Profile AI — Privacy Policy

_Last updated June 16, 2026_

How Profile AI collects, uses and protects your data — especially your photos.

1. Who we are

This Privacy Policy explains how Profile AI handles your personal data. The data controller is Leonard Reuther (Germany), operator of the Profile AI app. Full contact and Impressum details are in Section 18. We take the privacy of your photos especially seriously, because Profile AI is built around them.

2. Age requirement

Profile AI is for users aged 13 and over (and at least the minimum digital-consent age in your country, up to 16 in the EU). We do not knowingly collect personal data from children under 13. If you believe a child has given us data, contact privacy@profile-app.com and we will delete it.

3. The data we collect

Data you give us

  • Account data: email address, phone number and/or name, depending on how you sign in (Apple, Google, email or phone).
  • Photos you upload of yourself, and any reference or outfit photos you add.
  • Profile data: optional username, display name, avatar and the content you choose to make public.
  • Messages you send us for support.

Data created when you use the app

  • Generated images and the settings used to create them.
  • Purchase data: your subscription status and credit purchases (processed by Apple/Google and RevenueCat).
  • Usage and diagnostics: device type, app version, language, and in-app actions used to operate, secure and improve the service.
  • Identifiers: an account ID and device/app identifiers.

4. Your photos & facial data

Profile AI processes photos of your face to generate your portraits. Depending on where you live, facial images can be considered biometric or special-category personal data, so we treat them with extra care.

  • We process your face photos only to provide the service — to generate and edit the images you ask for.
  • We do not use facial recognition to identify you, build a searchable faceprint, or track you across other services.
  • We do not sell, rent or trade your photos or any biometric data, ever.
  • We process face photos on the basis of your explicit consent, which you can withdraw at any time by deleting your photos or your account.
  • We keep your photos only as long as needed for the service and delete them when you remove them or close your account (see Section 11).

5. How we use your data

We use your data to:

  • Generate and edit your AI images and run the core features of the app;
  • Create and secure your account and authenticate you;
  • Process subscriptions and credit purchases;
  • Operate optional social features you turn on;
  • Keep the service safe — moderation, abuse prevention and enforcing our Terms;
  • Provide support and respond to your requests;
  • Comply with our legal obligations.

6. Legal bases (GDPR)

  • Your explicit consent — for processing your face photos to generate images (Art. 6(1)(a) and Art. 9(2)(a) GDPR). You can withdraw it at any time.
  • Performance of a contract — to provide the account, generations and purchases you request (Art. 6(1)(b)).
  • Our legitimate interests — to keep the service secure, prevent abuse and improve it (Art. 6(1)(f)).
  • Legal obligation — where the law requires us to process or retain data (Art. 6(1)(c)).

7. How your images are generated (AI processing)

To create your images, we send your uploaded photos and a generation prompt to our AI provider, OpenAI, which processes them through its image-generation API and returns the result.

  • Under OpenAI’s API data-usage policy, data sent through the API is not used to train OpenAI’s models.
  • OpenAI deletes API inputs and outputs within roughly 30 days, except where it must retain them to meet a legal obligation.
  • We use AI only to generate the images you request, plus automated safety checks — not to identify or profile you.

8. Who we share data with

We do not sell your personal data. We share it only with service providers (“processors”) that help us run Profile AI, under contracts that require them to protect it and use it only for us:

  • OpenAI (United States) — AI image generation. Shared: your uploaded photos and the generation prompt.
  • Supabase (European Union (eu-west-1)) — Database, file storage and authentication. Shared: account data, photos, generated images, usernames.
  • RevenueCat (United States) — Subscription and credit-purchase management. Shared: purchase history, app-user and device identifiers.
  • Apple (United States / global) — App distribution, payments, Sign in with Apple. Shared: purchase data, authentication tokens.
  • Google (United States / global) — Google sign-in and (on Android) payments. Shared: authentication tokens, purchase data.

We may also disclose data where required by law, to protect our rights or users’ safety, or in connection with a business transfer, in which case we will notify you.

9. Public & social features

If you set a public username, make your profile public, or publish uploads, that information becomes visible to other users and through people-search. Public content is not private — please don’t publish anything you wouldn’t want others to see. You can make content private again or delete it at any time.

10. International data transfers

Your account data and images are stored in the European Union (Supabase, eu-west-1). Some providers, including OpenAI, RevenueCat, Apple and Google, process data in the United States. Where data leaves the EU/EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

11. How long we keep your data

  • Uploaded photos and generated images: kept while your account is active; deleted when you remove them or delete your account.
  • Face/biometric data: never kept longer than needed for the service, and in any case destroyed when you delete your photos or account, or within three years of your last use, whichever is first.
  • Account and profile data: kept for the life of your account.
  • Purchase and transaction records: kept as long as required by tax and accounting law (generally up to 10 years in Germany).
  • Diagnostics and logs: kept for a short period for security and troubleshooting.

12. How we protect your data

We use encryption in transit, access controls and reputable infrastructure providers to protect your data. Each user’s photos and content are isolated by row-level security so other users cannot access them. No system is perfectly secure, but we work to keep your data safe and will notify you and the authorities of a breach where the law requires.

13. Your rights

Everyone

You can delete your account and all associated personal data at any time in the app under Help & Support › Delete Account. You can also delete individual photos and generations.

EU/EEA & UK (GDPR)

  • Access, rectify, erase or restrict processing of your data;
  • Data portability;
  • Object to processing based on legitimate interests;
  • Withdraw consent at any time, without affecting prior processing;
  • Lodge a complaint with your data-protection authority.

California (CCPA/CPRA)

  • Know, access, correct and delete your personal information;
  • Limit the use of sensitive personal information (including biometric data);
  • Opt out of “sale” or “sharing” — note we do not sell or share your personal information, and never your biometric data;
  • Non-discrimination for exercising your rights.

To exercise any right, use the in-app controls or email privacy@profile-app.com.

14. We do not sell or share your data

We do not sell your personal information and do not share it for cross-context behavioral advertising. We honor recognized opt-out preference signals, such as Global Privacy Control, where they apply.

15. Tracking & advertising identifiers

Profile AI does not track you across other companies’ apps or websites for advertising. If we ever ask to access your device’s advertising identifier, iOS will show you the App Tracking Transparency prompt first, and you can decline. We use only the analytics and diagnostics needed to run and improve the app.

16. Children’s privacy

Profile AI is not intended for children under 13, and we do not knowingly collect their data. Parents or guardians who believe their child has used the app can contact privacy@profile-app.com to have the data deleted.

17. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you in the app or by other appropriate means. The “last updated” date below always reflects the current version.

18. Contact & Impressum

For privacy questions or to exercise your rights, email privacy@profile-app.com. For general help, email support@profile-app.com.

Impressum (§5 DDG / §18 MStV)

  • Ulrich Reuther
  • Willibald-Alexis-Straße 25
  • 10965 Berlin
  • Germany
  • Email: support@profile-app.com

Responsible for content under §18 (2) MStV: Ulrich Reuther. Operator and data controller for the purposes of the GDPR: Ulrich Reuther.