Quasar Character Studio Privacy Policy

Effective date 27 October 2026 | Version 2026-10-27.3

This Policy explains what personal information Quasar handles, why it is needed, when it is shared and how to exercise your choices. Character prompts and images can include personal information even when you are creating fiction.

1 Who handles your information

Kreisler Technologies (ABN 16 473 804 591), a sole trader business based in Victoria, Australia, is the responsible operator for personal information handled through its Quasar Character Studio product. Privacy contact: support@auth.quasarcharacterstudio.com. You can ask about access, correction, deletion or a privacy complaint.

Postal privacy contact: Privacy contact, Kreisler Technologies, Suite 1208, 530 Little Collins Street, Melbourne VIC 3000, Australia. This is a correspondence address, not a visitor location.

This Policy covers the studio, creator profiles, character pages, image tools, downloads, referrals and support. It explains our practices and commitments. Whether a particular statutory right applies depends on the law and circumstances. You can contact us even if a statutory privacy regime does not apply to a particular request.

2 Information we collect

Account and access information includes your email address, account identifier, username, verification and sign-in records, account preferences and security signals. Our authentication provider handles passwords in a protected authentication system; passwords are not character prompts or material shown on your profile. We record your confirmation that you are 16 or older. We do not collect your date of birth or an age band through this check.

Creative information includes character briefs, prompts, answers, suggested and approved text, lorebooks, generation results, portraits, reference images and any reference-role instructions. Fictional character information can become personal information if it identifies or describes a real person. Do not include sensitive personal details or images of others unless you have a lawful basis and appropriate permission.

Profile and community information includes the username, bio and avatar you choose, featured characters, Public or Private settings, likes, ratings and reviews. Support information includes your submitted email, subject, message, correspondence and the outcome of a request.

Service records include token balances, allowances, purchase or grant records, coupon and referral codes, referral relationships, reward adjustments, request identifiers, timestamps, model usage, costs, error codes and limited technical diagnostics. Network and security providers can receive IP addresses, device/browser details and request information needed to deliver or protect the service. We record your Terms agreement and Privacy Policy acknowledgement separately, with the document versions and hashes, server date and time, account identifier and whether you completed sign-up or an account update. This acknowledgement is not consent to unrelated processing.

If paid checkout is offered, the checkout provider processes payment details. Quasar receives the transaction, status and entitlement information needed to fulfil and support the purchase. Do not submit payment-card details in a prompt or support message. Simulated private-test purchases do not collect a real payment.

3 How information reaches us and why we use it

We collect information directly when you register, create or edit a character, upload a reference, publish a profile, use a coupon, leave a review or contact us. We also receive service and security records from the providers involved in those actions. You may browse publicly available pages without a Quasar creation account, although ordinary network information is still processed.

We use this information to authenticate you; save and restore work; generate, review and deliver text, portraits and files; run profiles and sharing; account for tokens and referrals; answer requests; prevent abuse; maintain reliability; and meet legal, accounting and dispute obligations. We use the information needed for each task rather than treating registration as permission for unrelated uses.

Some Suggestions use a common pool of generic ideas. Private contextual generation sends the relevant character context for that request. We do not offer a public pool of your private character drafts. We do not sell personal information or use private character content to train a separate Quasar model.

We may inspect relevant private material where reasonably necessary to handle your support request, investigate abuse or a technical failure, or comply with law. Access is restricted to authorised people and providers carrying out those functions; “Private” does not mean end-to-end encrypted or inaccessible to the operator.

If you choose not to provide information essential to an action, that action may not work. Optional profile information and browser notifications are your choice.

4 AI processing and service providers

OpenAI processes the prompts, relevant character context and any reference images sent for generation, checks and moderation. Uploaded avatars can be sent for an automated safety check. Quasar uses the OpenAI API; this is separate from the settings of your personal ChatGPT account.

Quasar’s text requests use the API’s store=false setting. This does not disable all provider retention. OpenAI states that API inputs and outputs are not used for model training by default unless the customer opts in, and that abuse-monitoring records can normally be retained for up to 30 days, with stated legal and safety exceptions. Its current data-controls documentation describes endpoint-specific rules.

Supabase provides authentication, database storage, backend functions and stored images. OpenAI Sites provides the hosted web pages and their access layer. Cloudflare Turnstile helps distinguish legitimate requests from automated abuse and processes technical signals for that purpose. Google Fonts receives ordinary request information when your browser loads the site’s externally hosted fonts.

Email-delivery and inbox providers process messages and addresses used for sign-in and support. Our public support address uses Resend. Where third-party sign-in is offered and you choose it, the sign-in provider processes that authentication and we receive the account information needed to sign you in; we do not receive your password for that external account. An enabled checkout provider processes the information needed for a purchase. We identify newly enabled providers and material changes to data handling before they are used.

Relevant provider information is linked at the end of this Policy. A provider can process some information under its own legal responsibilities as well as on our instructions. Sharing a character to Wollo or another external platform involves that platform’s own practices.

5 What other people can see

Creator profiles can be public by username, including a bio, avatar, join date, featured Public characters and published ratings or reviews. A review can show the reviewer’s username. Your account email, token balance and private creative files are not intended to appear in that public projection. New creator profiles and characters start Private for everyone. You can use the ordinary Public setting to publish them. Existing public choices are preserved. There are no separate teen account tiers or age-based bans on profiles, publishing or feedback.

Individual character pages are Private unless you choose Public. A Public page exposes the character presentation, portrait and selected author information to visitors. Public material can be copied, indexed or shared outside Quasar. Switching to Private or deleting a character stops future public access through Quasar’s page controls, but cannot recall copies held by other people or services.

Use a pseudonym and avoid identifying information in public bios, portraits, reviews and characters. A private character setting does not make your creator profile private. Downloaded PNG or kit files can contain embedded character data; inspect the whole file before distributing it.

6 Browser storage and optional notifications

We use browser local storage, session storage and IndexedDB to retain sign-in state according to your Remember me choice, drafts, reference images, preferences and a pending referral code. Some information therefore remains on the device you used. Signing out does not necessarily erase every local draft or file.

Browser settings can clear local data, but doing so can remove unsynchronised work and require another sign-in. Clear local drafts is a device-cleanup control, not a request to erase the cloud account. On a shared device, sign out and clear local work that should not remain available to other users.

Cloudflare and the hosting/access layer can use security-related storage or cookies under their own notices. We do not currently operate behavioural advertising or a marketing-tracker programme. If optional analytics or marketing technologies are introduced, we will explain them and obtain any consent required before activation.

Ready alerts are optional browser notifications. Your device’s notification settings control them, and notifications may be visible to someone looking at your screen. You can turn them off in Quasar or the browser.

7 Where information is processed

The primary Supabase project is configured in the Sydney, Australia region. This does not mean that every part of the service, provider support, delivery infrastructure or AI processing remains in Australia. OpenAI, OpenAI Sites, Cloudflare, Google and email providers can process data overseas, including in the United States and countries used by their service networks and subprocessors.

The provider links below identify their published processing and subprocessor locations. They supplement the United States and Australian locations described above. You can ask the privacy contact for the countries and safeguards relevant to your information. We take the reasonable steps required by applicable law for overseas disclosures and use appropriate provider arrangements. Accepting this Policy or using the site does not waive our cross-border obligations or amount to unrestricted consent for new uses.

8 Retention and deletion

We keep account and creative information while it is needed to provide your account, restore work and deliver the features you use, or for another lawful purpose explained here. Retention decisions consider whether the account is active, a deletion has been requested, a record is needed for tax or a dispute, and whether a less identifying record is sufficient.

Deleting a character removes its saved creative content, linked saved portraits and Quasar public page through the deletion process. Limited transaction and usage records, deletion-prevention identifiers and generated-name allocation records can remain. Those records help account for past activity and prevent an older copy from restoring a deleted character. A retained fictional name allocation is distinct from keeping the character’s profile text.

Account closure and broader personal-information deletion are handled by request. We remove or de-identify information that no longer has a necessary lawful purpose and explain retained categories and reasons. Australian tax records generally need to be kept for at least five years from the applicable statutory starting point; longer periods can apply. This does not mean all prompts or images are kept for five years. Limited dispute, security and fraud-prevention records may also be retained where necessary and lawful. The 16+ confirmation and policy-acknowledgement records are included in account-closure review and retained only as necessary for eligibility, evidence of the versions presented, or an applicable legal obligation or dispute.

Provider abuse-monitoring records, backups and third-party copies can follow different retention processes. We cannot promise immediate removal from every backup or another service. Copies in a backup must remain protected and must not be used to restore information contrary to an effective deletion request. We can explain the applicable process when handling a request.

Keep copies you want before deleting. A downloaded file, external import or another person’s copy is not erased by a Quasar deletion. We may need to preserve particular records under a legal obligation or hold and will explain this where permitted.

9 Security and automated checks

We use reasonable safeguards including authenticated access, ownership checks, restricted backend access, protected storage and anti-abuse controls. No internet service can guarantee complete security. Contact us promptly if you think your account or information is at risk.

Automated checks assess uploaded avatars and relevant account or request activity to detect prohibited imagery, abuse and excessive requests. They can reject an image, limit requests or temporarily restrict avatar uploads. These checks can be mistaken. Contact us for review of a material restriction; we can verify the circumstances and arrange human consideration. Character generation is not used to decide employment, lending, housing or comparable eligibility about you.

Where a security incident triggers notification duties under applicable law, we will investigate, take protective action and notify affected people and authorities as required.

10 Users aged 16 and 17

Quasar’s minimum account age is 16. We do not knowingly accept accounts from children under 16. If you think a younger child has registered or personal information has been submitted without appropriate permission, contact us so we can investigate and take suitable action.

If you are 16 or 17, use a pseudonym, keep identifying details out of public material and ask a parent or guardian to review purchases. We must still handle your information appropriately. A parent or guardian’s request does not automatically entitle them to see your private content; we consider your capacity, safety, identity verification and applicable law.

Age and permission checks should collect only what is needed. If an additional check is required, we explain its purpose, provider and data handling before collection. Do not send identity documents, passwords or sign-in codes in an ordinary support message.

11 Your choices rights and complaints

Contact support@auth.quasarcharacterstudio.com or our postal privacy contact to request access, correction, deletion or account closure, to raise a privacy concern, or to ask about an automated restriction. Including your account email and the scope of your request helps us respond. We verify identity proportionately and do not ask for your password or one-time sign-in code. You do not have to use a particular form to ask about your privacy rights.

Where European Economic Area or UK data protection law applies, rights can also include portability, restriction, objection and withdrawal of consent. They have legal conditions and exceptions. We generally rely on performance of the service contract for requested account and creative actions, legitimate interests for proportionate security and support, legal obligations for required records, and consent where required for optional processing. We assess any additional basis needed for sensitive information.

We aim to respond substantively to privacy requests or complaints within 30 days. Where applicable law requires one calendar month or a shorter or different period, we follow that period and any lawful extension process, including required notice. If we refuse all or part of a request, we explain the reason and available review or complaint route, subject to legal restrictions.

If Australian privacy law gives you that right, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au. You may also contact the appropriate regulator in your location, including a relevant EEA authority or the UK Information Commissioner where those laws apply. You do not waive these rights by using Quasar.

12 Changes and provider information

We update this Policy when our practices change. We show the effective date and give an appropriate notice of material changes. Where a new use needs consent, we ask for it separately rather than relying only on an updated notice. You can request a free copy of this Policy in an accessible form from our privacy contact.

Privacy contact: support@auth.quasarcharacterstudio.com. Postal correspondence: Privacy contact, Kreisler Technologies, Suite 1208, 530 Little Collins Street, Melbourne VIC 3000, Australia. Account and data deletion instructions: https://quasar-character-showcase.lightgiant16.chatgpt.site/data-deletion.

OpenAI API data controls

OpenAI Privacy Policy

Supabase privacy resources and subprocessors

Cloudflare Turnstile Privacy Addendum

Google Privacy Policy

Resend Privacy Policy