Privacy Policy

1. Who is responsible

Generama Labs Inc., a Delaware corporation, decides how the data described here is processed and is the controller for it. Write to [email protected] about anything on this page.

2. What we hold

• Your account — the email address you sign in with, your name if you give one, and when you signed in. Held by Clerk on our behalf. If you are invited to a team, the owner who invited you sees your email address.
• What you upload — garment photographs, photographs of mannequins, photographs of a person wearing an outfit, backgrounds, the two photographs of yourself used to make a custom model, and the text you write to describe a scene. Files are kept as you uploaded them, including any details your camera stored in them.
• What the service makes — the rendered images and clips, the settings that produced them, and a record of each request to a model provider: the images and instructions sent and what came back. We keep that record with the run so we can find out why an image failed or came out wrong.
• Billing — your plan, your credit balance and your purchase history. The payment itself is handled by Stripe; card numbers never reach us.
• Technical records — IP address, browser, request times, error reports and application logs, kept to run the service securely.
• How the app is used — which pages are opened, and a few actions: starting or cancelling a run, starting a clip, saving a look, opening checkout. Each carries only counts, such as how many images or garments, and the app also reports errors that occur in your browser. None of it carries your name, email or uploads, it is not tied to your account, and it does not follow you from one visit to the next.
• Visits to this website — the same kind of anonymous page statistics; if you accept analytics cookies, Google Analytics measurement; and if you accept marketing cookies, the Meta Pixel (see “Cookies and local storage”).
• Sign-ups, first runs and subscriptions — if you accept the matching cookies in the app, our servers tell Google and Meta when you create an account, when you start your first run of your own, and when you pay for your first subscription, with its price. With each go your IP address, your browser and the Google and Meta cookie identifiers this website set, if it set any; Meta also receives a hashed (scrambled) copy of your email address and of your account number, so it can match the event to a Facebook or Instagram account.
• What you send us — the details you enter when you ask for a call, which go into a Google Form, and whatever you write to us by email.

3. Photographs of people

• A photograph of someone wearing an outfit (Street to On-Model). Before it goes to an image model, we find the faces in it and blur them, and the image model receives only the blurred copy. The faces are found on graphics servers we rent from Vast.ai, to know where to blur; no one is identified. Only faces are blurred: the rest of the photograph, including the person’s body, is sent. If no face can be found, nothing is sent and the image is not charged.
• Checking a render. To make sure a finished image still shows the model you chose, in the pose you chose, we compare the face and pose in two images the service generated. Your uploaded photographs are never part of this comparison, and no face template is kept, only the result.
• A custom model is made from two photographs of you by Google’s Gemini models. Images rendered with it carry that likeness, and pass through the same providers as any other render.
• Mannequin and garment photographs are sent as you uploaded them, so leave out anything you do not want a model provider to receive.

4. Why, and on what basis

• To provide the service you asked for, including storing your images and producing renders — because we have a contract with you.
• To take payment and keep the records tax law requires — contract and legal obligation.
• To keep the service secure, prevent abuse and fix faults — our legitimate interest in a service that works and is not misused.
• To see which parts of the app and the website are used, from statistics that identify no one — our legitimate interest in improving the product. Google Analytics on this website, and the sign-up, first run and subscription reports from the app, run only with your consent.
• To measure our ads on Facebook and Instagram, and to show them to people who have visited this website, through the Meta Pixel, and to learn which ads led to an account, a first run or a subscription — only with your consent, which you can withdraw at any time from the cookie banner.
• To answer you when you write to us — contract and legitimate interest.

We do not sell data, and we do not send marketing email unless you ask for it. Apart from the advertising above, which needs your consent, we do not profile you.

5. Who else processes it

These providers process data on our instructions, for the purpose described next to each:

• Clerk — accounts, sign-in, and the emails that verify an address or invite you to a team.
• Stripe and Link — payments, receipts and tax. For subscriptions started since 16 September 2026, Link, a Stripe company, is the seller of record.
• OpenAI — the main image model for Flat Lay, Street and Mannequin to On-Model. It receives the image of the model you chose, your garment or mannequin photographs or the blurred photograph of a person, and the instructions for the render.
• Google — the Gemini models that finish renders, produce editorial images, generate scenes from a description and make custom models; Google Forms, where a request for a call is sent; and Google Analytics, on this website and for the app’s sign-up, first run and subscription reports, with your consent.
• Runware — access to further image and video models: a second image model used when the main one fails, the model that adjusts garment length, and the video model that turns a finished image into a clip. These models are made by ByteDance, Black Forest Labs and Alibaba.
• Vast.ai — graphics servers that run our own image tools: finding faces to blur, outlining skin and clothing, measuring where a garment ends, comparing faces and poses in generated images, and refining faces in finished renders. These servers read and write your files in our storage directly.
• Temporal — coordinating the steps of a render. It sees settings, the instructions sent to the models and references to files, not your images.
• Amazon Web Services — storage of your uploads, renders and run records, and delivery of images to your browser.
• Render — hosting, application database and job queue.
• Cloudflare — delivery of the website and the app, and protection of both against attack.
• PostHog — the usage statistics described above, held in the United States.
• Sentry — error and performance reports and application logs, which include your IP address and account identifier and can include the instructions sent to an image model, so faults can be fixed. Held in the European Union.
• Cookiebot — the cookie banner on this website and in the app, which records the choice you make.

Inside the service, everyone in a team sees the team’s uploads, renders and credits. Our own staff can see your account and your renders when they need to, to support you or to keep the service safe.

Meta is not one of these providers: it uses the data for its own purposes as well as ours. If you accept marketing cookies on this website, the Meta Pixel sends Meta the pages you visit, the buttons you click, whether you sent a request for a call or went to sign up — without what you wrote in the form — your IP address, your browser, the identifier in a Meta cookie, and any cookies Meta’s own sites have set in your browser, which lets Meta match the visit to a Facebook or Instagram account. If you accept marketing cookies in the app, our servers send Meta the same kind of data when you create an account, start your first run of your own or pay for your first subscription: the event, the price of a subscription, your IP address, your browser, the Meta cookie identifiers and a hashed copy of your email address. We use it to see whether our ads on Facebook and Instagram lead to visits, accounts and subscriptions, and to show our ads to people who have visited. For collecting and sending this data, we and Meta (Meta Platforms Ireland Limited for the EU, Meta Platforms, Inc. for the UK) are joint controllers under Meta’s Controller Addendum: we give you this notice, and Meta handles requests to use your rights over that data. What Meta does with it afterwards is covered by Meta’s Privacy Policy.

We do not sell your data, and apart from the Meta Pixel and these reports from the app we do not share it for advertising. We disclose it beyond these providers and Meta only when the law requires, to protect people or the service from harm, or to a buyer if the business is sold — and a buyer must keep to this policy.

6. Training

We do not train models, and we do not use your photographs or your renders to improve anything beyond producing the output you asked for. Each provider receives only what it needs for the step it performs, and we do not authorise any of them to train on it. OpenAI and Google state, for the paid API services we use, that content sent through them is not used to train their models.

If we ever want to show your work — in a case study, on this site — we will ask you first, each time.

7. How long it is kept

• Uploads, renders and the records of each run stay while your account is open, so you can come back to them.
• When you delete a garment, a mannequin photograph, a photograph of a person, a background or a custom model, its file is removed from storage. When you delete a render or a clip, it leaves your library at once, and its file is removed when your account is deleted. Copies made while producing an image — blurred copies, outlines, the records of each request — are kept with the run until then.
• The source photographs of a custom model are deleted when you choose a result.
• If you leave a team, what you made in it stays with the team.
• Ask us to delete your account and we remove your images, renders and account data within 30 days.
• Technical logs are kept for up to 90 days, and the coordination records of a render for up to 90 days.
• Billing records are kept for as long as tax law requires, which is usually seven years. Those records are held by Stripe.

8. Where it is processed

Your uploads and renders are stored in the United States, and the service runs on infrastructure in the United States and the European Union. The graphics servers we rent from Vast.ai can be in other countries. Usage statistics are held in the United States and error reports in the European Union. Where data leaves the EU or UK, the transfer relies on the European Commission’s Standard Contractual Clauses or an equivalent safeguard. Meta processes what the Meta Pixel and the app send in the United States and elsewhere, under its own transfer safeguards.

9. Your rights

If you are in the EU or the UK, you can ask for a copy of your data, have it corrected, have it deleted, take it elsewhere, object to processing based on legitimate interest, withdraw a consent you gave, or ask us to restrict what we do with it. We answer within a month.

Write to [email protected]. If you think we have handled your data badly, you can complain to the data protection authority where you live.

10. If you live in the United States

If you live in California or another state with a privacy law, you can ask what personal information we hold about you, have it corrected or deleted, and receive a copy. We do not sell personal information. If you accept marketing cookies on this website, the Meta Pixel shares the pages you visit, what you click on them, your IP address and a cookie identifier with Meta for advertising, and if you accept them in the app, our servers tell Meta when you sign up, start your first run or subscribe, with a hashed copy of your email address. California law calls this sharing for cross-context behavioral advertising. To opt out, decline marketing cookies or change your choice in the cookie banner; neither the pixel nor the app sends anything to Meta when your browser sends a Global Privacy Control signal. We will not treat you differently for using these rights. Write to [email protected]; you may also have an authorised agent write for you, and we will ask you to confirm it is you.

11. Cookies and local storage

This website asks before it sets analytics or marketing cookies, through a Cookiebot banner. If you accept analytics cookies, Google Analytics measures visits with its own cookies. Until you choose, or if you decline, Google receives only signals without cookies or identifiers, which it uses to estimate visits in aggregate. If you accept marketing cookies, the Meta Pixel loads, sets a Meta cookie and tells Meta which pages you visit and what you click on them; until then it does not load at all, and it never loads when your browser sends a Global Privacy Control signal. Cookiebot stores your choice in a cookie of its own, shared by this website and the app so you are asked once, and you can change it at any time from the banner. Separately, the website counts page views with PostHog, which uses no cookies and no local storage. Cloudflare, which delivers the website, sees each request.

The app sets only what is needed to sign you in and keep you signed in, and keeps your settings, any unsent draft and whether you have seen a guide in your browser’s local storage, so they are there when you come back. Neither is used to track you, and usage statistics in the app use no cookies and no local storage. Stripe sets what it needs to detect fraud at checkout, and the videos on the guide page come from YouTube, which may set cookies of its own when the page loads. The app asks for your consent with the same Cookiebot banner, unless you have already answered it on this website. It loads neither Google Analytics nor the Meta Pixel; if you accept, it sends our servers the Google and Meta cookie identifiers this website set and the choice you made, so they can report sign-ups, first runs and subscriptions as described above — analytics cookies cover the report to Google, marketing cookies the one to Meta, and nothing goes to Meta when your browser sends a Global Privacy Control signal.

12. Security

Data is encrypted in transit and at rest with our storage and hosting providers, access is limited to the people who need it to run the service, and sign-in is handled by a specialist provider rather than by us. The links that show you your images are signed and expire, within seven days at most; until then, anyone you pass a link to can open that file. No service can promise perfect security; if a breach ever affects your data, we will tell you and the relevant authority as the law requires.

13. Children

The service is not for people under 16, and we do not knowingly hold their data. If you believe a child has given us data, write to us and we will delete it.

14. Changes

We will update this policy as the service changes. If a change matters — a new provider, a new purpose — we will email you before it takes effect. The date at the top always shows the current version.

15. Contact

Generama Labs Inc. — [email protected]