Privacy Policy

Last updated: September 28, 2026.

1. Information we process

Depending on how you use FRIMAJ, we may process account information such as email address and account role; uploaded images and generation instructions; generated outputs and job metadata; credit balances and ledger activity; technical information needed for security and service operation; and identifiers associated with payment transactions.

2. Payment information

When checkout is available, payments use Stripe Managed Payments, with Link acting as merchant of record. Stripe and Link process payment, billing, tax, fraud-prevention, and receipt information under their own privacy terms. FRIMAJ stores transaction identifiers, amounts, currencies, payment and refund status, and related credit records to maintain credit balances and reconcile payments, and does not receive or store your full payment-card number.

3. Why we process data

We process data to authenticate users, provide and recover generation jobs, deliver outputs, maintain credit balances, verify purchases and refunds, prevent abuse, troubleshoot failures, secure the service, and comply with applicable legal obligations.

Where the GDPR applies, we rely on performance of our contract with you for account, generation, and credit services; legal obligations for records we are required to keep; and legitimate interests in security, fraud prevention, troubleshooting, and establishing or defending legal claims, balanced against your rights. Account and generation information needed to fulfil a request must be provided for us to deliver that service.

4. Service providers

FRIMAJ uses providers for hosting, authentication, data storage, payments, and AI processing. These providers receive the data needed for their services, which can include uploaded images and instructions for AI processing. An earlier payment provider may retain transaction data if a payment was previously completed. Data is shared only as needed to provide or protect the service.

Providers may process data outside the European Economic Area. Transfers subject to the GDPR require an applicable legal transfer mechanism, such as a European Commission adequacy decision or Standard Contractual Clauses with any necessary supplementary safeguards. You can contact us through the Contact page for information about the recipients and safeguards applicable to your data, including how to obtain a copy of the relevant safeguards.

5. Retention

Private generation input images are temporary. They become eligible for automatic deletion 6 hours after upload and are normally removed by the next hourly cleanup; inputs used by queued or running jobs are protected until those jobs are no longer active. This describes FRIMAJ's input storage; external providers may have separate retention periods for processing and security under their applicable terms.

Account, generation, and generated-output records may be retained to provide your account and generation history until they are deleted or you request account closure. You can request account and data deletion through support. Some browser-local history may remain on your device until removed by you or by the application.

After account closure, limited payment and credit records, and information necessary for a specific legal claim, may be retained where there is a legal basis. Retention is limited to the applicable legal recordkeeping period or the time needed to establish, exercise, or defend that claim, including applicable limitation periods. This does not mean that all uploaded images or generated outputs are kept for financial recordkeeping. Stripe and Link may retain their own transaction records under their privacy terms and legal obligations.

6. Security

FRIMAJ uses access controls, private storage paths, signed delivery URLs, server-side billing verification, and other technical measures designed to reduce unauthorized access. No online service can guarantee absolute security.

7. Your choices and rights

Depending on your location, you may have rights to request access, correction, deletion, restriction, objection, or portability of personal data. We may need to verify your identity before acting on a request.

FRIMAJ is operated by an individual. For privacy questions or requests, contact us through the Contact page.

Account and data deletion requests are handled through support. For requests under the GDPR, we respond without undue delay and normally within one month; if a lawful extension is needed, we will explain it within that month. You may also lodge a complaint with a data protection authority, including the President of the Personal Data Protection Office (UODO) in Poland, or the competent authority where you live or work.

8. Changes

We may update this policy as FRIMAJ, its providers, or legal requirements change. The latest version will remain available at this URL.