Privacy Policy

The controller of your personal data is the seller of the Service: an individual entrepreneur registered in the Russian Federation, named on the Contacts page and in the seller details at the end of this document.

• Account data: your email address, which is your login and the address for account messages, and your password. The password is stored only as a one-way hash and never in plain text.
• Credits: your credit balance and the history of credit operations (purchases, credits spent, refunds and automatic returns).
• Content: the photos you upload, the text you enter (headline, instructions), and the results generated from them.
• Payment data: the order identifier and the amount that we send to the payment provider. Card details are entered on the payment provider’s page; we do not receive or store your full card number.
• Technical data: your IP address, which is processed briefly in the server’s memory to protect against password guessing and mass sign-ups. It is not used to identify you or your location and is not written to disk. We also use a random device identifier with no personal data in it, and keep a history of significant account events (sign-in, credit changes, purchases) for incident investigation and abuse prevention.
• Analytics data, only if you accept analytics: page visits and the pages you leave from, collected by Yandex Metrika and by the VK Pixel. Uploaded photos and text requests are not sent to these services.
• Browser storage: see the Cookie Policy.

Uploaded photos and their results are stored on the Service’s secure server, not only in your browser. Until an account has made at least one successful purchase, the full-size file without the watermark is not released by the server to anyone, including you; your browser receives only the reduced watermarked version. After the first purchase on the account, the server releases the full-size file without the watermark to that user only.

Your working state (the chosen scenario, headline text, composition settings and a local copy of results for quick reopening) is kept in your browser’s local storage or IndexedDB. These records are tied to that browser and are not synchronised between devices. On another device you will see your balance and account, but not the project list kept in this browser.

• Creating and running your account, signing you in, generating images and videos at your request, managing credits, promo codes, referrals and support requests. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Processing payments and keeping accounting and tax records. Legal basis: performance of a contract, and compliance with legal obligations (Article 6(1)(c) GDPR).
• Preventing fraud and automated abuse, protecting the Service, and investigating incidents. Legal basis: our legitimate interests (Article 6(1)(f) GDPR).
• Analytics through Yandex Metrika and the VK Pixel. Legal basis: your consent (Article 6(1)(a) GDPR and, in the UK, Regulation 6 of PECR). These counters load only after you click “Accept”.
• Attribution of referral and campaign links, which is set when you arrive through such a link. They contain no personal data and are used only to credit a referral or campaign.

Photos can incidentally show sensitive information, such as health or religious beliefs. We do not use photos to identify people or to infer such characteristics. Please do not upload images of other people without their consent.

We do not sell personal data. We share data only with the following recipients:

• fal.ai (United States): the AI provider that generates images and, where offered, videos. It receives the uploaded photo and the text describing the scenario, without your name, email or other account data.
• T-Bank (Russia): card payments. It receives the order identifier and the amount, and processes the card details itself as a licensed payment operator.
• Prodamus (Russia): an additional payment method. It receives the order data needed to take the payment.
• Yandex Metrika (Russia): analytics, only after you accept analytics.
• VK Pixel (VK, Russia): audience measurement for the Service’s own advertising, only after you accept analytics. It measures our advertising in VK Ads and may be used to show our ads to people who visited the site. In the English version it loads only after you click “Accept”, and you can withdraw at any time via “Cookie settings”. We do not sell personal information.
• Hosting and email delivery providers. Our servers are hosted by Beget LLC in St. Petersburg, Russia, which also delivers our emails.
• Language model provider for the text feature. Texts are created through fal.ai (United States), which passes your request to a third-party language model; we send only the text of your request.

Some recipients are outside the EU, the EEA and the UK: fal.ai in the United States, and payment and analytics providers in Russia. Russia does not have an adequacy decision from the European Commission or the UK. For analytics data sent to Russia we rely on your explicit consent (Article 49(1)(a) GDPR). Transfers to fal.ai and to our payment providers are also necessary to provide the service you ask for (Article 49(1)(b) GDPR).

Account data, and the photos and results of thumbnails made in the studio, are kept for as long as your account exists. Photo restoration and enhancement results and animated clips are kept in My photos for 30 days from creation and then deleted automatically; you can delete any of them sooner with the Delete button. The result of a free restoration made without signing in is kept for 24 hours and is linked only to your browser (a cookie); if you sign in within that time it moves to My photos, otherwise it is deleted. To limit free restorations without an account we keep a one-way hash of the IP address and a device marker for no longer than 30 days. The original photos you upload for restoration, enhancement or animation are not kept after processing. You can ask us to delete your data at any time.

When you ask us to delete your account, we delete or anonymise the data within a reasonable period, except records that the law requires us to keep longer. Payment records are kept for tax and accounting purposes for the period required by Russian law. Under Russian accounting law this is at least five years.

Event history used for security and abuse prevention, and analytics data, are kept for the periods shown in the Cookie Policy and in the settings of the analytics providers.

If you are in the EU, the EEA or the UK, you have the right to:

• access your personal data and receive a copy;
• have inaccurate data corrected and incomplete data completed;
• have your data erased;
• restrict processing, and object to processing based on our legitimate interests;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting processing done before withdrawal;
• lodge a complaint with the data protection authority of your country of residence.

We respond within one month, which can be extended where the law allows. Our anti-abuse checks are automated and can block a sign-up or an operation. You may ask us to review any such block by contacting support.

If you are a California resident, you have the right to know which personal data we collect and how we use it, to delete and correct it, to opt out of its sale or sharing, and not to be discriminated against for exercising these rights. We do not sell personal information. Residents of other US states may have similar rights under their state laws.

To exercise any right, contact us as described in the Contacts section, from the email address registered on your account. We may ask you to confirm your identity. You may use an authorised agent to make a request on your behalf.

To delete your account, email us from the address registered on the account. Deletion is handled by request. We delete the account data within 30 days of a request sent from the email address of the account.

Passwords are stored only as one-way hashes. Access to a full-size file without the watermark is checked on the server for each request and is released only to the owner of the result after a confirmed purchase, whatever the browser interface shows. Administrative access to internal tools is protected separately and is not available to ordinary users.

No system is perfectly secure. If a security incident affects your personal data, we will notify you and the relevant authorities as the law requires.

We may update this policy. The date at the top shows when the current version took effect. We tell registered users about material changes by email or on the site at least 14 days before they take effect.