Privacy Policy

1. Who We Are

This Privacy Policy is issued by Trionity Web Services LTD("PhotoMania.net", "we", "us", or "our"), a company registered in Israel. We are the data controller (or the equivalent under your local law) for personal data processed through our website at photomania.net, our companion mobile applications, and related services (collectively, the "Service").

Registered address: Enzo Sereni 18, Givatayim, Israel.
Privacy contact: support@photomania.net.

For users in the European Economic Area (EEA), United Kingdom (UK), and Switzerland, see Section 17 for our representative arrangements and supervisory authorities.

2. Scope of This Policy

This Policy applies to all individuals who interact with the Service, including visitors, registered account holders, and users of our paid plans. It covers personal data we collect online, through our mobile apps, and through customer support communications. It does not apply to third-party websites, products, or services that we do not control, even if they are linked from the Service.

3. Information We Collect

3.1 Information you provide

• Account information: name, email address, profile picture, authentication identifiers from Google, Apple, or email magic-link sign-in.
• User content: photos and other media you upload, including any metadata embedded in those files (e.g., EXIF).
• Payment information: billing details and payment method tokens. Card numbers are handled by our payment processors (Stripe and Polar) and are not stored on our servers.
• Communications: support messages, survey responses, and any feedback you send us.
• Marketing preferences: your opt-in or opt-out choices for marketing emails.

3.2 Information collected automatically

• Device & technical data: browser type and version, operating system, language, screen resolution, device identifiers.
• Usage data: pages viewed, effects used, generation timestamps, error events, time spent in the Service.
• Log data: IP address (used and then discarded or hashed for security/abuse prevention), access times, referring URLs.
• Cookies and similar technologies: see Section 7 and our Cookie Policy.

3.3 Information from third parties

• Identity providers: if you sign in with Google or Apple, we receive your name, email, and profile image from them.
• Payment processors: Stripe and Polar provide us with payment status, plan, and billing country.
• Future integrations: if you choose to connect a third-party photo source (e.g., Facebook, Dropbox, Google Photos — planned features), we will receive only the photos and metadata you explicitly authorize.

4. How We Use Your Information (Purposes & Legal Bases)

For users in the EEA, UK, and Switzerland we list the GDPR / UK GDPR / revFADP legal basis for each purpose. For users elsewhere, we still process data only for these purposes.

We do not use your photos to train our AI models without your separate, explicit opt-in.

5. How We Process Your Photos

• Processing: When you generate an effect, your photo is sent to a third-party AI inference provider (currently Replicate and similar) to produce the output. We send only what is needed for the requested transformation.
• Storage: Inputs and outputs are stored in our cloud object storage (Cloudflare R2) so you can access them in your gallery. Storage URLs are private by default.
• Retention: Photos remain available until you delete them, your account is deleted, or our retention schedule applies (see Section 11).
• No model training on your private content: We do not use your photos to train, fine-tune, or evaluate our AI models without your separate, explicit consent.
• Public sharing is opt-in: Photos are private unless you choose to share them via a public link or in a discover feed.

6. How We Share Your Information

We share personal data only with the categories of recipients below and only as necessary for the purposes in Section 4. We do not sell your personal data, and we do not share it for cross-context behavioural advertising (as those terms are defined under California law).

6.1 Sub-processors and service providers

6.2 Legal disclosures

We may disclose information if required by law, subpoena, court order, or other lawful request, or where we believe disclosure is necessary to investigate fraud or violations of our Terms, to protect our rights, property, or safety, or that of our users or the public.

6.3 Business transfers

In the event of a merger, acquisition, financing, reorganisation, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you and any applicable regulators where required.

6.4 With your consent

We share information with third parties for any other purpose only when you give us your specific consent.

7. Cookies and Similar Technologies

We use cookies, local storage, and similar technologies for four categories of purposes: Strictly Necessary, Functional, Analytics, and Marketing. We load Analytics and Marketing cookies only after you give consent (or, in jurisdictions that allow opt-out rather than opt-in, only until you object).

We honour the Global Privacy Control (GPC) signal from compatible browsers as a request to opt out of analytics and marketing.

You can change your choices anytime via the Cookie Preferences button in our footer or from your account settings. For full details and a category-by-category cookie list, see the Cookie Policy.

8. Data Security

We implement administrative, technical, and physical safeguards designed to protect your information, including:

• TLS encryption for data in transit
• Encryption at rest in our managed databases and object storage
• Role-based access controls and least-privilege production access
• Audit logging for sensitive administrative and privacy actions
• Regular dependency updates and security reviews

No security measure is perfect. If we ever experience a personal-data breach that is likely to result in risk to your rights, we will notify you and the appropriate regulators where required by law.

9. International Data Transfers

We are based in Israel and most of our sub-processors operate in the United States or globally. When personal data is transferred from the EEA, UK, or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (and the UK Addendum or Swiss equivalent), supplemented where necessary by additional technical and organisational measures.

Israel has been recognised by the European Commission as providing an adequate level of protection for personal data transferred from the EEA.

10. Your Rights

Depending on where you live, you may have the rights described in Section 17. Regardless of jurisdiction, you can exercise the following from Settings → Privacy & Data:

• Access & portability: download a copy of your data in JSON format.
• Correction: update your name or profile from settings, or contact us for other changes.
• Deletion: request account deletion. We immediately anonymise your account, and we hard-delete your content after a 30-day grace period (so you can recover it if you change your mind).
• Marketing opt-out: turn off marketing emails with one click.
• Cookie preferences: withdraw analytics or marketing consent at any time.

You can also email us at support@photomania.net for any of these requests. We will respond within the timelines required by applicable law (typically 30 days, extendable as permitted).

We will not discriminate against you for exercising any of these rights.

11. Data Retention

We keep personal data only as long as we need it for the purposes set out in this Policy:

• Account data: while your account is active.
• Uploads and generated images: until you delete them or your account is hard-deleted.
• Soft-deleted accounts: PII is anonymised immediately on deletion request; remaining content is hard-deleted after a 30-day grace period.
• Billing records: retained as required by tax and accounting laws (typically 7 years).
• Consent records: retained for the duration of the consent plus a reasonable period for evidence (typically 3 years after withdrawal).
• Audit and security logs: retained for security and compliance, typically 12–24 months.

12. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. Users between 13 and 17 may use the Service only with the consent and supervision of a parent or legal guardian, where required by local law (for example, age 16 in some EU member states). If you believe a child has provided us personal data without proper consent, please contact support@photomania.net and we will take appropriate action.

13. Automated Decision-Making

We do not use your personal data for solely automated decision-making that produces legal or similarly significant effects on you. Our AI effects are creative tools that you initiate; they do not make decisions about your access to services, credit, employment, or similar matters.

14. Third-Party Links and Integrations

The Service may contain links to or integrations with third-party websites and services (e.g., social sign-in, planned imports from Facebook / Dropbox / Google Photos). We are not responsible for their privacy practices. Once you authorise a third-party integration, the data you choose to share through it is also subject to that third-party's privacy policy.

15. Marketing Communications

We send you transactional messages about your account (e.g., receipts, security notices) regardless of marketing preferences. We will only send you marketing emails if you opt in (or, where lawful, until you opt out). You can change this anytime in Settings → Privacy & Data → Marketing emails or via the unsubscribe link in every marketing message.

16. Changes to This Privacy Policy

We may update this Policy from time to time. When we make material changes we will post the new version here, update the "Last updated" date, and where required by law, notify you in-product or by email. Your continued use of the Service after a change takes effect means you accept the updated Policy.

17. Region-Specific Disclosures

17.1 European Economic Area (GDPR)

If you are in the EEA, the controller is Trionity Web Services LTD. You have the rights set out in Articles 15–22 GDPR: access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of past processing. You also have the right to lodge a complaint with your local supervisory authority. A list of EU authorities is available at edpb.europa.eu.

17.2 United Kingdom (UK GDPR & DPA 2018)

If you are in the UK, the controller is Trionity Web Services LTD. You have substantially the same rights as under the GDPR. You may lodge a complaint with the UK Information Commissioner's Office at ico.org.uk.

17.3 Switzerland (revFADP)

If you are in Switzerland, you have rights under the revised Swiss Federal Act on Data Protection that mirror the GDPR rights above. You may complain to the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

17.4 California (CCPA / CPRA) and other US state privacy laws

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, or another US state with a comprehensive consumer privacy law, you have the following rights to the extent provided by that law:

• Right to know / access the categories and specific pieces of personal information we collect.
• Right to delete personal information we hold about you.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing of personal information for cross-context behavioural advertising. We do not sell or share your personal information for cross-context behavioural advertising.
• Right to limit the use of sensitive personal information. We do not use sensitive personal information for any purpose beyond what is necessary to provide the Service.
• Right to data portability and right to non-discrimination for exercising your rights.

Categories of personal information collected in the last 12 months: identifiers (name, email, account ID), commercial information (subscription & payment records), internet/network activity (usage data, device data), geolocation (coarse, derived from IP), audio/visual (your uploaded photos and generated outputs), and inferences drawn from the above for product improvement.

How to exercise your rights: use the controls in Settings → Privacy & Data, email support@photomania.net, or send a Global Privacy Control (GPC) signal from your browser. We honour GPC as a valid opt-out request for analytics and marketing. We may need to verify your identity before fulfilling certain requests. You may use an authorised agent; we will require proof of authorisation.

17.5 Brazil (LGPD)

If you are in Brazil, the controller is Trionity Web Services LTD. Under the Lei Geral de Proteção de Dados, you have the rights of confirmation, access, correction, anonymisation/blocking/deletion, portability, information about sharing, information about the consequences of refusing consent, and revocation of consent. You may contact the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

17.6 Quebec (Law 25)

If you reside in Quebec, you have the rights of access, rectification, deletion, portability (when fully in force), and withdrawal of consent under Quebec Law 25. You may also request that automated decision-making about you be reviewed by a human (we do not currently use such automated decisions). You may contact the Commission d'accès à l'information du Québec at cai.gouv.qc.ca.

17.7 Israel (Privacy Protection Law)

If you are in Israel, our processing is governed by the Israeli Privacy Protection Law, 5741-1981 and its regulations. You have the right to inspect personal data we hold about you and to request correction or deletion of inaccurate data. You may contact us at support@photomania.net or the Privacy Protection Authority at gov.il.

17.8 Other jurisdictions

Where local law gives you additional or different rights, we will honour those rights. If you have questions about how a specific law applies, contact us at support@photomania.net.

18. Contact Us

For privacy questions, requests, or complaints, please reach out to:

• Trionity Web Services LTD
• Enzo Sereni 18, Givatayim, Israel
• Email: support@photomania.net