Privacy Policy

1. Account and sign-in information

Email registration collects your name, email address and a password stored as a password hash. Google sign-in provides account identifiers, email, display name and profile image according to the permissions you approve. We also keep authentication records, sessions and account settings needed to operate your account.

Email registration signs you in without a verification email or CAPTCHA. If password recovery is configured and you request it, we process your email address and a time-limited reset token to send a recovery link.

2. Photos, facial features and generated content

We process the photos you upload, selected style and model, generation settings, task status and generated images or videos. Photo transformation processes visible facial features to guide the model. This service does not offer identity verification or biometric sign-in.

Only upload a photo you own or have permission to use. Do not include identity documents, financial records or other information that is unnecessary for the transformation. Your source photos and generated results are not automatically published in our public style collection.

3. Billing, technical and support records

We keep purchase identifiers, payment-provider references, currency, amounts, payment status, credit balances and transaction history. Payment providers collect payment details through their hosted checkout. We do not collect or store full payment-card numbers or security codes on this site.

Requests can include IP addresses, browser or device details and timestamps processed by hosting infrastructure. Our rate limiter derives a keyed hash from the request IP address to limit repeated requests. We may retain error records and support messages to investigate problems, protect accounts and resolve billing disputes.

4. Why we use information

We use information to authenticate accounts, store private assets, submit and reconcile generation tasks, deliver downloads, verify payments, calculate credits, return credits after failed tasks, answer support requests and maintain service security.

Where a legal basis is required, service delivery and billing rely on performing our agreement with you; account security and reliability rely on legitimate interests balanced against your rights; required financial records rely on legal obligations. Optional processing that requires consent will be explained separately. We do not use this workflow to make employment, lending or other eligibility decisions about you.

5. Providers and information sharing

Cloudflare provides hosting, database and private object storage. Google supports Google sign-in when configured. Kie.ai and the selected image or video provider receive the reference content and generation instructions necessary to produce your output. Providers may receive a time-limited signed asset link or the reference file itself. Waffo may receive generation prompt text for content screening.

Waffo handles payments. Cloudflare Email Service delivers password recovery emails when configured. A provider receives only the information needed for the requested function, but its own privacy terms and retention practices also apply. We may disclose information when legally required, to handle fraud or disputes, or as part of a lawful business transfer with appropriate notice.

6. Training, sale and publicity

We do not run a model-training pipeline using customer photos and do not sell your uploaded photos or use them as public marketing examples without separate permission. The app currently has no advertising tracker or sale/sharing program for targeted advertising.

This notice does not promise that every external model provider has identical training or retention rules. Those rules depend on the provider and model used. Contact support before submitting content if you need a specific contractual retention or training restriction.

7. Cookies and local storage

Essential authentication cookies keep you signed in and support login security. Sessions are configured to last up to 30 days and can be renewed while you use the service. Google sign-in and hosted checkout may set their own cookies on their respective services.

The studio saves pending task identifiers in local storage so you can resume checking a task after a reload. Clearing cookies or local storage can sign you out or remove these local shortcuts; it does not automatically delete assets or purchase records in your account. We use Google Analytics 4 to measure visits, page views and navigation so we can understand and improve the service. Google Analytics may use cookies and process device, browser and usage information. This integration does not intentionally send uploaded photos, generation prompts or account email addresses to Google Analytics.

8. Retention and deletion

The scheduled cleanup targets source files, generated assets and completed task records after 100 days. Cleanup runs in batches, so removal may occur after that threshold rather than at an exact instant. Download results you want to keep. You can delete saved assets through My creations; deletion removes the stored file and marks its record for subsequent cleanup.

Account information is kept while needed to maintain your account, or until a valid deletion request is processed, subject to necessary legal and dispute-related retention. Billing and credit records may be retained for accounting, refunds, fraud prevention and legal obligations even after account closure. Support and security records are kept only as needed for their purpose; providers and backups may follow separate deletion schedules. An active provider task may already have received its input before you delete it here.

9. Security and international processing

Private asset access uses authentication and ownership checks; provider access uses limited links or server-mediated uploads. We use transport security in production and restrict operational access. No online service can guarantee absolute security.

Hosting, payment and generation providers may process information in countries outside your own, where legal protections may differ. Where applicable law requires transfer safeguards, they must be established for the relevant provider arrangement. Contact us for information about a specific request or provider.

10. Your choices and rights

You can edit supported account details, download your creations and delete saved assets in My creations. Email support@femalemalfoy.com to request access, correction, account deletion or other privacy assistance. We may ask for proportionate proof that you control the account; do not send your password, full card details or identity documents unless a secure and necessary verification process is agreed.

Depending on your location and applicable law, you may have rights to access, erasure, correction, portability, restriction, objection and withdrawal of consent, and to complain to your local data-protection authority. Some requests may be limited by legal retention duties or others' rights. We respond within the applicable legal timeframe.

11. Children and third-party photos

Accounts are intended for adults aged 18 or older, or the age of majority where they live if higher. We do not knowingly seek accounts from children. If you believe a child has supplied personal information or your photo was used without permission, contact support so we can investigate and remove information as appropriate.

12. Changes and contact

We will publish the current version and update date on this page. Material changes to processing will be communicated when required, and new consent will be sought where necessary. For privacy questions and requests, email support@femalemalfoy.com.

Contact the atelier

For support, billing and privacy requests: support@femalemalfoy.com.