Privacy Policy

This policy was last updated on 2026-10-11.

1. Data Controller

Reimorph is operated by an individual under the Reimorph brand, not an incorporated company. The individual operator is responsible for the personal information processed by this Service. Data Protection Officer: Not applicable. For operator identification enquiries, privacy questions, data-rights requests, account matters, or billing matters, contact support@reimorph.com.

2. Personal Information We Collect

Information you provide

• Account information: email address, name (optional), and password (stored only as a cryptographic hash).
• Third-party sign-in, if you choose it: the provider account identifier and authorized basic profile information, such as your email address, display name, and profile image, plus authentication information needed to maintain the sign-in connection. Google sign-in is available when configured; it is optional.
• Content you create: the reference images you upload and the prompts you enter, together with the generated results. This content is private to your account.
• Communication records: support emails, in-app feedback/support tickets, their subjects and messages, timestamps, and replies needed to handle your request.
• Content reports and appeals: the contact details you choose to provide, the reported page URL or generation/task ID, your explanation, and our related correspondence. Please do not send illegal material or unnecessary personal information in a report.

Information collected automatically

• Device and network data: IP address, browser type and version, operating system.
• Usage data: pages visited, features used, generation activity (model, options, credits consumed), and referral source.
• Log data: server logs kept for security and abuse prevention.

Payment information: card numbers and other payment data are collected and processed exclusively by our PCI-DSS compliant payment processor, Waffo Pancake (our merchant of record). Card data is never transmitted to or stored on our servers.

When purchases are enabled, we receive the order and subscription identifiers, selected product, amount and currency, payment status, billing-period and refund information necessary to deliver credits and maintain your account. These are transaction records, not complete payment-card data. Paid checkout is currently disabled pending merchant approval.

3. How We Use Your Personal Information

| Purpose | Legal basis (GDPR Art. 6) | | -------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | | Providing the service: generating images, storing your private gallery, delivering results | Performance of a contract | | Account management, authentication, and security | Performance of a contract / legitimate interests | | Assessing prohibited-content reports, moderation appeals, and enforcing acceptable-use rules | Legitimate interests in operating a safe service / legal obligation where applicable | | Processing payments, credits, receipts, and preventing fraud | Performance of a contract / legal obligation | | Sending service emails (receipts, security notices, verification) | Performance of a contract / legal obligation | | Product improvement using aggregated, non-identifying usage statistics | Legitimate interests | | Marketing emails (only if you opt in) | Consent, withdrawable at any time |

4. Cookies and Tracking Technologies

Our current release uses cookies and similar technologies for:

• Strictly necessary functions: session, authentication, and security checks. Blocking these may prevent the requested service from working.
• Functional preferences: remembering interface choices and generation drafts where you use those features.
• Anti-bot verification: Cloudflare Turnstile processes browser and network signals to protect account and generation actions. See Cloudflare's privacy policy and Turnstile addendum.

Google Analytics, Plausible, advertising pixels, and third-party live-chat widgets are not currently configured on this release. If we enable non-essential tracking later, we will identify the provider, update this disclosure, and provide any consent controls required before enabling it.

You can inspect, delete, or block cookies through your browser settings. There is currently no site-wide cookie-preference banner, so we do not claim that one is available. See our Cookie Policy for details.

5. Sharing and Disclosure of Personal Information

We do not sell your personal information. We share it only as follows:

• Payment processing: Waffo Pancake processes your payments as merchant of record and receives the transaction data necessary for billing, tax, and refunds.
• AI model providers: to generate your edits, your reference images and prompts are transmitted to the third-party AI model you selected (for example Google, xAI, OpenAI, Black Forest Labs, or Alibaba models) through our model providers, solely to process that specific request. Providers are contractually and by policy restricted from using customer inputs to train their public models where such restrictions apply.
• Generation and infrastructure providers: fal.ai routes the selected image-generation request; Cloudflare supplies hosting, D1 database storage, private R2 image storage, Turnstile anti-bot checks, and email delivery/routing. A support email may be forwarded to the operator's support mailbox for handling your request. If you choose Google sign-in, Google processes authentication information under its own privacy policy.
• Content safety review: configured review providers may process prompts or generated images to check compliance with our acceptable-use rules. Authorized support staff may review the minimum content and report information needed to assess a complaint or appeal. A private image needed for an automated review may be made available to the review provider through a short-lived, image-specific access link; it is not published as a public gallery.
• Service providers: hosting, email delivery, and anti-abuse infrastructure, bound by data processing agreements.
• Legal requirements: when required by law, regulation, or valid legal process.
• Business transactions: in the event of a merger or acquisition, with notice to you.

Provider notices: fal.ai privacy policy, Cloudflare privacy policy, and Google privacy policy. Our current prompt-review provider is Waffo Content Safety and our generated-image review provider is SeeAPI. Provider notices do not replace our responsibilities under this policy.

6. Data Security Measures

We protect your data with TLS/HTTPS encryption in transit, hashed passwords, role-based access controls, private per-user media storage, and audit logging. Normal private-gallery access requires authentication and an ownership check; authorized administration, generation, and content review access is limited as described above. In the event of a personal data breach affecting you, we will notify you and the applicable regulator within 72 hours where legally required.

7. Retention of Personal Information

| Data category | Retention | Disposal | | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ------------------------------------------ | | Account information | While your account is active; 30 days after deletion request | Deleted | | Reference images, prompts, and results | While your account is active; deleted within 30 days of account deletion | Deleted | | Transaction and billing records | 7 years (tax and accounting obligations) | Anonymized or retained as required by law | | Server logs | Up to 12 months | Deleted | | Content reports and appeal correspondence | Only as necessary to assess and resolve the report, enforce our rules, and meet applicable legal requirements | Deleted or minimized when no longer needed | | Marketing consent records | Until consent withdrawal plus 3 years | Deleted |

8. Your Data Rights

Depending on your jurisdiction, you have the right to: access, correct, delete, restrict processing of, and port your personal data; object to processing based on legitimate interests; and withdraw consent for marketing at any time. To exercise any right, email support@reimorph.com — we respond within approximately 30 days. If you are in the EU/EEA or UK, you may also lodge a complaint with your local data protection authority.

9. Marketing Communications

We do not currently operate a marketing-email subscription program or an account-level marketing toggle. If we introduce marketing emails, we will obtain any required opt-in consent and provide a working unsubscribe method before sending them. You can contact support@reimorph.com about communication preferences. Service-critical notices (billing, security, account verification) are not marketing and are sent as necessary to operate your account.

10. International Data Transfers

Our service operates on global cloud infrastructure, and your data may be processed in countries other than your own, including Singapore, the United States, and the European Union. Where required, transfers are protected by standard contractual clauses or equivalent safeguards.

11. Children's Privacy

The Service is not directed to children. You must be at least 18 years old to use it (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children; if we learn we have, we delete it promptly.

12. Third-Party Links and Services

Our website may link to third-party sites and services (for example, our payment processor). We are not responsible for their privacy practices; please review their policies separately.

13. Changes to This Policy

We may update this policy and will notify registered users by email at least 15 days before material changes take effect. The "last updated" date above always reflects the current version.

14. Contact Us

• Privacy questions and data requests: support@reimorph.com
• General support: support@reimorph.com
• Prohibited content reports and moderation appeals: support@reimorph.com
• Legal matters: support@reimorph.com

Operated by Reimorph. Support hours: business days, response within 2 business days.