Privacy Policy

This Privacy Policy explains how Loomy (“Loomy”, “we”, “us”) — the service at loomy.work — collects and processes personal data. Loomy is operated by an individual based in Poland (the “operator”), who is the data controller for the data described below.

1. Who we are

Loomy is run by a private individual based in Poland, currently as unregistered business activity (działalność nieewidencjonowana) — not a registered company, so there is no NIP, REGON, or KRS number. For any privacy matter, contact us at loomysupport@gmail.com and we will respond. If you need the operator’s full legal identity (e.g. for a formal data-protection request), email us and we will provide it to you directly.

2. What data we collect

• Account data: name (optional), email address, hashed password.
• Content you upload: product/jewelry photos and the AI-generated images produced from them.
• Billing data: subscription status and plan. Card details are handled by our payment processor (Polar) — we never store card numbers.
• Your AI provider key: if you supply your own Google Gemini API key, it is stored encrypted at rest (AES-256-GCM).
• Technical data: functional session cookies and server logs needed to run and secure the service.

3. Why we use it and our legal basis

• To provide the service (generate images, store your gallery, run your account) — performance of our contract with you (GDPR Art. 6(1)(b)).
• To process payments and prevent fraud — contract and legitimate interests (Art. 6(1)(b), (f)).
• To send essential account emails (password resets, billing, security, trial reminders) — contract.
• To send occasional product/marketing emails — our legitimate interest in informing existing users, which you can opt out of at any time via the unsubscribe link in every such email.
• To meet legal obligations (e.g. tax/accounting records) — legal obligation (Art. 6(1)(c)).

4. AI processing — important

When you generate an image, the photos you provide are sent to a third-party AI provider for processing — currently Google (Gemini). Do not upload photos containing personal data (e.g. identifiable faces) that you are not entitled to share. These providers process the images to return a result; we do not control their internal use of data beyond their terms.

5. Sub-processors

We rely on the following processors to run Loomy:

• Railway — application hosting.
• Supabase — database and file storage.
• Polar — subscription billing and payments.
• Resend — transactional and marketing email delivery.
• Inngest — background job processing.
• Google (Gemini) — AI image and text processing.

6. International transfers

Some of these providers process data outside the European Economic Area (e.g. in the United States). Where that happens, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses and/or an adequacy framework.

7. How long we keep it

We keep account data and your uploaded/generated images for as long as your account is active. If you delete your account, your data is erased. Bulk export ZIP archives are retained for 30 days. Billing records may be retained longer where required by tax law.

8. Your rights

Under the GDPR you can:

• Access and export your data — Settings → Account → “Download my data”.
• Erase your account and data — Settings → Account → “Delete account”.
• Rectify inaccurate data, restrict or object to processing, and opt out of marketing.
• Lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl) or your local authority.

9. Cookies

We use only strictly-necessary cookies — a session cookie to keep you logged in and a local preference for your theme. We do not use advertising or third-party analytics trackers, so no cookie-consent banner is required for non-essential tracking.

10. Changes

We may update this policy. Material changes will be communicated by email or in-app. The “last updated” date above always reflects the current version.