Privacy policy
Last updated 12 October 2026
What we collect
Account details you give us (email, name, company), the images you upload, the images we generate for you, billing records held by our payment processor, and cookieless page view counts.
Photos of people
A photo of a person may contain biometric information. We process it only to produce the images you ask for, we never use it to train a model, and we delete it automatically 30 days after upload. You can delete it sooner from Settings. Before you upload one we ask you to confirm you have that person’s permission, and we record that confirmation.
IP addresses
We store a one-way hash of your IP address for abuse prevention and rate limiting, not the address itself.
Cookies and analytics
We count page views with Vercel Web Analytics, which sets no cookies and does not identify you across sites or days. We skip it if your browser sends a Global Privacy Control signal, or if you previously declined analytics on this site. We use no advertising or tracking cookies. If we ever add a tool that sets analytics cookies or records sessions, it will load only after you accept it on a cookie banner. Strictly necessary cookies for signing in, security and abuse prevention are always set. Analytics never receive your uploaded images.
Do Not Track
Your browser may send a Do Not Track or Global Privacy Control signal. We treat Global Privacy Control as an opt out and skip analytics when it is on. We do not track you across other websites, so there is no cross site tracking for a Do Not Track signal to turn off.
Who else sees your data
Model providers process your images to generate output. Our hosting, storage, email and payment providers process the data needed for their function. We do not sell personal data and we do not share it for advertising. The current list of sub-processors is available on request and changes are notified in advance on business agreements.
How long we keep things
Photos of people: 30 days. Other uploads and generated images: until you delete them or 30 days after your account closes. Billing records: as long as tax law requires. Hashed IPs: 90 days.
Your rights
You can access, correct, export or delete your data. Email privacy@rorlai.app and we will action it within 30 days. If you are in the EU or the UK you may also complain to your supervisory authority; if you are in Turkey, to the KVKK authority.
International transfers
Our infrastructure and some providers are in the United States. Transfers out of the EEA and the UK rely on Standard Contractual Clauses.
Contact
privacy@rorlai.app.