Privacy Policy

We collect only what is necessary to provide the service:

• Account data — name, email address, and profile picture from your Google account (collected via Google OAuth at sign-in).
• Training photos — the selfies you upload to train your personal AI face model (JPEG, PNG, or WebP images).
• Face data (embeddings) — numerical representations of your face derived from your training photos during model training, used to personalise your model and to run the automated identity check on generated portraits.
• Generated portraits — images produced by your personal model, stored so you can access and download them.
• Usage data — pages visited, features used, error logs, and performance metrics (collected in aggregate; no cross-site tracking).
• Billing data — payment method details are handled exclusively by Stripe. We store only a Stripe customer ID and subscription status — never full card numbers.

• Training photos are used solely to train your personal AI face model. They are not shared with other users, not used to train any shared or third-party model, and not used for advertising.
• Generated portraits are stored so you can re-download them at any time. We do not use them for any purpose other than serving them back to you.
• Account data is used to authenticate you and send transactional emails (order confirmations, model-ready notifications, password resets).
• Usage data is used in aggregate to improve the service and diagnose issues.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

• Contract performance(Art. 6(1)(b) GDPR) — processing your account data, training photos, and generated portraits to deliver the service you signed up for.
• Legitimate interests(Art. 6(1)(f) GDPR) — aggregate usage analytics used to maintain and improve the service.
• Legal obligation(Art. 6(1)(c) GDPR) — retaining billing records as required by French accounting law.

Selfies and generated portraits may be classified as biometric data under Art. 9 GDPR. We process them on the basis of your explicit consent given at sign-up and confirmed before you start your first training session. You may withdraw consent at any time: deleting a model from My Models immediately and permanently removes that model, its training photos, and the face data derived from them. To close your account and erase everything else, email hello@ohmyunicorn.com.

• Training photos — deleted immediately and permanently when you delete your model from My Models, or upon an account-closure request.
• Face data (embeddings) — deleted immediately and permanently together with the model they were derived for, or upon an account-closure request.
• Trained model — removed from your account immediately when you delete it and no longer usable; weight files held by our AI processing provider are no longer accessible through SyntheticPic.
• Generated portraits — kept until you delete them or your account is closed. Deleting a model does not delete the portraits it already generated.
• Account data — retained for the duration of your account, plus 12 months after closure (to handle disputes or legal obligations).
• Billing records — retained for 10 years as required by French commercial law (Code de commerce, art. L123-22).

Model deletion is user-initiated from My Models and takes effect immediately; the currently active model must first be switched out before it can be deleted. Full account closure remains available by email (see Your rights below).

Under GDPR and French law you have the right to:

• Access — request a copy of all personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — request deletion of your data ("right to be forgotten").
• Portability — receive your data in a structured, machine-readable format.
• Restriction — ask us to limit how we process your data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — revoke consent for biometric processing at any time.

To exercise any of these rights, email hello@ohmyunicorn.com. We respond within 30 days. You may also lodge a complaint with the French data-protection authority: CNIL (cnil.fr).

We use a small number of sub-processors to operate the service. All are bound by Data Processing Agreements and handle your data only on our documented instructions:

• Stripe — payment processing (USA; EU Standard Contractual Clauses apply).
• Google — authentication via Google OAuth.
• fal.ai— AI model training and image generation (USA); generated portraits and model weight files are stored on fal's content delivery network.
• EU hosting provider — EU data centers (Germany) hosting the application, database, training photos, and face data.

We do not use third-party advertising networks or sell data to data brokers.