use Confetti and improve the product. Earlier limits on this internal research remain in effect, and results shared outside Confetti are aggregate totals without prompts or personal identifiers.

Designs imported from ChatGPT

When you ask the Confetti plugin to prepare a design, we receive the design brief and selected image you send, not your full ChatGPT history. We temporarily store them to create a private import link. Anyone with this link can view and claim the design before you save it. Links expire after a week; expired handoff records are removed hourly, the copy of the brief kept with a link is emptied two hours after you save the design, and image files are queued for deletion once you save the design or the link expires. We use limited request counts to prevent abuse, counted for your account or, without one, for the anonymized user identifier ChatGPT sends us (we keep only a hash of it). Opening the import link while signed in saves the design to your Confetti account and opens its workspace. If you are signed out, import resumes after sign-in.

Where Confetti can be used from ChatGPT without an account, opening the link while signed out saves the design to a guest project instead. Only the browser that opened the link can reach it, for a week, and you can order from it without an account: the payment provider collects your email and card, and we keep your delivery address with the order. Creating an account in that browser moves the guest project and its orders to your account. A guest project with no order is deleted 30 days after it was created.

Saved designs become private project files under the account that claims them and follow our project retention and account-deletion rules. Preparing or saving a handoff does not run an AI model, charge you, place an order or share the design with a supplier. Opening the saved design in Confetti automatically prepares print files using AI at Confetti’s expense and sends the selected artwork and placement to Printful to render product photos. Previews do not include your delivery details or create an order. When you order, checkout collects your delivery details and payment through Stripe, and Confetti sends the print files, product choices and delivery address to Printful, which prints and ships the order.

AI services

When you use AI features, we send your prompts, relevant conversations, project files, preferences and uploaded media to AI service providers to generate or review content. Providers may process and retain requests under their own terms, including for security and abuse prevention. We may use another provider if one is unavailable. Contact us for information about the providers that process your requests.

Research sharing, described below, is separate from processing needed to provide the service. Do not submit confidential information or personal information you do not have permission to share.

Research data sharing

We may share prompts, conversations, outputs and uploaded media with AI providers and research partners to evaluate, benchmark, improve and train AI models and related services. This may include generated designs, intermediate attempts, feedback and information about your preferences and use of the service. We may receive payment for licensing this data.

Research sharing is on by default for eligible US accounts created on or after October 10, 2026. Paid plans can turn it off. We preserve earlier opt-outs, exclusions and limits on the data covered by previous notices. Uploaded media is included only for submissions covered by this notice, not retroactively. Accounts outside the US and existing age-based exclusions remain outside the program.

Before sharing research data, we remove account identifiers, contact and payment details, and exclude support messages. Content can still contain personal information you include in a prompt, file or image. Recipients must not try to identify users from the data.

Do Not Sell or Share My Personal Information

Research disclosures may constitute a sale of personal information under applicable US privacy laws. We do not use your project content for advertising. Optional advertising measurement described below may also constitute sharing for cross-context advertising.

On a paid plan, you can turn research sharing off in Settings. This choice lasts while your paid plan remains active; if you return to the Free plan, sharing resumes for data you create afterwards. Where applicable law gives you the right to opt out of sale or sharing, you can do so on any plan by contacting support or emailing support@confetti.build. We also honor Global Privacy Control signals. These opt-outs remain in effect regardless of your plan.

Opting out stops future licensing and deletes records retained for research sharing. Deleting a project or account removes it from future licensing. Data already licensed cannot be recalled. These choices do not stop the processing needed to provide Confetti or the internal product research described above.

Optional analytics

With your permission, we use PostHog for product analytics and session recordings to understand how the product is used and to fix usability problems. Recordings capture interactions such as clicks, scrolling, and navigation. Product events include which workspace stages reached the screen, actions such as pressing Build, tab visibility, and time spent with the tab visible. These events do not tell us why someone leaves. We mask the chat input so the text you type is not captured in recordings. We do not send project contents to analytics or use analytics for advertising or cross-site tracking.

Do Not Track and Global Privacy Control keep optional analytics off. Essential account storage, operational diagnostics and limited aggregate measurements may still operate without analytics permission. Our aggregate referral counts also stop when either browser signal is present.

Optional advertising measurement

Advertising measurement is off unless you separately opt in. With your permission, we send Meta a hashed version of your account email, payment amount, currency, time and category, and whether you started a paid subscription. Meta may match these records to its accounts to measure and improve Confetti ads. Hashing does not make this information anonymous. We do not include project content, card details or delivery addresses, and do not install a Meta browser pixel through this preference.

You can withdraw this permission in Billing settings at any time. This stops future disclosures, including future subscription renewals. When detected while you use Confetti, Global Privacy Control and Do Not Track also turn this account preference off. Previously sent information remains subject to Meta’s privacy policy. Product analytics permission does not enable advertising measurement.

Other disclosures

We use service providers for hosting, storage, authentication, payments, email, analytics and support. They receive the information needed for their services. When you request manufacturing quotes, shipping or physical orders, we share the relevant files, order details and delivery information with manufacturing partners, suppliers and shipping providers, including Sinter when you select it. Sinter handles its own checkout and payment. External services handle information under their own privacy policies.

Your public profile and content you choose to publish or post are visible to others. Publishing a design does not publish your private conversations, reference files or other versions. Other people may download or copy public content, and those copies cannot be recalled. We may also disclose information when required by law or necessary to protect the service and the rights or safety of others.

Keeping and deleting information

We keep personal information for as long as necessary for the purposes described in this notice or to meet legal requirements. How long we keep it depends on the type of information and why we need it. When it is no longer needed, we delete or anonymize it.

Guest access ends after seven days. This does not delete the project. We retain guest projects privately with no automatic deletion deadline, subject to the purposes and deletion rules in this notice. Existing limits on staff access and research sharing still apply. You can contact support to request deletion.

You can delete saved projects and your account in Confetti. After deletion, we may retain limited information to resolve disputes, complete transactions, prevent fraud and abuse, or meet legal obligations. You can contact us to request deletion of retained information, subject to these needs.

Copies may remain in encrypted backups until removed under our retention schedules. Shared files still used in another person’s publication or remix may remain. Other devices, service providers and people who downloaded your content may retain copies under their own retention practices.

Your choices and rights

You can update your profile, download projects and delete your account in Confetti. Depending on where you live, you may also have rights to access, correct or delete personal information, obtain a copy, or object to or restrict certain processing. To make a request, contact support or email support@confetti.build. We handle requests as required by applicable law.

Age requirement

You must be at least 18 to use Confetti.

Changes and contact

We may update this notice as our services and practices change. We will update the date above and, where appropriate, notify you in Confetti or by email before material changes take effect.

Asteria Labs, Inc. is responsible for the personal information described in this notice. Our address is 2261 Market Street STE 74309, San Francisco, CA 94114. Send privacy questions to support@confetti.build.