Privacy policy
Last updated 27 July 2026
What we collect
Account details you give us (email, name, company), the images you upload, the images we generate for you, billing records held by our payment processor, and product analytics if you have consented to them.
Photos of people
A photo of a person may contain biometric information. We process it only to produce the images you ask for, we never use it to train a model, and we delete it automatically 30 days after upload. You can delete it sooner from Settings. Before you upload one we ask you to confirm you have that person’s permission, and we record that confirmation.
IP addresses
We store a one-way hash of your IP address for abuse prevention and rate limiting, not the address itself.
Analytics
In the EU, the EEA, the UK and Turkey, no analytics load until you accept them. Elsewhere they load by default and you can decline at any time from the banner. Analytics never receive your uploaded images.
Who else sees your data
Model providers process your images to generate output. Our hosting, storage, email and payment providers process the data needed for their function. We do not sell personal data and we do not share it for advertising. The current list of sub-processors is available on request and changes are notified in advance on business agreements.
How long we keep things
Photos of people: 30 days. Other uploads and generated images: until you delete them or 30 days after your account closes. Billing records: as long as tax law requires. Hashed IPs: 90 days.
Your rights
You can access, correct, export or delete your data. Email privacy@rorlai.app and we will action it within 30 days. If you are in the EU or the UK you may also complain to your supervisory authority; if you are in Turkey, to the KVKK authority.
International transfers
Our infrastructure and some providers are in the United States. Transfers out of the EEA and the UK rely on Standard Contractual Clauses.
Contact
privacy@rorlai.app.