Privacy policy

This policy explains how your personal data is processed when you visit the Genima website, use the Genima web app or the Genima Android app (together, the "Service"), and which rights you have. It is written to comply with the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 on Data Protection (LOPDGDD).

1. Who is responsible for your data

The data controller is Alejandro Acho, who runs Genima. You can contact him about anything related to your data by email at contact@genima.art or through the contact form.

2. What data we process

Account data: your name, username, email address, password (stored only as a secure hash, never in plain text), preferred language, profile picture if you add one, your token balance, and your settings and email preferences.
Google sign-in: if you choose to sign in with Google, Google shares your name and email address with us. We never receive your Google password.
Prompts and generation settings: the text you write to generate or edit images and videos (and the improved version, if you use the prompt enhancer), the model and options you choose, and the tokens each generation costs.
Your creations: the images and videos you generate, whether you keep them private or make them public, and the likes they receive.
Files you upload: images and audio clips you use as input for a tool, for example a photo to restore, expand or edit, a face for face swap, a picture for an avatar, lip-sync or character video, or a reference image. These files can show people's faces or contain their voice: only upload material of yourself or of people who have given you permission. We use these files only to carry out the operation you ask for; we do not use them to identify anyone or to build biometric profiles.
Personal styles: if you train a personal style, the photos you upload for the training and the resulting style file. A style is only available in your own account.
Purchases: when you buy tokens, Stripe processes the payment and tells us the pack you bought, the amount and the email address used. We never receive or store your full card details.
Rewarded ads (Android app): if you choose to watch a rewarded ad to earn tokens, Google AdMob shows the ad and sends us a signed confirmation with your user id and a transaction id so that we can credit the tokens. AdMob may use your device's advertising identifier according to Google's policies and your device settings.
Community features: the users you block and the content you report.
Messages you send us: the name, email address and message you send through the contact form or the feedback and support forms in the app.
Newsletter: your email address and language, only if you subscribe.
Technical data: IP address, browser and device information, and server logs needed to run the Service securely, prevent abuse (for example, by limiting the number of requests) and investigate errors.
Cookies and similar storage: see section 9.

3. Why we process it and on what legal basis

To provide the Service and manage your account: generating and storing your images and videos, training your personal styles, keeping your token balance, processing purchases and ad rewards, and sending essential emails (account verification, password reset, purchase confirmations). Legal basis: performance of the contract you accept when you sign up (Art. 6(1)(b) GDPR).
To keep the Service safe and fair: prompts and uploaded images are checked automatically for sexual or otherwise inappropriate content, and a request that fails the check is rejected (if you think a rejection is wrong, contact us); we handle reports, apply blocks, restrict accounts that break the terms, and keep a record of the email addresses that have already received the free welcome tokens so they can't be claimed twice. Legal basis: our legitimate interest in protecting the Service, its users and the people shown in content (Art. 6(1)(f) GDPR).
To keep the Service secure and working: logs, request limits, backups and error reports. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
To answer your messages. Legal basis: our legitimate interest in replying to you, or steps taken at your request before entering into a contract (Art. 6(1)(b) and (f) GDPR).
To send news and offers about Genima, only if you have agreed to receive them. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from the unsubscribe link in each email or from your email preferences.
To measure visits to the public website with Google Analytics, only if you accept the analytics cookies. Legal basis: your consent (Art. 6(1)(a) GDPR).
To comply with legal obligations, such as keeping accounting records of purchases or answering requests from the competent authorities (Art. 6(1)(c) GDPR).

We do not sell your data and we do not use your prompts, uploads or creations to train AI models (except the personal styles you train yourself, which only you can use).

4. Who can see it and who we share it with

Other users: images and videos you make public appear in the community gallery and on your profile together with your username, and may be shown as examples on the Genima website. Private creations are not listed anywhere. You can change the visibility of a creation or delete it at any time.

Service providers that process data on our behalf and under our instructions (data processors), to the extent each one needs:

Hosting, database, file storage and backup providers on which the Service runs.
FAL (fal.ai), which runs most of the image and video models and tools (upscaling, background removal, face swap, inpainting, lip-sync, avatars and others), trains personal styles, improves prompts and checks uploaded images for inappropriate content. FAL receives your prompts and the files each request needs. For some models, FAL forwards the request to the company that develops the model.
Hugging Face, which runs the free "Sketch" model and the automatic check of prompts; it receives the text of your prompts.
Stripe, to process payments.
Google, for Google sign-in, rewarded ads in the Android app (AdMob) and, only with your consent, Google Analytics on the public website.
An email delivery provider that sends our emails.
Slack, where technical error reports (which may include details of the request that failed) are sent so that we can fix problems.

We may also disclose data when required by law or by a valid request from a public authority.

5. International transfers

Some of these providers (such as FAL, Hugging Face, Stripe, Google or Slack) may process data outside the European Economic Area, mainly in the United States. In those cases the transfer is covered by the European Commission's Standard Contractual Clauses and, where the provider is certified, by the EU–U.S. Data Privacy Framework.

6. How long we keep it

Account data, creations, prompts and personal styles: while your account exists. Deleting an image or video removes it and its file. When you delete your account, your profile and everything linked to it (creations, uploads, prompts, personal styles, likes and notifications) are deleted, together with their files in our storage; copies in backups are deleted as those backups are rotated out.
Files you upload as input for a tool: deleted automatically from our storage a few days after you upload them (training photos for a personal style are kept with the style until you delete your account).
Data held by processing providers: providers such as FAL may keep the inputs and results of a request for a limited period under their own terms.
Email address after deleting your account: we keep only your email address in a list of addresses that have already received the free welcome tokens (so they can't be claimed again) and, if an account was closed for breaking the terms, in a list of banned addresses.
Accounts under review: while an account is restricted because of a possible breach of the terms, its content may be kept until the review ends.
Purchase records: for as long as tax and accounting law requires.
Contact messages: for as long as needed to handle your request and for up to one year afterwards.
Server logs: for a short period, only as long as needed for security and debugging.
Analytics data: no longer than 14 months, according to the Google Analytics retention settings.

Some data may be kept for longer when the law requires it or to defend legal claims.

7. Your rights

Under the GDPR you have the right to:

Access your personal data and obtain a copy of it.
Rectify inaccurate data. You can edit most of it directly in your account.
Erase your data. You can delete any creation, or your whole account at any time from your account page, which removes your data as described in section 6.
Portability: you can download your images and videos from your gallery at any time, or ask us for a copy of your data.
Object to processing based on legitimate interest, and ask us to restrict it.
Withdraw your consent at any time, without affecting earlier processing. For analytics, use the "Cookie settings" link in the website footer.

To exercise these rights, contact us as described in section 1. If you believe your data has not been processed lawfully, you can lodge a complaint with the data protection authority of your country of residence (in Spain, the Agencia Española de Protección de Datos, www.aepd.es).

8. Security

We protect your data with encrypted connections (HTTPS), hashed passwords and access controls. Your files are stored under long, random addresses that are not listed anywhere, but anyone who has the direct link to a file can open it, so only share links to creations you are happy for others to see. No system is completely secure; if you notice anything suspicious, please let us know.

9. Cookies and local storage

Essential: cookies and browser storage that keep you signed in and remember your language, theme, whether you have completed the app tour and your cookie choice. They are needed for the Service to work and do not require consent.
Analytics (optional): Google Analytics cookies, used only on the public website (never in the app or on the sign-in pages) and only if you click "Accept" in the cookie banner. You can change your choice at any time from the "Cookie settings" link in the footer.

10. Minors

The Service is not intended for children under 14, and we do not knowingly collect their data.

11. Changes to this policy

We may update this policy when the Service or the law changes. We will publish the new version on this page with its date and, if the changes are significant, we will let you know by email or in the app.