Privacy Policy

(profilfoto-ki.de, Last updated: June 8, 2026)

1. Data Controller

Profilfoto KI
Owner: Safak Tepecik
Heidestraße 2, 58239 Schwerte
Germany
Email: info@profilfoto-ki.de

2. General Information

We take the protection of your personal data very seriously. Personal data is processed on this website exclusively in accordance with applicable data protection regulations, in particular the General Data Protection Regulation (GDPR).

3. Website Hosting

This website is hosted statically via Netlify Inc. (2325 3rd Street, Suite 215, San Francisco, CA 94107, USA). When you visit the website, technically necessary data (e.g., IP address, date and time of access, accessed files) is processed.

Netlify uses a globally distributed CDN. This may result in data processing in third countries, in particular the USA. The transfer is based on EU Standard Contractual Clauses (Art. 46 Abs. 2 lit. c DSGVO). A Data Processing Agreement (DPA) according to Art. 28 DSGVO is in place with Netlify.

Legal basis: Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in secure and stable operation)

4. User Accounts & Authentication

Creating a user account is required to use the service. Processed data:

• Email address
• Optional: Name (for Google login)
• Technical metadata (time of registration, session token)
• Gender specification for the selection of sample photos

During registration, we ask for your gender. This information exclusively controls which of the three versions of our sample photos we show you when selecting a look. It does not influence the generation of your images, as your appearance is derived solely from the selfies you upload, and it has no effect on price, credits, or results. You can change it at any time in the settings, and it will be deleted together with your account.

Authentication is provided via Supabase Auth (Supabase Inc., 970 Toa Payoh North, Singapore). The data is stored on servers in the European Union (Frankfurt am Main, AWS eu-central-1). A DPA according to Art. 28 DSGVO is in place with Supabase.

Alternatively, login via Google OAuth (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) is possible. In this case, Google only transmits your name and email address to our service. We do not retrieve any further data. The EU-US Data Privacy Framework applies to transfers to the USA.

Legal basis: Art. 6 Abs. 1 lit. b DSGVO (fulfillment of contract)

4a. Service and Notification Emails

a) Contract and Onboarding Emails (without separate consent)

Within the scope of the user relationship established by registration (see General Terms and Conditions § 3 Abs. 3), we send the following service emails that are necessary for providing the agreed service:

• Confirmation of registration and login by our auth provider
• Order confirmation, invoice, and payment receipts for paid purchases
• Security and system-critical notifications
• Reminder of pending onboarding steps, specifically uploading a selfie and triggering the first image generation with the free credit (maximum of two reminders per account)

Each of these emails contains an unsubscribe link that allows you to permanently prevent the sending of further onboarding reminders.

Legal basis: Art. 6 Abs. 1 lit. b DSGVO (fulfillment of contract and pre-contractual measures) or Art. 6 Abs. 1 lit. c DSGVO (legal obligation)

b) Advertising and Promotional Emails (only with explicit consent)

If the user has checked the corresponding box during registration or at a later time, we occasionally send notifications about paid offers, new features, or promotions, such as a reminder of available package upgrades after completing the free trial. Each of these emails contains an unsubscribe link. With one click, you can permanently revoke your consent. The date and time of consent are documented.

Legal basis: Art. 6 Abs. 1 lit. a DSGVO (consent). Revocation is possible at any time in accordance with Art. 7 Abs. 3 DSGVO.

5. Upload of Selfie Images

To create AI profile pictures, users upload portrait photos (PNG, JPG, WebP). The use of this feature requires an active user account. By completing the registration and accepting the terms of use, the user declares their consent to the described image processing.

Storage

The image files are stored in a private, access-protected storage area at Supabase (EU servers, Frankfurt am Main). Public access to the files is not possible; retrieval is exclusively via time-limited, signed URLs (validity: 1 hour).

Legal basis: Art. 6 Abs. 1 lit. b DSGVO (fulfillment of contract) in conjunction with Art. 9 Abs. 2 lit. a DSGVO (explicit consent)

6. AI-Supported Image Processing

To generate the profile pictures, the uploaded images are transmitted via an automated processing pipeline to the following services:

• n8n GmbH (Joachimsthaler Str. 12, 10719 Berlin, Germany), Workflow automation, coordinates the processing sequence. Data processing takes place in the EU. A DPA according to Art. 28 DSGVO is in place with n8n.
• Google LLC / Google Gemini API (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), AI image generation model (Gemini Image Generation). The uploaded images are transmitted to the Google AI API to create the profile pictures. The transfer to the USA is based on EU Standard Contractual Clauses (Art. 46 Abs. 2 lit. c DSGVO) and the EU-US Data Privacy Framework. A Data Processing Agreement according to Art. 28 DSGVO (Google Cloud Data Processing Addendum) is in place with Google. Google uses the transmitted data exclusively to provide the API service and not to improve its own products, unless configured otherwise.

The transmission is exclusively for providing the service requested by the user. No biometric profiles, facial recognition vectors, or permanent personal characteristics are stored by the sub-processors.

Legal basis: Art. 6 Abs. 1 lit. b DSGVO; Art. 9 Abs. 2 lit. a DSGVO; Art. 28 DSGVO (data processing)

7. Storage and Deletion

Uploaded selfies are automatically deleted no later than 90 days, regardless of whether the user is active. Deletion occurs automatically on a daily basis and includes both the file in the storage system and the corresponding database entry. Users are transparently informed about the remaining storage duration in the app by an expiration date per selfie. Upon account deletion, all stored selfies and generated photos are immediately and irretrievably removed from our systems.

Users can request the immediate deletion of all stored data at any time by sending an email to info@profilfoto-ki.de or directly via the account settings.

Invoice and transaction data are kept for 10 years in accordance with § 147 AO.

Legal basis: Art. 6 Abs. 1 lit. b DSGVO; Art. 17 DSGVO (right to erasure)

8. Payment Processing

Payment processing is handled by Stripe Payments Europe Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). We do not receive any credit card or bank details. Only transaction reference IDs and the payment status are stored in our database. Stripe has a DPA according to Art. 28 DSGVO.

Legal basis: Art. 6 Abs. 1 lit. b DSGVO (fulfillment of contract)

9. Tracking and Cookies

Analysis tools (Google Analytics 4) are only used with explicit consent via the cookie banner. Without consent, no tracking cookies are set and no corresponding scripts are loaded. Session cookies for authentication are technically necessary and do not require separate consent.

Legal basis: Art. 6 Abs. 1 lit. a DSGVO (consent for analysis cookies); Art. 6 Abs. 1 lit. f DSGVO (legitimate interest for technically necessary session cookies)

9a. Reach and Channel Measurement (First Party, Without Cookies)

We want to be able to track through which channel new users become aware of our offer, for example via a search engine, social networks, or a direct visit. For this purpose, we exclusively evaluate information that you transmit yourself when visiting our site, and we do not use cookies or third-party services for this.

The following details are recorded:

• The source, medium, and campaign from the referral parameters (utm_source, utm_medium, utm_campaign) of the link you clicked,
• The origin of the referring page, specifically only the domain without the path, provided your browser transmits it,
• For click identifiers from social networks or advertisements (for example fbclid, igshid, gclid), exclusively the derived channel name such as instagram, never the identifier itself,
• The first page of our website that you visited.

These details are kept only in your browser's session storage (sessionStorage) during your visit and are automatically deleted when the browser tab is closed, ensuring that neither recognition during subsequent visits nor tracking across other websites occurs. As soon as you create a user account, the origin determined in this way is assigned to your account once and stored so that we can evaluate the success of our channels. When your account is deleted, these details are also deleted.

Legal basis: Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest is to measure the effectiveness of our own marketing channels without resorting to third-party services or cross-device tracking. You can object to this processing at any time in accordance with Art. 21 DSGVO; a brief message to the address provided in the imprint is sufficient.

10. Processors and Third-Country Transfers

Personal data is transmitted to the following processors:

SCC = EU Standard Contractual Clauses (Art. 46 Abs. 2 lit. c DSGVO); DPF = EU-US Data Privacy Framework

11. Rights of Data Subjects

You have the following rights at any time:

• Information (Art. 15 DSGVO), which data we process from you
• Correction (Art. 16 DSGVO), have incorrect data corrected
• Erasure (Art. 17 DSGVO), deletion at any time via the app or by email
• Restriction of processing (Art. 18 DSGVO)
• Data portability (Art. 20 DSGVO)
• Objection (Art. 21 DSGVO) to processing based on legitimate interests
• Revocation of consent (Art. 7 Abs. 3 DSGVO) at any time with effect for the future

Please direct inquiries to: info@profilfoto-ki.de

In addition, there is a right to lodge a complaint with the competent data protection supervisory authority. For NRW: Landesbeauftragte für Datenschutz und Informationsfreiheit NRW, Kavalleriestr. 2–4, 40213 Düsseldorf, www.ldi.nrw.de.

12. Updates

This Privacy Policy will be updated in the event of technical or legal changes. The current status is indicated at the top.