Privacy Policy

1. Information We Collect

We collect several types of information depending on how you interact with our Site:

1.1 Photos You Upload

When you use our AI portrait generation service, you upload one or more photographs. These photos are transmitted to our servers and processed by our AI system to generate royal-style portraits. We store uploaded photos securely and use them solely for the purpose of generating your portrait(s). Photos are not shared with third parties except as necessary for AI processing (see Section 4).

1.2 Order Information

When you make a purchase, we collect information necessary to process your order, including:

• Email address (collected during Stripe checkout)
• Billing information (processed and stored by Stripe; we do not store full payment card details)
• Shipping address (for physical print and canvas orders only)
• Order details (product type, size, amount paid)

1.3 Device and Usage Information

When you visit the Site, we automatically collect certain information about your device and browsing activity, including:

• IP address and approximate geographic location
• Browser type and version, operating system
• Device type (desktop, mobile, tablet) and screen resolution
• Referring website or source
• Pages visited, time spent on pages, click behavior
• Session recordings and heatmap data (via Hotjar)

1.4 Session Information

We use anonymous sessions to allow you to use the Site without creating an account. A unique session identifier is stored in a cookie on your browser and linked to your uploads, generations, and orders. No personal information is required to start a session.

2. How We Use Your Information

We use the information we collect to:

• Provide the service: Process your uploaded photos through our AI system to generate portraits, deliver digital downloads, and fulfill physical print/canvas orders.
• Process payments: Complete transactions securely through Stripe and maintain order records.
• Communicate with you: Send order confirmations, download links, shipping updates, and respond to support inquiries via email (powered by Klaviyo).
• Improve the service: Analyze usage patterns, identify issues, and optimize the user experience using analytics tools.
• Marketing: With your consent, send promotional emails about new features, templates, or offers. You can unsubscribe at any time.
• Prevent fraud and abuse: Monitor for unauthorized access, automated abuse, or attempts to circumvent our security measures.

3. Photo Data Handling

We take the handling of your uploaded photos seriously. Here is how we treat your photo data:

• Purpose limitation: Uploaded photos are used solely for generating AI portraits. We do not use your photos for training AI models, selling to third parties, or any purpose other than fulfilling your portrait request.
• AI processing: Your photos are sent to our AI provider (Google Gemini via fal.ai) for portrait generation. The AI provider processes the images in real time and does not retain them after generation is complete.
• Storage: Uploaded photos are stored securely in our cloud infrastructure (Supabase Storage) with access controls. Only your session can access your uploads.
• Retention: Uploaded photos are automatically deleted 30 days after upload. Generated portraits (both watermarked previews and purchased clean versions) are retained for 90 days to allow for purchases and re-downloads.
• Early deletion: You may request immediate deletion of your photos and generated portraits at any time by contacting us at help@turnmeroyal.com.

4. Third-Party Services

We share your information with the following third-party service providers, each for a specific purpose:

Payment Processing

• Stripe — Processes all payments. Stripe receives your email, billing details, and payment card information. Stripe's privacy policy: stripe.com/privacy

Data Storage

• Supabase — Hosts our database and file storage (uploaded photos, generated images, session data, order records). Data is stored in secure cloud infrastructure with encryption at rest.
• Vercel — Hosts our website application. Processes web requests and may log IP addresses and request metadata.

AI Processing

• fal.ai / Google (Gemini) — Processes your uploaded photos to generate AI portraits. Photos are transmitted securely and processed in real time. The AI provider does not retain your images after processing.

Email Communications

• Klaviyo — Sends transactional emails (order confirmations, download links) and marketing emails (with your consent). Klaviyo receives your email address and order information. Klaviyo's privacy policy: klaviyo.com/legal/privacy

Analytics and Tracking

• Google Tag Manager (GTM) — Manages analytics and marketing tags on our Site. GTM may load additional scripts from Google Analytics and other providers.
• Meta Pixel (Facebook) — Tracks conversions and enables retargeting advertising on Meta platforms (Facebook, Instagram). Collects browsing behavior and purchase events.
• Mixpanel — Tracks user interactions and events (e.g., photo uploads, generations, purchases) to help us understand usage patterns and improve the service.
• Hotjar — Records anonymized session replays and generates heatmaps to help us understand how users interact with our Site. Hotjar does not collect personal information from form fields.

5. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

• Essential cookies: Session identifier cookie (tmr_session) that allows you to use the Site without creating an account. This cookie is necessary for the service to function.
• Analytics cookies: Placed by Google Analytics, Mixpanel, and Hotjar to collect anonymized usage data and improve the service.
• Marketing cookies: Placed by Meta Pixel and Google to enable targeted advertising and measure ad campaign effectiveness.

You can control cookie preferences through your browser settings. Disabling essential cookies may prevent the Site from functioning properly. Disabling analytics and marketing cookies will not affect core functionality but will limit our ability to improve the service and show you relevant advertisements.

6. Behavioral Advertising

We use your personal information to provide you with targeted advertisements or marketing communications that we believe may be of interest to you. This is done through the following mechanisms:

• Meta (Facebook/Instagram): We use Meta Pixel to track actions on our Site (such as viewing a preview or completing a purchase) and create custom audiences for advertising on Meta platforms.
• Google Ads: We may use Google advertising services via GTM to display retargeting ads to visitors who have interacted with our Site.

You can opt out of targeted advertising by adjusting your preferences on these platforms:

• Facebook: facebook.com/settings/?tab=ads
• Google: adssettings.google.com
• Digital Advertising Alliance: optout.aboutads.info

7. Data Retention

We retain your data for the following periods:

• Uploaded photos: Automatically deleted 30 days after upload.
• Generated portraits: Retained for 90 days after generation to allow for purchases and re-downloads.
• Order records: Retained for as long as necessary for accounting, tax, and legal compliance purposes (typically 7 years).
• Session data: Anonymous session records are retained for 12 months, after which they are purged.
• Email and marketing data: Retained until you unsubscribe or request deletion.
• Analytics data: Retained according to each analytics provider's retention policies (typically 14–26 months).

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

For all users:

• Request deletion of your uploaded photos and generated portraits at any time.
• Unsubscribe from marketing emails using the link in any email we send.
• Request information about what data we hold about you.

For EU/EEA residents (GDPR):

If you are a resident of the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR), including:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate personal data.
• Right to erasure: Request deletion of your personal data (“right to be forgotten”).
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to processing of your data for direct marketing or based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at help@turnmeroyal.com. We will respond to your request within 30 days. You also have the right to lodge a complaint with your local data protection authority.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS/SSL), encryption at rest for stored data, access controls on file storage, and secure handling of payment information through Stripe (PCI DSS compliant). However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

10. Children's Privacy

Our service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal data, please contact us at help@turnmeroyal.com and we will take steps to delete such information.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States (where some of our service providers are located). We ensure that appropriate safeguards are in place for such transfers, including Standard Contractual Clauses (SCCs) where required under GDPR.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the updated policy on this page with a revised “Last updated” date. We encourage you to review this page periodically. Your continued use of the Site after any changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Company: UAB “Madcom”
• Email: help@turnmeroyal.com
• Website: ai.turnmeroyal.com