Your information.
What Windpaint collects when you use the website, the API, the dashboard, the CLI, the MCP server and agent plugins, what we do with it, and how to have it deleted.
- Covers
- Website, API, dashboard, CLI, MCP server, plugins
- Stored in
- AWS, United States
- Model training
- Never on your data
- To delete it
- hello@windpaint.ai
What we collect
Your account: name, email address and password (stored hashed), plus the organizations and projects you create. When you use Windpaint: the prompts, parameters and files you send, the images and clips we generate, job records, API key metadata (never the full key after creation) and usage for billing. When you buy credits: billing contact details, handled by Stripe.
What we use it for
To run the jobs you submit, store the results in your project, bill you for them, keep the service secure, enforce our content policy, and help you when you ask for support. We don't sell your data and we don't use it for advertising.
We don't train on your data
Windpaint does not use your prompts, uploaded inputs or generated outputs to train or fine-tune any model. This applies to every plan and every way of using Windpaint: the API, the dashboard, the CLI and the MCP server.
API, CLI, MCP server and agent plugins
These all call the same API with an API key you create, and everything they send is handled as described here. The CLI stores your key on your own machine. The hosted MCP server at mcp.windpaint.ai holds no keys: each request carries the caller’s own key, which is passed through to the API and not stored. The agent plugins and skills contain no code that collects data; they only point your agent at the API and MCP server.
Who can see it
Members of your organization, according to their role. Download links are signed and expire after 15 minutes. Windpaint staff access account, billing and job records, including prompts and outputs, only to provide support you've asked for, resolve billing issues, or investigate abuse or a breach of our terms.
How long we keep it
Uploaded files and generated outputs are kept for your organization's retention period: 7 days by default, configurable from 1 to 365 days or forever. When an asset expires or you delete it, its file is deleted from storage within minutes. Job records, including prompts, stay in your project until you delete your account.
Where it goes
Data is stored on Amazon Web Services in the United States (us-east-1). Open-weight models run on Windpaint's own GPUs. If a model runs on another provider's API, its page says so, and your prompt and inputs for that job are sent to that provider. Our service providers are Amazon Web Services (hosting, database, storage), Cloudflare (network and website hosting), Stripe (payments) and Resend (transactional email).
This website
No advertising trackers. Self-hosted, cookieless analytics: Umami and OpenPanel count page views, and OpenPanel records sessions on the site (what's on the page and how you move through it) so we can see how it's used. Anything you type into a form is masked and not recorded.
Your choices
You can delete assets, projects and API keys yourself at any time. To delete your account and everything in it, or to ask what we hold about you, email hello@windpaint.ai from the address on your account. More detail is in the data use and privacy docs.
Security practices are on the Trust page. Last updated 2026-11-11.