Privacy policy
Last updated October 11, 2026
This policy explains what personal data the Barmaris Studio apps for iPhone and Android and the barmaris.com web site process, why, for how long, who helps us process it, and how you can use your rights. It is written for people in the European Union and everywhere else the apps are offered.
1. Who we are
The controller of your personal data is [company name — pending, Q-33], a company registered in Poland at [registered address — pending, Q-33] (“Barmaris”, “we”). Our supervisory authority is the President of the Personal Data Protection Office (UODO), Poland.
- Privacy questions and requests: privacy@barmaris.com
- Security reports: security@barmaris.com
- Data protection officer: [to be appointed — pending the data protection impact assessment]
2. What Barmaris Studio does
You upload three photos of your own face (“reference photos”). Our AI models use them to generate photo shoots and short videos of you in the looks you choose. You can keep the frames you like, edit them, make videos, post them to your own social network accounts and publish them in the in-app community. Every generated photo and video is labelled as AI-generated.
3. The data we process, why, and on what legal basis
| Data | Examples | Why | Legal basis (GDPR) |
|---|---|---|---|
| Account | e-mail address, sign-in method (Apple, Google, e-mail code), language, country, consents with their versions | to create and secure your account | contract (Art. 6(1)(b)) |
| Sessions and devices | sign-in sessions, IP address of a session, device and app version, push token | to keep you signed in, protect your account and send notifications | contract; legitimate interest in security (Art. 6(1)(f)) |
| Reference photos | your three face photos and the checks we run on them (one face, same person, estimated age range, public-figure check, image quality) | to make sure the photos show you, an adult, and to generate photos and videos of you | your explicit consent (Art. 9(2)(a) and Art. 6(1)(a)) |
| Your creations | shoots, frames, edits, videos, captions, prompts and looks | to provide the service you asked for | contract |
| Community | profile, publications, likes, saves, follows, comments, reports | to run the community features you use | contract |
| Plans and purchases | plan, monthly limit, usage, store transaction identifiers (no card data) | to provide your plan and keep accounting records | contract; legal obligation (Art. 6(1)(c)) |
| Social network connections | account identifiers, display name, encrypted access tokens | to post on your behalf when you ask us to | contract |
| Support requests | your messages to us, screenshots you attach, the category, and diagnostics sent with a request (app version, platform and system version, phone model, language, time-zone offset, account ID, plan and recent failed tasks); our replies and internal notes | to answer your request and fix what went wrong | contract; legitimate interest in improving the service |
| Moderation | results of automated checks, reports, warnings, strikes, bans and appeals | to keep the service safe and comply with the law | legal obligation; legitimate interest in platform safety |
| Fraud prevention | rate limits, hashed identifiers that prevent repeated free trials, device signals | to prevent abuse | legitimate interest |
| Product analytics | pseudonymous usage events, aggregated statistics | to understand and improve the app (opt-out in the app’s settings) | legitimate interest, with opt-out |
| Marketing e-mail | your e-mail address, only if you opt in | to send news and offers | consent (Art. 6(1)(a)) |
We do not sell personal data and we do not use your photos, frames or videos to train AI models.
4. Your reference photos and your face
Because we analyse facial features to check that the three photos show the same person and to generate images of you, we treat reference photos as special-category (biometric) data and process them only with your explicit consent, which you give on a separate screen before your first shoot. You can withdraw it at any time.
- What happens to them: an automated check that each photo shows exactly one adult face, that the three photos show the same person and that they do not show a public figure; then generation of the photos and videos you request.
- Who processes them for us: Amazon Web Services (face and safety checks) and Google (the image and video models), as listed in section 7.
- How long we keep them: until you delete them, and automatically 90 days after your last shoot. Deleting your account deletes them immediately.
- What we do not do: we do not store face templates or vectors, we do not build face collections, and we do not use your photos for any other purpose or for training models.
- Photos and videos already generated stay in your account; they are your content, not biometric templates.
5. AI-generated content and labels
Every photo and video made with Barmaris Studio carries an AI-generated label in its file metadata, which cannot be turned off. On the Trial plan a visible watermark is added as well. Our share pages show an “AI-generated” badge.
6. Content moderation
Every uploaded photo, every generated frame and video and every text you write is checked automatically before it is used, shown or published, and some cases go to a person on our safety team. Decisions that restrict your content or account come with the reason and a way to appeal; see the Content rules.
7. Who we share data with
We use processors bound by data processing agreements. Some of them process data outside the European Economic Area; transfers rely on the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework.
| Processor | What for | Data |
|---|---|---|
| Amazon Web Services EMEA SARL | hosting, storage, e-mail, face and safety checks (Frankfurt region) | all data above |
| Google (Gemini API, Firebase Cloud Messaging, Google Play, Sign in with Google) | image and video generation, text and image moderation (including support messages and screenshots), translating support messages for our team, push notifications on Android, purchases, sign-in | reference photo derivatives, prompts, generated media, support messages and screenshots in transit; push tokens; purchase tokens |
| Apple (Sign in with Apple, push notifications, App Store) | sign-in, push notifications on iPhone, purchases | identity tokens, device tokens, transaction identifiers |
| Meta, TikTok, X | publishing the posts you ask us to publish | the media and captions of those posts, account identifiers |
Google may keep prompts and generated outputs for a limited time to detect abuse of its models, as its API terms describe; it does not use them to improve its products. Once you post to a social network, that network is an independent controller of the post. We may also disclose data when the law requires it, for example to report child sexual abuse material to the competent authorities.
8. How long we keep data
| Data | Retention |
|---|---|
| Account | until you delete it, plus a 7-day grace period in which you can cancel the deletion |
| Reference photos | until you delete them; automatically 90 days after your last shoot |
| Shoots, frames and videos | until you delete them (deleted items are kept 30 days so they can be restored) |
| Sessions | 90 days after they end |
| Support requests | 24 months after the last message; screenshots 90 days after the request is solved; deleted with your account and included in “Download my data” |
| Moderation records | as long as the content they concern, longer where the law requires it |
| Purchases and limit records | anonymised after account deletion and kept as accounting law requires |
| Server logs | 30 days (security logs 90 days) |
| Backups | deletions reach backups within 35 days |
9. Your rights
You can access and export your data (a data export from the app’s settings), correct it, delete your reference photos at any time and delete your account (Settings → Delete account). You can object to processing based on legitimate interest, restrict processing, withdraw consent at any time without affecting earlier processing, and ask for a human review of automated moderation decisions. Write to privacy@barmaris.com for anything you cannot do in the app; we answer within 30 days and verify requests with a code sent to your account’s e-mail address. You may also complain to the UODO or to the supervisory authority where you live.
10. Children
Barmaris Studio is for adults aged 18 and over. We reject reference photos of anyone who may be younger than 18. If we learn that an account belongs to a minor, we delete it and its data.
11. The web site
barmaris.com loads no third-party scripts and no trackers. It sets one functional cookie, locale, only when you choose a language in the language menu, to remember that choice for a year. Fonts and images are served from our own servers. Opening a share link counts a view of that link without identifying you.
12. Security
Data is encrypted in transit and at rest, access is limited to the people who need it, social network tokens are encrypted with separate keys, and we follow an incident response procedure that includes notifying the authority and affected users when the law requires it.
13. Changes to this policy
We will tell you about material changes in the app or by e-mail before they apply. When the consent text for reference photos changes, we ask for your consent again before your next shoot.