Privacy Policy

Last updated: [DATE] · Controller: [COMPANY LEGAL NAME], [ADDRESS] · Contact: support@example.com. Draft — have counsel review before launch.

1. What we process

Account data: email address, password hash (scrypt), login timestamps.
Photos you upload: two portrait photos (and optionally a reference photo) containing facial images, which are sensitive personal data.
Generated images and album metadata (title, names, date).
Payment data: handled by our Merchant of Record Paddle. We never see your card number; we receive an order ID, amount, currency and tax amount.
Technical data: IP address (rate limiting, abuse prevention), device identifier stored in your browser, browser language.

2. Why we process it (legal bases)

Perform the service (Art. 6(1)(b) GDPR): generating your images from your photos.
Explicit consent (Art. 9(2)(a) GDPR) for facial images: asked before each first generation, withdrawable at any time.
Legal obligations (Art. 6(1)(c)): invoices, tax records, AI-content labeling duties.
Legitimate interests (Art. 6(1)(f)): fraud prevention, rate limiting, service security.

3. Retention

Uploaded photos: deleted as soon as generation starts (the job only keeps the request in memory).
Generated images: stored on our server, associated with your device identifier, until you delete them or 12 months pass.
Account data: until you delete your account; payment records as long as tax law requires.

4. Who else is involved (processors)

Paddle.com as Merchant of Record — payment, invoicing, sales tax/VAT.
Image-generation model providers (e.g. ByteDance Volcano Ark, Google Gemini) — receive your photos and prompt for the duration of a generation. Region may be outside the EEA; transfers rely on Standard Contractual Clauses where applicable.
Hosting provider [HOSTING PROVIDER, REGION].

5. Your rights

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Email support@example.com — we answer within 30 days. You may complain to your local supervisory authority.

6. Children

The service is not for anyone under 16 (or the digital-consent age in your country). We delete accounts we learn belong to children.

7. Cookies and local storage

We use only essential storage: a device identifier, your sign-in token, your consent choice, and a UI preference. No advertising or analytics cookies.