Privacy Policy

1. What we collect

• Account data: your name, email address and profile picture from Google sign-in, and your account settings.
• Your content: the photos you upload (including any people in them), the results we make, and what you type — instructions, briefs, brand details, captions and customer quotes.
• Credits and payments: your credit balance and history, plans, and payment records (amount, currency, method, date, status). Card numbers and e-wallet credentials are handled by our payment providers; we never see or store them.
• Usage and security data: which tools you use and when, results and failures, estimated processing costs, and — to stop free-trial abuse — a keyed hash of your browser's random ID and of your IP address (we never store the raw values).
• Support messages you send us, and messages you type into the site assistant (processed to answer you, not stored by us).

We do not knowingly collect special-category data (for example health or biometric data). Photos of people are used only to make the result you ask for — never to identify anyone or to build face templates.

2. Why we use it, and on what basis

• To provide the service you signed up for — sign-in, running the tools on your photos, credits, payments and support (performance of our agreement with you).
• To process your photos with AI providers to make your results, which you consent to when you accept these terms and upload them (consent; you can withdraw it at any time by deleting your content or account).
• To keep the service safe — preventing fraud, free-trial farming, abuse and prohibited content (legitimate interest and legal obligation).
• To keep records required by tax and accounting law (legal obligation).
• To send service emails such as credit-expiry reminders and receipts. We send marketing only if you opt in, and you can opt out at any time.

We do not sell your personal data, and we do not use your photos or results to train AI models.

3. Who processes your data for us

We use trusted providers (data processors) under contracts that limit them to processing your data on our instructions. AI providers are used through their paid business APIs, whose published terms do not allow your content to be used to train their models.

• Supabase — database, sign-in and private file storage.
• Hostinger — website hosting. Cloudflare — network protection (if enabled).
• Inngest — background job scheduling (job and item IDs only, no photos).
• Google (Gemini API, Google Sign-In), OpenAI, Anthropic, fal.ai (including models such as ByteDance Seedream and Qwen hosted there), Alibaba Cloud (site assistant) and, where configured, OpenRouter (routing AI requests) — AI processing of photos and text.
• Stripe (card payments in US dollars) and Xendit (rupiah payments: QRIS, e-wallets, bank transfer, cards).
• Resend — service emails.

Camera's instant effects and depth reading run on your own device: the depth model is downloaded from Hugging Face, but your photo is not uploaded for them.

4. International transfers

Some providers process data outside Indonesia (for example in Singapore, the United States or the European Union). Where data leaves Indonesia we make sure the receiving provider offers a level of protection equivalent to or higher than UU PDP, or appropriate safeguards are in place, as UU PDP Article 56 requires, and you consent to the transfer by using the service.

5. How long we keep it

• Uploaded photos and generated results: deleted automatically 30 days after upload. Scene templates you save stay until you delete them.
• Account data, credit history and job records (without the images): while your account exists.
• Payment records: 10 years, as Indonesian tax and company law requires — after account deletion they are kept without your name or email.
• Free-trial device and network hashes: kept after account deletion, so a deleted account can't be used to claim a new trial. They can't be turned back into your browser ID or IP address.
• Security and server logs: up to 90 days.

6. Your rights

Under UU PDP you can: get information about how we process your data; access and get a copy of it; correct it; delete it; withdraw consent; object to or restrict processing; and complain about a violation.

• Download a copy of your data at any time: Billing → Your data → Download.
• Delete your account and all your photos at any time: Billing → Your data → Delete account.
• For anything else, email hello@garnepic.studio. We reply within 3 × 24 hours where UU PDP requires it, and otherwise as soon as we can.

7. Security

Your photos are stored in private storage and shown only through short-lived signed links. Every request is checked against your account; credits and payments are changed only by the server. Uploads are checked and re-encoded to remove hidden metadata such as GPS location. Our prompts, keys and models stay on our servers. Admin access requires two-step verification and is logged.

No system is perfectly secure. If a personal-data breach happens, we will notify you and the authority in writing within 3 × 24 hours, as UU PDP Article 46 requires, with what happened, what data was involved and what we are doing about it.

8. Cookies

We use only essential cookies: to keep you signed in, remember your language, and a random browser ID used (as a keyed hash) to prevent free-trial abuse. We don't use advertising or third-party tracking cookies. Google's sign-in button may set Google's own cookies when you use it.

9. Children

The service is for businesses and adults aged 18 or over. Don't upload photos of children unless you are their parent or guardian or have that person's consent, and never in a sexual or harmful context.

10. Changes and contact

We will post any change here with a new date, and ask you to accept material changes in the studio. Questions or requests: hello@garnepic.studio — [Legal entity name — PT …] (NIB [NIB]), [Registered business address, Indonesia].