Privacy Policy

1. Information We Collect

1.1 Account Information. Email address, authentication credentials, account role, the age range you confirm at signup, streak/usage counters, and last-active date.

1.2 Photos and Generated Content. Original photographs you upload, optional custom reference images, AI-generated transformed images, and comic strips.

1.3 AI Analysis Data. Facial feature descriptions, estimated age, facial landmark coordinates, and AI-generated character details (name, class, rarity, backstory, traits, stats) produced from your photographs. The facial feature descriptions and facial landmark coordinates are your Facial Data, as defined in Section 4.

1.4 Biometric Consent Record. A timestamp reflecting when you gave consent to processing of your Facial Data and, for a Teen Account, a record of the parental or guardian consent obtained before any such processing, including the date, time, and reference of the verifying payment-card transaction (see Section 4).

1.5 Usage Data. Transformation settings, timestamps, credit balance, daily usage counts, and device/browser information.

1.6 Billing Information. Credit-pack purchase records, payment status, and records of any transaction used to verify parental or guardian consent for a Teen Account. We do not receive or store full payment card details — these are handled directly by our payment processor.

1.7 Referral Information. Referral codes and the email addresses of users you refer.

1.8 Safety Settings. Graphic Mode preference and content-restriction preference.

1.9 Locally Stored Preferences. Your privacy-consent choice, Facial Data consent flag, and animation-effect preference are stored in your browser's local storage, not on our servers. The age range you confirm at signup is also stored with your account, as described in Section 1.1.

2. How We Use Your Information

2.1 We use collected information to:

• 2.1.1 provide the AI photo transformation and comic-strip creation service;
• 2.1.2 create and manage your account, credit balance, and free trial credits;
• 2.1.3 store and display your transformation gallery and favorites;
• 2.1.4 process payments and prevent fraud;
• 2.1.5 enforce daily usage limits to maintain service quality;
• 2.1.6 apply safety measures, including AI-based age estimation and blocking of certain transformation types for apparent minors;
• 2.1.7 monitor, secure, and improve the Service; and
• 2.1.8 send service-related communications (receipts, policy updates, low-credit and referral notices) and comply with legal obligations.

2.2 We do not currently send marketing emails, and we do not share your information with unaffiliated third parties for their own marketing purposes.

3. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area or United Kingdom, we process your information based on: (a) performance of our contract with you (providing the Service you signed up for), (b) your consent (in particular for Facial Data processing and optional analytics), and (c) our legitimate interests in securing, operating, and improving the Service and preventing fraud.

4. Biometric Information

4.1 To generate your transformations, the Service analyzes facial characteristics in your photos, generating facial feature descriptions and facial landmark coordinates (together, your "Facial Data"). Before any such analysis occurs, you must affirmatively check a consent box and click "I Consent"; we log the timestamp of that consent. If your account is a Teen Account, as described in Section 5.8, we do not perform this analysis at all unless a parent or guardian has first consented on your behalf by completing a payment-card transaction that notifies the primary holder of that payment account. The payment method must belong to the consenting parent or guardian and not to the Teen Account holder. We use that transaction only to confirm that the person consenting is an adult, and we do not receive or store full card details. You may withdraw this consent and request deletion of your Facial Data at any time — see Section 11 (Your Choices) for how.

4.2 The Service is not currently offered to residents of, or accessible from, Illinois, Texas, or Washington, and we use IP-based geolocation to block access from those states, given their specific biometric privacy statutes.

5. Children and Teens

5.1 Because the age confirmation at signup is self-reported and we do not verify it, our Service remains likely to be accessed by people under 18. We therefore apply the following protections to every account, regardless of the age confirmed at signup, rather than trying to determine which individual users are minors.

5.2 Default Privacy and Safety Settings. Every account starts with our most protective settings enabled by default: Graphic Mode is off, content restrictions are on, and age-restricted transformation types remain blocked.

5.3 Age Estimation for Content Safety. We apply AI-based age estimation to uploaded photographs to decide whether a specific requested transformation is permitted (e.g., blocking swimwear or body-modification styles where the subject appears under 18). The estimated age generated for this purpose is used only to make that safety determination — it is not used for any other purpose, not retained longer than necessary to make and record that determination, and never repurposed for advertising, profiling, or anything unrelated to content safety.

5.4 No Self-Reported Bypass. Confirming an age of 18 or older at signup does not unlock age-restricted content, loosen any default setting, or remove the protections described in this Section 5.

5.5 Age-Appropriate Language. This Privacy Policy and our Terms of Service are also available in a shorter, plain-language summary written for younger users — see our Privacy & Safety, Explained Simply page.

5.6 Tools and Controls. The Account & Data page is designed to be easy to find and use. You can review and adjust safety settings, and delete an account and its data, at any time through that page — see Section 11 for how.

5.7 Location Data. We use IP-based location only to determine whether a user is accessing the Service from a state where it isn't offered (see Section 15). We do not share a user's precise location with other users, third parties, or use it to track a minor's whereabouts.

5.8 Teen Accounts (Ages 13 to 17). If you confirm at signup that you are between 13 and 17, we treat your account as a Teen Account. The following limits apply to a Teen Account and cannot be changed from within the account: we do not generate Facial Data from photographs uploaded to a Teen Account, and we perform no AI facial analysis on them other than the age estimation described in Section 5.3, unless a parent or guardian has first given consent by completing a transaction using a credit card, debit card, or other online payment method that notifies the primary holder of that payment account of the transaction, and that payment method must belong to the consenting parent or guardian and not to the Teen Account holder; Graphic Mode is unavailable; age-restricted transformation types remain blocked; the referral program is unavailable, so a Teen Account neither collects nor submits other people's email addresses; and we do not send marketing communications to a Teen Account. A parent or guardian who has given consent may withdraw it at any time using the contact method in Section 11; we will stop the processing and delete any Facial Data held for that account.

The Service is not directed to children under 13, and the age-gate at signup requires every user to confirm their age range before proceeding. An account confirmed as belonging to a user aged 13 to 17 is a "Teen Account" and carries the additional limits in Section 5.8. Age confirmation is self-reported and we do not independently verify it, so Sections 5.1–5.8 above apply to every account, not only to accounts identified as Teen Accounts.

6. Cookies and Local Storage

We use essential cookies to operate the Service and maintain your login session, and cookies to remember your preferences. We also use optional analytics cookies to understand usage patterns — you may decline these through the privacy-consent prompt shown on your first visit. We recognize and honor the Global Privacy Control (GPC) signal and other legally recognized universal opt-out preference signals where applicable. Separately, certain preferences (consent choices and animation settings) are stored only in your browser's local storage and are not transmitted to our servers. Rejecting or disabling essential cookies through your browser settings may prevent login and use of core features.

7. How We Share Your Information

7.1 We share information with:

• 7.1.1 Third-party AI providers (including Replicate), who receive your uploaded photos and reference images to generate transformations, and who are permitted to use that content only to produce the output you request and not to train, fine-tune, or otherwise improve their own models;
• 7.1.2 Our payment processor (Base44 Payments / Wix Payments), which handles billing and receives payment information directly — we do not store full card details;
• 7.1.3 Service providers for hosting, analytics, and email delivery, under confidentiality and data-processing obligations;
• 7.1.4 A QR-code generation service, which receives only referral codes (no personal information) to create referral QR images; and
• 7.1.5 Legal and safety authorities, when required by law, court order, or to protect the rights, safety, or property of Company or others.

7.2 We do not sell your personal information, and we do not share aggregate or non-personal information with third parties for marketing purposes.

8. Data Storage and International Transfer

The Service is operated from the United States, and your information is hosted on U.S.-based infrastructure. If you access the Service from outside the U.S., your information will be transferred to and processed in the United States. The United States is not the subject of a European Commission adequacy decision. Where we transfer personal data of EEA or UK users to the United States, we do so under the European Commission's standard contractual clauses, and, for United Kingdom users, the UK International Data Transfer Addendum to those clauses, together with supplementary technical and organizational measures where required. We have entered into those clauses with the third-party providers described in Section 7 that receive personal data on our behalf. You may request a copy of the relevant clauses using the contact method in Section 11.

9. Data Security

9.1 We use reasonable administrative, technical, and physical safeguards to protect your information, including:

• 9.1.1 row-level security restricting each standard user to their own records;
• 9.1.2 token-based authentication;
• 9.1.3 PCI-DSS-compliant payment processing, with no full card data stored on our servers;
• 9.1.4 input validation on backend systems to prevent injection attacks;
• 9.1.5 IP-based geolocation blocking for restricted states; and
• 9.1.6 admin-only access to security audit logs and other sensitive internal dashboards.

9.2 No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9.3 Third-Party Providers.

9.3.1 We rely on third-party providers — including Replicate, our payment processor, and our hosting, analytics, and email-delivery providers — to operate parts of the Service. Each maintains and is responsible for its own security practices, which we do not control. We are not responsible for a security incident, data breach, or unauthorized access that occurs on a third-party provider's own systems, except to the extent it results from our failure to exercise reasonable care in selecting or overseeing that provider.

9.3.2 If a Breach Occurs. If a security incident occurs that affects your personal information, we will notify you and, where required, applicable regulators, in accordance with applicable law.

10. Who Can Access Your Information

You can access and manage your own account information at any time. Company personnel with the administrator account role have broader access across user accounts — including the ability to view, update, or delete records — for support, security, and content-moderation purposes. This administrative access is a function of internal role permissions and is not conditioned on your individual consent.

11. Your Choices and Opt-Out Rights

11.1 You have the following choices regarding your information:

• 11.1.1 Analytics tracking: decline optional analytics cookies through the privacy-consent prompt at any time.
• 11.1.2 Cookies generally: control or reject cookies through your browser settings (note: rejecting essential cookies may prevent login and use of the Service).
• 11.1.3 Facial Data consent: withdraw your consent to Facial Data processing and request deletion of your Facial Data at any time by emailing legal@transformme.net.
• 11.1.4 Account and data deletion: delete your account and all associated data at any time through the Account & Data page in the app.
• 11.1.5 Referral program: decline to participate in, or stop using, the referral program at any time.
• 11.1.6 Marketing communications: we do not currently send marketing emails; if this changes, every marketing message will include an unsubscribe option, and you may also opt out by contacting us.
• 11.1.7 California residents: exercise your CCPA/CPRA rights (see Section 12) by emailing legal@transformme.net.
• 11.1.8 EEA/UK residents: exercise your GDPR rights (see Section 14) by emailing legal@transformme.net.

11.2 To exercise any of these choices, contact us at legal@transformme.net. We will respond to verified requests within the time required by applicable law.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information (including sensitive personal information, such as biometric data) we collect, to request deletion or correction of that information, and to opt out of the sale or sharing of your personal information. We do not sell or share your personal information for cross-context behavioral advertising. You also have the right to limit the use of sensitive personal information, which you may exercise using the contact method in Section 11. We will not discriminate against you for exercising these rights.

13. Other U.S. State Privacy Rights

If you live in Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Utah, or Virginia, state law may give you rights similar to those described in Section 12, including the right to:

• 13.1 confirm whether we process your personal data, and access it;
• 13.2 correct inaccuracies in your personal data;
• 13.3 delete your personal data;
• 13.4 receive a portable copy of your personal data; and
• 13.5 opt out of the sale of your personal data, targeted advertising, and certain kinds of profiling.

We do not sell your personal information, use it for targeted advertising, or engage in profiling that produces a legal or similarly significant effect on you, so several of these opt-outs already reflect our default practice. Some of these states (including Maryland and Connecticut) provide additional protections specific to consumer health data; we do not collect consumer health data as defined under those laws. If we deny a rights request and your state provides a right to appeal, we will explain how to do so in our response. To exercise any of these rights, contact us using the method in Section 11. We will respond within the time required by the law of your state.

A handful of additional states (including Oklahoma, Louisiana, Alabama, and Vermont) have enacted similar comprehensive privacy laws that are not yet in effect as of the date of this Policy. We intend to extend the same practices described above to residents of those states as their laws take effect, and will update this Policy accordingly.

14. European Users (GDPR/UK GDPR)

If you are located in the EEA or UK, you have the right to access, correct, delete, or restrict our processing of your personal data, to receive a copy of your data in a portable format, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local data protection supervisory authority. Exercise these rights using the contact method in Section 11.

15. State Availability

The Service is not available to residents of Illinois, Texas, or Washington, and access from these states is blocked based on IP-based geolocation, in light of those states' biometric privacy statutes.

16. Aggregate and Internal Analytics Data

We compile aggregate usage statistics (e.g., daily transformation counts, total users, revenue, credit usage, and signup-funnel metrics) for internal purposes, visible on internal dashboards. Some aggregate data may be exported to our own internal spreadsheets (e.g., via a Google Sheets connector) but is not shared with outside third parties.

17. Data Retention

We retain your information for as long as your account remains active and as necessary to provide the Service. Facial Data is an exception. We use your Facial Data solely to generate the transformation you request, and we permanently delete it as soon as that transformation completes or fails. We do not retain Facial Data after that point, and we do not use it to train or fine-tune any model. Retention of your uploaded photographs and of the resulting transformed images is separate, and is governed by the content-retention terms of our Terms of Service. If you request deletion of your account or your Facial Data specifically, we will delete the applicable information within the time required by applicable law, except where we are required to retain certain records (e.g., payment records) for legal or accounting purposes. This Section 17, together with Section 4 (Biometric Information) and Section 9.3.2 (If a Breach Occurs), is our written biometric policy. It is published here and available to the public, and it sets out our retention schedule for Facial Data, our guidelines for permanent destruction of that data, and our protocol for responding to a security incident affecting it.

18. Automated Decision-Making and AI-Generated Content

18.1 AI-Generated Content Disclosure. Transformed images, comic strips, and AI-generated character details are produced by artificial intelligence, not a human artist. Where required by applicable law (including Article 50 of the EU AI Act for users in the EEA/UK), we label or otherwise disclose that this content is AI-generated.

18.2 No Use for Advertising or Profiling. We do not use your photos, Facial Data, or AI-generated content to build an advertising profile about you, and we do not use it to make any decision about you other than the content-safety determination described in the Children and Teens section above.

19. Third-Party Links

The Service may contain links to third-party websites or services we do not operate or control. We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies before providing them with information.

20. Changes to This Policy

Changes to this Privacy Policy are effective upon posting, and continued use of the Service after changes take effect constitutes acceptance of the updated policy. We will notify users of significant changes through an in-app notice or email; minor changes may be reflected only by an updated "Last Updated" date.

21. Contact Us

Unfolde Technologies, LLC

Phoenix, AZ

Questions, requests, or complaints regarding this Privacy Policy: legal@transformme.net