Privacy Policy

Effective date: October 27, 2026.

AURA Studio (奧拉映像) at auraphoto.ai is operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. We are the controller of the personal data described in this notice. Privacy contact: info@auraphoto.ai.

We collect:

• Account data: email address, name, and sign-in details if you use Google sign-in.
• Photos you upload, including face photos, and the style and shooting settings you choose.
• Images generated for you, your selections, crops, favourites and quality requests.
• Credit and order data: packs purchased, Credit balance and usage, order and refund status.
• Payment data: payments are processed by Paddle. We do not receive or store your full card or PayPal details; Paddle shares with us the information needed to confirm and manage your order.
• Technical data: device and browser information, log data, and data stored in cookies or local storage (see section 9).

We use your face photos only after you give explicit consent, and only to check selfie quality and to provide the AI photo service you request. We do not use your photos to train our own AI models and do not use them for marketing by third parties. You can withdraw consent by deleting your photos or projects; this does not affect processing already carried out.

Generation is not processed on your device. When you start a generation, the necessary reference photos and settings are sent to our AI image provider, fal.ai, and the model providers it uses. We are still reviewing these providers' retention, deletion and training policies, and we cannot yet guarantee zero retention or zero training by them.

We process your data:

• to provide the Service, run your account, generate and deliver images and manage Credit (performance of our contract with you);
• to process face photos (your explicit consent);
• to keep the Service secure, prevent fraud and misuse, moderate content and improve reliability (our legitimate interests);
• to keep records of transactions and meet tax, accounting and other legal obligations (legal obligation);
• to respond to your requests and support messages (contract and legitimate interests).

We do not sell your personal data. We share it only with:

• Paddle.com, our reseller and Merchant of Record, which processes payments, tax, invoices and refunds;
• Lovable Cloud, which provides hosting and analytics for the Service, our database, authentication and private photo storage;
• fal.ai and its model providers, which process reference photos and settings to generate images;
• Google, if you choose to sign in with Google;
• professional advisers, such as lawyers and accountants, where needed;
• authorities, courts or law enforcement where required by law or to protect rights and safety.

Our service providers may process data outside your country, including in the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses.

Photos are not stored permanently. The default retention periods are:

• Guest (not signed in) shoots: 24 hours.
• Members' unfinished projects: 30 days. Saving a project can extend this.
• Photos you have unlocked or purchased: 90 days.
• AURA ID photo orders: files for unpaid orders are deleted by our periodic cleanup after 24 hours; unlocked orders can be downloaded for 30 days.
• Expired projects are deleted automatically by an hourly cleanup. The expiry date shown on each project or photo applies.
• Account, Credit and order records: for as long as your account is active, and transaction records for as long as tax and accounting law requires.

Depending on where you live, you may have the right to access, correct, delete or restrict your personal data, to object to processing, to data portability, to withdraw consent at any time, and to complain to a data protection authority.

You can delete projects and photos yourself in the studio, your selfie manager or your portfolio. Self-service deletion of your whole account is not yet available; email info@auraphoto.ai to request it, and we will respond within one month. Deletion by us does not yet confirm deletion by third-party providers.

We use cookies and browser local storage that are needed to keep you signed in, remember your language and keep in-progress selections. We do not use advertising cookies. Paddle may set its own cookies during checkout.

Our hosting platform (Lovable) provides basic first-party traffic and usage analytics for this site, for example pages visited, referrer, and device and browser type. These are loaded through scripts served from our own domain (such as /~flock.js and /__l5e/events). We use this information only to operate and improve the Service. We do not use advertising trackers and we do not sell your personal data.

We may also display anonymized recent activity on the site — for example the type of photo service completed, the country or region when available, and how long ago it happened. This activity information contains no names, photos, account details or other personal identifiers.

Photos are stored in private storage that cannot be browsed publicly. Access is checked against your account and project, and downloads use short-lived authorised links. Staff accounts do not automatically gain access to customers' private photos. No system is completely secure, but we take reasonable technical and organisational measures to protect your data.

The Service is not intended for anyone under 18. Do not upload photos of a child unless you are their parent or legal guardian.

We may update this notice and will post changes on this page with a new effective date.

Contact: [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Privacy: info@auraphoto.ai.