Privacy Policy

Last updated: September 10, 2026

This Privacy Policy explains how AI Photos of You handles personal information when you visit aiphotosofyou.com, create a profile, purchase credits, or generate and edit photos. Carl Ulsøe Christensen, an individual based in Denmark, operates AI Photos of You and is the controller of the personal information described here ("we", "us", or "our"). Contact us using the support details below about this policy or your data.

1. Information we collect

Account information. We collect your email address, account identifier, and sign-in records. If you sign in with Google, we receive information such as your name, email address, and profile image from Google. Authentication records can include your IP address, browser information, sessions, and tokens needed to sign you in securely.

Your photo studio. We require confirmation of adult consent and store profile names, reference photos, prompts and editing instructions, generated photos, favorites, and shoot settings and status. Photos may reveal personal characteristics and information in their backgrounds. Only upload information you have permission to share.

Purchases and support. We keep credit balances, credit transactions, checkout and order identifiers, payment and refund status, and amounts needed to reconcile purchases. Polar handles payment details; we do not store full payment-card numbers. If you contact us, we receive the information you include in your message.

Technical information and attribution. Our hosting and service providers process request, network, and device information to deliver and protect the service. Our operational records include request identifiers, errors, timing, and generation usage and costs. We exclude raw prompts, photos, reference URLs, credentials, and email addresses from application logs and product analytics. We also collect campaign source, campaign name, and campaign content labels from referral links and associate them with your account to understand which campaigns bring customers to the service.

2. How we use information

We use information to authenticate you, maintain your profiles and library, generate and edit the photos you request, deliver downloads, process credits and refunds, provide support, and send sign-in emails and photo-ready notices you request. We also use necessary records to prevent abuse, investigate failures, secure the service, reconcile costs, and meet legal and accounting obligations.

Where applicable data-protection law requires a legal basis, we rely on performance of our contract for account, photo, and purchase services; legitimate interests for security, reliability, support, and measuring campaign performance; legal obligations for required financial records; and consent for optional analytics. You can decline optional product analytics without losing access to the studio. Account and photo information is necessary to provide the corresponding features; without it we cannot sign you in or create the requested photos.

3. Photos and AI processing

Reference and generated photos are private to your account by default; they are not a public gallery. To carry out a generation or edit, we send the necessary reference or source images and instructions to OpenRouter and the image provider selected for that request. These services process the content to produce a result and may apply safety checks.

We do not use your photos or prompts to train our own AI models or publish them in our marketing without separate permission. Provider processing and retention depend on the provider and the settings applicable to the request. We do not promise zero retention or immediate deletion from every provider system. See OpenRouter’s Privacy Policy and contact us for information about the provider used for your shoot.

We use photos to create images of a consented adult, not to authenticate someone through facial recognition. Do not upload identity documents or sensitive information that is unnecessary for your photo request.

4. Who receives information

  • Cloudflare hosts the application, database, and private image storage, runs photo jobs, and delivers authentication and requested photo-ready emails.
  • OpenRouter and its selected image provider process the images and instructions needed for your generation or edit.
  • Polar provides checkout, payment processing, tax handling, refunds, and the customer portal as merchant of record. Its Privacy Policy applies to information it handles for its own payment and legal purposes.
  • Google handles Google sign-in if you choose it. We manage account authentication using Better Auth software within our service.
  • PostHog receives optional product analytics after you allow it and separate billing-operation monitoring events, as described below.

We may also disclose information where necessary to comply with law or a valid legal request, protect people or the service, or resolve a dispute. If the business is transferred, information may transfer to the new operator subject to applicable law and notice of changes to how it is handled. We do not sell personal information or share it for cross-context behavioral advertising.

5. Cookies and browser storage

Your browser stores account-specific copies of photos and smaller previews to speed up repeat visits. Signing out, switching accounts, or deleting your account clears these copies in that browser. Deleted photos are removed when the app learns of the deletion. Cached copies expire after seven days and are cleaned up when the app next checks the cache. You can also remove them through your browser’s site-data controls.

Essential cookies support sign-in and security. Browser storage remembers your analytics choice; session storage holds studio drafts, sign-in continuity, and campaign attribution. With your permission, PostHog receives specific product events such as screens visited, pack selections, upload counts, checkout starts, and shoot outcomes. Events may be linked to your internal account identifier when signed in; they are not anonymous. PostHog also receives the network information necessary to receive those events.

We do not send photos, prompts, reference URLs, or email addresses in these events, and session recording and automatic interaction capture are disabled. Analytics identifiers are held in memory rather than persistent analytics cookies. Use Cookie settings to change your choice. Withdrawing consent stops future optional collection in that browser; it does not itself erase events already received. You can contact us to request deletion.

Separately, server-side billing monitoring sends PostHog service-status events and payment reconciliation failures, which may include order or checkout identifiers. These events use a service identity, not a browser analytics profile. Billing monitoring and campaign attribution operate independently of the optional analytics choice. Contact us to object to campaign attribution or request removal of linked attribution information.

6. Retention and deletion

We retain account and studio information while needed to provide your account and saved library. You can delete individual photos, profiles, or your account in the app. Deleting a profile requires deleting its associated shoots first and then removes its reference photos. Account deletion removes the whole library. Download anything you want to keep first.

Account deletion removes your primary account and session records and stored studio media. Active shoots must finish before deletion can proceed. Payment, credit-ledger, and generation-cost records remain separately for reconciliation, accounting, fraud prevention, and legal obligations. These records can retain internal account and transaction identifiers but do not retain your photos or prompts.

Retention depends on the purpose of the record, unresolved transactions or disputes, and applicable legal requirements. Deleting content from our service does not recall downloads or copies you have shared. Job execution history, temporary sign-in and security records, provider records, and any backup copies can remain beyond deletion from the app and follow their applicable retention processes; account deletion does not guarantee immediate removal of those copies.

7. Security and international processing

We use access controls and account ownership checks to protect stored media. No online service can guarantee absolute security. Keep access to your email and Google account secure, and contact us if you suspect unauthorized use.

Our providers may process information in the United States and other countries whose privacy laws differ from yours. Where required by applicable law, international transfers must have appropriate safeguards. Contact us for details of the locations and safeguards applicable to your information.

8. Your choices and rights

Depending on your location and applicable law, you may request access to, correction of, deletion of, or a portable copy of your information, or restriction of processing. You may withdraw consent where processing relies on it, without affecting earlier lawful processing. You may also have the right to object to processing based on legitimate interests. Contact support to make a request, including if a photo of you was uploaded by someone else without permission.

We may need to verify your identity and authority before acting, and some records may be exempt from deletion under applicable law. We normally respond to GDPR rights requests within one month; where legally permitted, we may extend this by up to two additional months for complex or numerous requests and will explain the extension within the first month. You may complain to the Danish Data Protection Agency, Datatilsynet, or your local supervisory authority. We do not discriminate against you for exercising privacy rights.

9. Adults only

The service is for people aged 18 or older and for photos of consenting adults. We do not knowingly collect children’s information. Contact us if you believe a child’s information has been uploaded so we can investigate and remove it as appropriate.

10. Policy updates

We may update this policy as the service or legal requirements change. We will update the date above and provide additional notice of material changes where required. If a new use requires your consent, we will ask for it before that use.

Contact

AI Photos of You is operated by Carl Ulsøe Christensen, an individual based in Denmark. For privacy requests, content concerns, or questions about these terms, email support@aiphotosofyou.com.

AI Photos of You ✳ Your AI photo studio.