This policy explains how LIU WEI processes personal data when you use TurnMyPhoto. The controller is LIU WEI.
1. What we collect
- Account data: email address, authentication data and account status.
- Age-verification data: your date of birth and when you confirmed it, used only to enforce the 18+ requirement.
- Photos you upload and the results generated from them.
- Generation data: the template used, status, cost and consent record.
- Payment data: handled by Waffo Pancake as merchant of record; we do not store card numbers.
- Usage data: pages visited and errors, collected only if you accept analytics cookies.
- Marketing consent: whether you opted in to news and whether you have unsubscribed. We do not send marketing email without an opt-in.
2. Why we use it
- To provide the service: run the effect, deliver the result, manage credits.
- To keep the service safe: enforce the template allowlist, handle reports and abuse.
- To meet legal and payment-provider obligations.
- To enforce the adult-account requirement and keep the related record.
- To improve the product, using analytics only with your consent.
- To send marketing email, only where you opted in and never after you unsubscribe.
Where the GDPR applies, the lawful bases are performance of a contract, our legitimate interests in keeping the service safe, consent for analytics cookies, and legal obligation for records we must keep.
3. Retention
Uploaded photos are kept for 7 days and generated results for 30 days, unless you delete them earlier. Account data, including the age-verification record and the marketing consent record, is kept while the account exists and is deleted with it. Reports and moderation records are kept for up to 12 months after the report is closed; open reports are kept until they are resolved. Payment records are kept as long as tax law requires.
4. Sharing
We use service providers to run the product: Waffo Pancake (payments), Cloudflare R2 (file storage), fal.ai and Google (AI models), Sightengine (content safety checks), Resend (transactional email), PostHog (analytics, only with consent) and Railway (hosting). Your photos are sent to the AI provider that produces your chosen style; which one is used is shown on the effect page. The generation models currently include Google Gemini image models (the installed headshot recipe uses gemini-nano-banana-2.1) and fal.ai FLUX image and Veo video models. We do not publish the private prompt or parameters, and we do not use your photos to train models. They process data on our instructions. Where data leaves the EEA or the UK, we rely on appropriate safeguards such as standard contractual clauses. We do not sell your email address or share it with an advertising network.
5. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your data, to object to or restrict processing, and to withdraw consent. You can delete your uploads and results in the app, and you can delete your whole account from the danger zone on your account page (/account). Deleting your account removes your uploaded photos and generated results from storage, your files, generation history, contact messages and sign-in data. Reports you filed are kept as legal records without the link to your account. You can also contact [email protected]. You may complain to your local data protection authority. You can stop marketing email with the unsubscribe link in any marketing message; the link works without signing in.
6. Marketing email
We send marketing email only if you opted in. Every marketing message carries an unsubscribe link and our postal address, and the link works without signing in. Unsubscribing stops marketing email but not essential messages about your account, a purchase, a verification link or a password reset. You can also ask us to stop by writing to[email protected].
7. Children
The service is for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child's photo has been uploaded, use the report page and we will remove it.
8. Security and changes
We use access controls, private storage and retention limits to protect the data. No system is perfect; if a breach affects you we will notify you and the authorities as the law requires. We may update this policy and will change the date above.
9. Contact
Privacy questions and requests: [email protected].