Privacy Policy

1. Data controller

The controller of your personal data is Graphicmania OÜ, registry code 14237556, Maleva põik 6-18, 11712 Tallinn, Estonia. For any questions about your data, write to info@genframe.ai.

This policy describes how we process data on the genframe.ai website and in the app.genframe.ai app under the EU General Data Protection Regulation (GDPR). The policy is available in several languages; if translations differ, the English version prevails.

2. What data, why, and on what legal basis

We don’t sell data, use it for advertising profiling, or train neural networks on it. Don’t upload documents, medical data, or photos of other people to the Service without their consent. We don’t make decisions with legal effects solely by automated means: a filter may reject a prompt, but account blocks are reviewed by a human.

3. Sign-in with Google

When you sign in with Google, we receive only your name, email address, profile photo, and account ID. We use them only to sign you in and to contact you about your account; we don’t share them with third parties for advertising and don’t use them to train AI models. Our use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

4. Payments

Payments are processed by Stripe Payments Europe, Ltd. (Ireland). You enter your card details on Stripe’s page: the full card number never reaches us. From Stripe we receive and store the Stripe customer ID, name, email, billing address and country, VAT number (if you provided one), card brand and last 4 digits with expiry date, and the history of payments, subscriptions, invoices and refunds.

Why: to take payment, run your subscription, issue invoices, charge and declare VAT, keep accounts and prevent fraud (Stripe Radar). Legal bases: contract (6.1.b), legal obligation (6.1.c — accounting records are kept for 7 years under Estonian law) and our legitimate interest in preventing fraud (6.1.f).

If you pay with Link by Stripe, your card details are stored by Stripe under its own privacy policy; we never see them.

5. Who we share data with

Data is shared only with contractors the Service can’t run without, and only to the extent necessary.

Model providers receive only the prompt and the files for the generation, without your name or email. Transfers to the USA and other countries outside the EEA rely on the EU adequacy decision (EU–US Data Privacy Framework) where the recipient is certified, otherwise on the EU Standard Contractual Clauses (SCC). You can request a copy of the safeguards at info@genframe.ai.

6. Cookies

Essential cookies. Sign-in session (gf_session), interface language (gf_lang), your choice in the cookie bar (gf_consent), sign-in protection, the Cloudflare Turnstile bot check and Stripe payment protection. The bot check at sign-in is done by Cloudflare Turnstile, invisibly to you; how Cloudflare processes this data is described in the Turnstile Privacy Addendum. The theme (light or dark) is stored in your browser, not on the server. There are no advertising cookies.

Partner cookie (gf_ref). If you arrive through a link of a genframe Partner Program member (an address with ?ref=), we store the gf_ref cookie with that partner’s nickname for 60 days and log the visit once on our server. This is how we credit the partner for your sign-up and purchases. The cookie holds no personal data about you and is not shared with ad networks. Legal basis: legitimate interest (Art. 6(1)(f) GDPR), paying our partners fairly. You can delete the cookie in your browser settings.

Cookie-free statistics (Umami). We count visits with Umami, which runs on our own server in Estonia (EU). Umami sets no cookies and does not store IP addresses: it sees the page address, the referring site, the browser and device type and the country, and counts unique visitors with an anonymous hash that changes every day and cannot identify you. The data is not shared with anyone. Legal basis: legitimate interest (Art. 6.1.f GDPR), to understand which pages are useful.

Google Analytics statistics cookies (only with your consent). If you click “Accept” in the cookie bar, we load Google Analytics 4 in Google Consent Mode (Consent Mode v2). The data processor is Google Ireland Limited (Ireland); Google may transfer data to the US under the EU–US Data Privacy Framework. Google Analytics sets the cookies _ga and _ga_* (kept 2 years) to tell visits apart; advertising features and Google Signals are turned off. If you chose “Necessary only”, Google Analytics is not loaded at all. Legal basis: consent (Art. 6.1.a GDPR). You can change your choice at any time: cookie settings.

7. Emails

We send emails from info@genframe.ai through Zone’s mail server: email confirmation, receipts and payment messages, important account notices. News and collections only if you subscribed, with an unsubscribe link in every email.

8. Your rights

At any time, you can:

• find out what data we hold and get a copy of it;
• correct inaccurate data;
• delete your data and account (except what we are required to keep by law, such as invoices);
• restrict processing, or object to processing based on legitimate interest;
• receive your data in a machine-readable format;
• withdraw consent, for example to the newsletter or to showing your work in the gallery.

Write to info@genframe.ai from the email address linked to your account. We respond within one month, free of charge. If you believe we are violating your rights, you can file a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the supervisory authority in your country.

9. Security

The connection is encrypted (HTTPS), only the company’s owners have access to the servers and database, protected by two-factor authentication, and we do not store user passwords. We will notify you and the Inspectorate of any breach that threatens your rights within the GDPR deadlines (the Inspectorate within 72 hours).

10. Children

The Service is not intended for persons under 18 years of age. If we learn that an account was created by a minor, we will delete it and refund any unused credits.

11. Changes

The current version is always on this page, with its date. We’ll email you about material changes, such as a new data recipient.