Privacy Policy for the “SelfieStoryAI” Application
Effective Date: 11th of Nov 2025
This Privacy Policy is an integral part of the Terms of Service for the “SelfieStoryAI” application (“Application”). It explains what personal data we collect, how we process it, with whom we share it, and what rights you have in relation to this processing.
§1. Data Controller and Contact
- The controller of your personal data is Atomic Manufactory Sp. z o.o. with its registered office at Augustyna Szamarzewskiego 21-2, 60-514 Poznań, Poland (entered into the Register of Entrepreneurs of the National Court Register (KRS) under number 0001197011, NIP: 7812096761, REGON: 542837304).
- In all matters related to personal data protection, you can contact us by sending a message to the dedicated email address: contact@atomicmanufactory.com.
- We have not appointed a Data Protection Officer (DPO) as we are not required to do so by law.
§2. What data do we collect?
- Account Data: To use the Application, you log in using “Sign in with Apple”. We process data associated with your Apple account necessary to create and maintain your Account.
- Your Photos and Image (Inputs): The main function of the Application is to process the photos you upload. Photos containing the image of a natural person are treated by us as biometric data, which belong to special categories of personal data (sensitive data). The processing of this data is based solely on your explicit consent. Consent is given by checking a dedicated box (checkbox) before uploading the first photo. Failure to provide it will make it impossible to use the main functions of the Application.
- Payment Data: Purchases of Credits or subscriptions are processed via Apple In-App Purchases. We receive transaction confirmation from Apple, but we do not have access to your financial data (e.g., card number).
- Technical and Usage Data: We automatically collect information such as device identifiers, application and operating system version, error logs, and timestamps to ensure the proper functioning and security of the Application.
- Communication Data: We store the content of correspondence if you contact our technical support.
§3. For what purposes and on what legal bases do we process your data?
| Purpose of Processing | Example Data | Legal Basis (GDPR) |
|---|---|---|
| Provision of the Service – Account maintenance, feature delivery, payments. | Account Data, purchase history. | Art. 6(1)(b) – necessity to perform a contract. |
| Generating AI Images – processing your photos (image). | Your photos (Inputs) – special categories of data. | Art. 9(2)(a) – Your explicit and voluntary consent. |
| Ensuring Security – detecting abuse, fraud, moderation. | Account Data, technical data, logs. | Art. 6(1)(f) – our legitimate interest. |
| Improving the Application and Analytics – analysis of operation and errors. | Anonymized usage and error data. | Art. 6(1)(f) – our legitimate interest. |
| Customer Support – responding to your inquiries. | Account Data, content of correspondence. | Art. 6(1)(f) – our legitimate interest. |
| Fulfillment of Legal Obligations – tax, accounting purposes. | Transactional data. | Art. 6(1)(c) – legal obligation. |
| Establishment and Defense of Claims | All necessary data. | Art. 6(1)(f) – our legitimate interest. |
§4. With whom do we share your data? (Recipients and Sub-processors)
To provide the Service, we use the support of external partners. We only transfer your data to the extent necessary.
| Recipient Category | Entity Name and Headquarters | Role | Purpose of Transfer |
|---|---|---|---|
| AI Intermediary | Replicate, Inc., 548 Market St PMB 91633, San Francisco, CA 94104, USA | Data processor (processor) | Intermediation in access to AI models. |
| AI Model Providers | Black Forest Labs (Germany/USA), Google LLC (USA) | Further sub-processors (sub-processors) | Processing photos to generate an image (Output). |
| Login and Payments | Apple, Inc., One Apple Park Way, Cupertino, CA 95014, USA | Independent controller | Handling “Sign in with Apple” login and In-App Purchases. |
| Hosting and Infrastructure | Cloud service providers (e.g., AWS, Google Cloud) | Data processor (processor) | Storage of Application data. |
| Analytics and Error Reporting | Tools such as Firebase Crashlytics | Data processor (processor) | Monitoring the stability and performance of the Application. |
Important: In our contracts with partners (Replicate, AI Providers), we require that your photos (Inputs) and generated images (Outputs) are not used to train their AI models. Any exceptions will be clearly communicated in the Application before using that feature and will require your additional, informed consent.
§5. Data transfers outside the European Economic Area (EEA)
Your data is processed by our partners based in the USA. We ensure the legality and security of these transfers by using mechanisms approved by European law:
- Adequacy decisions: For entities certified under the EU-U.S. Data Privacy Framework (DPF) program.
- Standard Contractual Clauses (SCC): For other entities with whom we conclude Data Processing Agreements (DPAs).
Upon your request, we will provide a copy of the safeguards applied (e.g., SCCs).
§6. How long do we store your data? (Retention Table)
| Data Type | Storage Period | Justification |
|---|---|---|
| Account Data | Until you delete your account. | Performance of the contract. |
| Inputs and Outputs (in cache) | Maximum 30 days. | Legitimate interest (performance). |
| Outputs saved in the Application gallery | Until you delete them or delete your account. | Performance of the contract. |
| Transactional data | 5 years from the end of the calendar year in which the transaction was made. | Legal obligation (tax law). |
| Security and technical logs | Up to 12 months. | Legitimate interest (security). |
| Correspondence with you | Up to 2 years from the resolution of the matter. | Legitimate interest (support, claims). |
§7. Your rights and how to exercise them
You have the following rights regarding your personal data:
- The right to access, rectify, and erase data.
- The right to restrict processing and data portability.
- The right to object to processing based on our legitimate interest.
- The right to withdraw consent for the processing of biometric data at any time. You can do this in the Application settings. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
- The right to lodge a complaint with a supervisory authority – in Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl).
How to exercise your rights? To exercise your rights, send a request to the e-mail address: contact@atomicmanufactory.com. We will respond to it without undue delay, no later than within 30 days. Before processing your request, we may ask you to verify your identity. Exercising your rights is free of charge, unless the requests are manifestly unfounded or excessive.
§8. Data Security
We apply modern technical and organizational measures to protect your data, including:
- Encryption of data in transit (TLS) and at rest (AES-256).
- The data minimization principle – we process only the data that is absolutely necessary.
- Access control and regular security audits.
- Breach notification procedures: In the event of a data breach that may pose a high risk to your rights, we will inform you about it without undue delay.
§9. Cookies and tracking technologies
We do not use traditional cookies or advertising identifiers (such as IDFA) in the Application for marketing or behavioral profiling purposes. We only use technologies necessary for:
- Analysis of the Application’s operation (in an aggregated and anonymous manner).
- Error and crash reporting, to be able to react quickly and improve the Service’s stability.
§10. Additional information for California residents (CCPA/CPRA)
This section supplements the information in the Policy and applies only to residents of the state of California.
- We do not “sell” or “share” your personal data within the meaning of the CCPA definitions. We do not share data with third parties for behavioral marketing purposes. Therefore, we do not offer a “Do Not Sell or Share My Personal Information” mechanism, as we do not engage in such practices.
- You have the right to limit the use of your sensitive personal information (in our case – photos/image) solely for the purposes necessary to provide the Service. Since we process this data solely based on your consent and only for the purpose of generating AI images, this right is realized by default.
§11. Automated decision-making and profiling
We do not make any decisions about you that are based solely on automated processing (including profiling) and produce legal effects or similarly significantly affect you.
§12. Children’s privacy
The Application is intended only for persons who are 18 years of age or older. We do not knowingly collect data from minors. If we receive credible information about an account belonging to a person under the age of 18, we will immediately suspend it and delete the data associated with it.
§13. Changes to the Privacy Policy
We may update this Policy. We will inform you of significant changes in advance in the Application or by email. Your continued use of the Service after the changes take effect constitutes your acceptance of them.