Privacy Policy

MimicAI is an AI photo editor. We are the data controller for your personal data — we decide how and why it is processed.

Questions: support@mimicai.app with the subject line “Data Protection Request.”

We collect the minimum needed to run the service.

Account data

• Email address (Google sign-in or email code)
• User ID (generated automatically)
• Authentication method
• Your language preference

Photos you upload

• Images you choose to upload for generation, stored in Cloudflare R2

AI-generated outputs

• Images created from your uploads, stored in R2 next to your originals

Generation metadata

• Template used, model, prompt, timestamps, status, and credits charged
• Used to deliver results, refund failed jobs, and operate the product

Payment data

• Handled by Creem (our merchant of record / payment processor)
• We store customer and subscription references, status, and credit balance
• We never see or store your full card number

Transactional email

• If email is configured, we may send sign-in codes and essential account notices
• We do not send marketing emails

Contract performance (GDPR Art. 6(1)(b))

• Creating and managing your account
• Processing subscriptions, payments, and credits
• Delivering AI-generated images

Explicit consent (GDPR Art. 6(1)(a) / Art. 9 where applicable)

When you upload a photo that includes a face, you consent to us sending it to our AI provider solely to generate the output you requested. We do not perform biometric identification or facial recognition.

Legitimate interest (GDPR Art. 6(1)(f))

• Security, abuse prevention, and rate limiting
• Diagnosing failures in generation

Legal obligation (GDPR Art. 6(1)(c))

• Keeping payment records required for tax and accounting

These processors help us run the service. We do not sell your data.

When you generate an image:

1. You upload a photo and pick a template (or write a prompt)
2. We send the photo and prompt to Replicate
3. Replicate returns an image
4. We store the output in our own R2 bucket

• Uploads and outputs: until you delete the generation in Gallery, or we delete them after an account-deletion request
• Account data: until you ask us to delete your account
• Payment records: retained as required for tax and legal compliance

Our processors may be located outside your country (including the United States). Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses or the EU-US Data Privacy Framework where a processor is certified.

Under GDPR / UK GDPR you may request access, correction, erasure, portability, restriction, objection, and withdrawal of consent for facial-image processing.

• Delete individual results in Gallery
• For account deletion or other requests: email support@mimicai.app
• We aim to respond within 30 days

You can also complain to your local data protection authority (for example the ICO in the UK or your EU DPA).

We use strictly necessary session cookies or tokens to keep you signed in. We also load Google Analytics 4, which sets `_ga` and `_ga_*` cookies to measure page views and in-product usage. We do not load advertising pixels.

MimicAI is for users 13 and older. If you are 13–18, review this policy with a parent or guardian. Some countries require 16+ or parental consent. We will delete data if we learn it belongs to a child under 13.

• TLS/HTTPS in transit
• Object access via our API and configured public media URLs
• Rate limiting on API endpoints

No system is perfectly secure. Report issues to support@mimicai.app.

If a breach is likely to affect your personal data, we will notify the relevant authority where required, tell you if the risk to you is high, and keep a record of what happened and what we did.

We may update this policy. Material changes will be announced in the product or by email where we have it. Continued use after changes means you accept the update. If you disagree, stop using the service and request deletion.

MimicAI

support@mimicai.app