Privacy Policy

Who is responsible

The controller is [pending: company legal name], [pending: registered address] ([pending: tax ID]). Privacy contact: privacy@amondu.com.

When a business uploads photos of its own staff, models or customers, that business is the controller of those photos and we process them on its behalf (see the Data Processing Addendum).

What we collect

Account data (name, e-mail, password hash or sign-in provider), workspace and billing data (through Stripe — we never see your full card number), the files you upload and the outputs you create, consent records for identities, support messages, and technical data (IP address, device and log data, security events).

Images of people can reveal physical characteristics. We use them only to create the images you ask for and never to identify people. Identity features require the person's signed consent.

Why and on what legal basis

To provide the service and bill you (performance of the contract); to keep it secure, prevent fraud and abuse and moderate content (legitimate interests and legal obligations); to keep accounting and tax records (legal obligation); to measure and improve the product with analytics (only with your consent, which you can withdraw in Cookie settings); and to send product e-mails you asked for (consent or legitimate interest, with an unsubscribe link in each).

Who receives it and international transfers

Our service providers (listed on the Subprocessors page) process data on our instructions. When data leaves the EEA or UK we rely on adequacy decisions (including the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.

We do not sell your personal information and we do not share it for cross-context behavioral advertising.

How long we keep it

Free-plan outputs: 30 days. Paid workspaces: while subscribed, then 30 days to export. Account data: while your account is open. Invoices: as long as tax law requires (usually 6–10 years). Security logs: up to 12 months. Consent records: for as long as the consent is valid plus the period needed to defend claims.

Your rights (EU, EEA and UK)

You can ask to access, correct, delete, restrict or port your data, object to processing based on legitimate interests, and withdraw consent at any time. Write to privacy@amondu.com; we answer within one month. You can also complain to [pending: lead supervisory authority] or the authority where you live.

Your rights (US states)

Residents of California and other US states with privacy laws can ask to know, access, correct and delete their personal information and to opt out of sale, sharing, targeted advertising and profiling. We do none of those, and we honor Global Privacy Control signals as an opt-out. We will not discriminate against you for using your rights. Requests: privacy@amondu.com or the Your Privacy Choices page; an authorized agent can act for you.

Children and security

Amondu is not for anyone under 18 and we do not knowingly collect children's data. We protect data with encryption in transit and at rest, access controls, two-factor authentication for staff and audit logs.