← Spooky Portraits · Privacy · Terms · Refunds · Español

Privacy Notice

⚠️ Draft template — not legal advice; to be reviewed by a lawyer before publication.

Controller (data "responsable"): Gustavo Mier (persona física), nombre comercial GamaLabs ("GamaLabs", "we"), operating Spooky Portraits (spooky.gamalabs.ai), with address at Querétaro, Mexico. Contact for privacy matters: privacy@apps.gamalabs.ai. This notice is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and also covers the basics of the EU/UK GDPR and California's CCPA/CPRA for international users.

1. Summary

• We use your selfie only to check it for safety and to create the portraits you ask for. We never use your photos or portraits to train AI models, and we do not sell or share them.
• Your selfie is processed in memory and not stored in any database. Paid HD images are kept encrypted for 24 hours so you can re-download them, then deleted automatically.
• Adults 18+ only. Photos that appear to show minors are rejected.

2. Personal data we process

• Your photo (selfie): resized (max 1024 px) and stripped of metadata (EXIF/location) before processing. A face image is personal data; we do not use it to identify you or create face templates (no biometric identification).
• Generated images: the free preview (low resolution, watermarked) is sent to your browser and not kept by us. Paid HD images are stored encrypted (AES) for up to 24 h.
• Preview token: an encrypted token with your photo and chosen style, plus a copy of your watermarked preview, is kept in your browser (not on our servers) for up to 24 h so you can buy the HD version; we cannot read it without our server key, and it expires automatically.
• Technical and usage data: IP address and a random browser identifier, used to enforce the free-preview limit (2 per day) and prevent abuse; daily counters expire within 48 h and abuse statistics within 30 days. Hosting logs are kept by Vercel for security.
• Payment data: processed by Stripe. We receive the payment status, amount, a session ID and, if provided to Stripe, your email and country; we never receive your full card number. Payment records are kept as required by tax and accounting law (in Mexico, generally 5 years).
• We do not knowingly collect sensitive personal data (health, religion, sexual life, etc.). Please do not upload photos that reveal such data.

3. Purposes

Primary purposes (necessary for the service): (a) automated safety moderation of your photo (minors, nudity, groups, public figures, illegal content); (b) generating your preview and paid HD portraits; (c) processing payments, delivering purchases and handling support, refunds and chargebacks; (d) enforcing limits, security and fraud prevention; (e) complying with legal obligations. Secondary purposes: none. We do not use your data for marketing, profiling or AI training.

4. Processors (encargados) and international transfers

• fal.ai (Features & Labels, Inc., USA): AI inference for moderation and image generation. Requests are sent with request-history storage disabled (X-Fal-Store-IO: 0) and output files set to expire after 10 minutes.
• Stripe (Stripe, Inc. / Stripe Payments Mexico): payment processing, fraud prevention and disputes; Stripe is an independent controller for some data under its own privacy policy.
• Vercel (Vercel Inc., USA/global edge): hosting and security logs.
• Upstash (key-value store): encrypted HD cache (24 h), counters and payment-session flags.

These providers act on our instructions to deliver the service (in Mexican law, "remisiones" to processors, which do not require your consent). Data is processed in the USA and other countries; for EEA/UK users, transfers rely on Standard Contractual Clauses or the EU-US Data Privacy Framework where applicable. We do not transfer your data to third parties for their own purposes, except when required by law or a competent authority.

5. Retention and deletion

• Selfie: not stored; deleted from memory when the request ends (fal output files expire in ≤10 min).
• Paid HD images: encrypted, auto-deleted after 24 h.
• Payment-session flags: 30 days. Abuse statistics: 30 days. Preview counters: ≤48 h.
• Payment and invoice records: as required by law.

6. Legal bases and consent

Under the LFPDPPP we process your photo with your express consent, given by ticking the consent box before uploading. Under the GDPR: consent (Art. 6(1)(a)) for your photo, contract (Art. 6(1)(b)) for purchases, legitimate interests (Art. 6(1)(f)) for security, abuse prevention and protecting minors, and legal obligation (Art. 6(1)(c)). You may withdraw consent at any time (stop using the service and/or write to us); withdrawal does not affect processing already completed.

7. Your rights

Mexico (ARCO rights): Access, Rectification, Cancellation and Opposition, plus withdrawal of consent and limiting use/disclosure. Send a request to privacy@apps.gamalabs.ai with your name, a way to reply, a copy of an ID (or your representative's authority), a clear description of the data and right, and any helpful information (e.g., the Stripe receipt). We will respond within 20 business days and, if applicable, act within 15 business days thereafter, as provided by law. You may file a complaint with the Mexican data protection authority (Secretaría Anticorrupción y Buen Gobierno, successor of the INAI). EEA/UK: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to your supervisory authority. California: right to know, delete and correct; we do not sell or share personal information or use sensitive personal information beyond providing the service, and we will not discriminate against you for exercising your rights. Since we keep almost nothing, many requests are fulfilled automatically.

8. Security

HTTPS in transit, encryption of HD images and tokens at rest, minimal retention, access restricted to authorized personnel. No system is 100% secure; we will notify you of breaches that significantly affect your rights as required by law.

9. Cookies and local storage

We do not use advertising or tracking cookies. The app uses your browser's local/session storage for a random ID (preview limit) and your preview token. Our landing page may use privacy-friendly, cookieless analytics.

10. Minors

The service is only for people aged 18 or older. We do not knowingly process data of minors; photos that appear to show minors are automatically rejected and not used.

11. Changes

We will publish any changes to this notice on this page with a new date; material changes will be shown in the app.

Spooky Portraits · GamaLabs · Privacy · Terms · Refunds · Español