Privacy Policy

• Account — email address, password (we store only its cryptographic hash), registration date, settings (e.g. language), whether two-factor authentication is enabled. When you sign in with Google — the email address and basic profile data provided by Google.
• Purchases and payments — purchase and Subscription history, amounts, currency, Stripe payment identifiers, the date and time of consent to the immediate start of the service. We do not receive payment card data.
• Content — prompts, uploaded files (photos, recordings, voice samples), Generation results and their parameters, publications in the Gallery, saved voice clones.
• Consents and declarations — consent to marketing messages (date and manner of giving or withdrawing it), declarations of the right to the likeness or voice used.
• Communication — help chat messages, emails to us, content reports, appeals, withdrawal statements.
• Security and abuse prevention — IP address and browser information for Generations and reports, IP address at registration, a hash of the normalised email address, security logs, information about blocked attempts to break the rules.
• Integrations — your Discord account ID, if you connect your account to the Discord bot; API keys (we store only their hashes).
• Technical data — aggregate visit statistics (without cookies) and application error reports.

We do not save conversations with the AI assistant — we only store the number of queries and their cost in Credits.

• Providing the services — account, Generations, Gallery, payments, help chat, API and integrations (Art. 6(1)(b) GDPR — performance of a contract).
• Legal obligations — tax and accounting, complaints and withdrawals from contracts, obligations under the Digital Services Act (DSA), e.g. handling reports and giving reasons for decisions, and responding to requests from authorities (Art. 6(1)(c) GDPR).
• Our legitimate interest (Art. 6(1)(f) GDPR) — security of the Service, abuse prevention (including preventing multiple accounts being created to obtain free Credits), content moderation and securing evidence of violations, pursuing claims and defending against them, visit statistics and error monitoring, service messages (e.g. confirmations, Subscription renewal reminders, information about changes to the Terms).
• Email marketing — only with your consent (Art. 6(1)(a) GDPR in conjunction with Article 398 of the Polish Electronic Communications Law — Prawo komunikacji elektronicznej). You can withdraw your consent at any time in your account settings or via the link in the message; this does not affect the lawfulness of messages sent before.

Providing data is voluntary, but without an email address you cannot create an account, and without payment details you cannot buy Credits.

You provide most of the data yourself. We receive some of it from: Google (when you sign in with Google), Stripe (payment information), Discord (account ID, if you connect your account) and from people who report content.

We entrust data to providers who process it on our behalf and in accordance with our instructions:

• Supabase — database and sign-in (servers in the EU),
• Vercel — application hosting and visit statistics,
• Stripe — payment processing,
• fal.ai — performing Generations; fal passes the input to the provider of the selected model (e.g. Google, Kuaishou — Kling, ByteDance, MiniMax, Recraft), which may process it outside the EEA, including in the USA and in Asia,
• Cloudflare — file storage (R2) and bot protection (Turnstile),
• Upstash — limiting the number of requests (security),
• Sentry — application error reports,
• Resend — sending emails,
• Telegram — notifications to our team about new help chat messages (message content and account email), reports and purchases,
• Discord — only if you connect your account to the Discord bot.

Google (sign-in) and Stripe (with regard to its own obligations, e.g. fraud prevention) also act as separate controllers. We may also disclose data to public authorities where required by law, and to our legal and accounting advisers.

Some recipients process data outside the European Economic Area, in particular in the USA. Transfers take place on the basis of a European Commission decision establishing an adequate level of protection (including the EU-US Data Privacy Framework — for certified entities) or standard contractual clauses approved by the Commission. You can obtain information about the safeguards applied and a copy of them by writing to contact@fattly.app.

• Account data — until the account is deleted.
• Generations, uploaded files and related technical data (IP address, browser) — 30 days from the creation of the Generation. Generations published in the Gallery — until they are unpublished or the account is deleted; we remove the technical data from them after 30 days.
• Saved voice clones — until the voice or the account is deleted. The voice model itself is stored by the provider (MiniMax) in accordance with its own rules.
• Blocked attempts to break the rules — we keep a record of the attempt (prompt, date, account) as evidence until the account is deleted; we delete the technical data (IP address, browser) after 12 months, and files earlier.
• Registration data used to prevent abuse (IP address, hash of the email address) — 13 months.
• Content reports — the reporting person’s data (email, name, IP address) for 12 months; the content of the report and the decision — until claims become time-barred.
• Help chat — until the account is deleted.
• Marketing consent — until it is withdrawn; we keep the record of it being given and withdrawn for as long as it is needed to demonstrate compliance with the law.
• Purchase records — 5 years from the end of the year in which the tax obligation arose; withdrawal statements, complaints and data needed to defend against claims — until claims become time-barred.
• Database backups — up to 30 days. Logs and error reports held by providers — according to their settings, usually up to 30–90 days.

After an account is deleted, we delete the account data and Content (including files), except for data we must retain under the law or to defend against claims.

You have the right to:

• access your data and obtain a copy of it — a data export is available in your account settings,
• rectification of your data,
• erasure of your data — you can delete your account yourself in the settings,
• restriction of processing,
• data portability,
• object to processing based on our legitimate interest, and to object to direct marketing at any time and without giving reasons,
• withdraw consent at any time (without affecting the lawfulness of processing carried out before the withdrawal).

To exercise your rights, write to contact@fattly.app. You can also lodge a complaint with the President of the Personal Data Protection Office (PUODO), Poland, or with the supervisory authority in the country where you live or work; in the United Kingdom — with the Information Commissioner’s Office (ICO).

Safety filters automatically block prompts and files that may violate the Service’s rules, and abuse-prevention mechanisms may automatically withhold free Credits when someone registers again. We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. You can ask for a human to review the matter by writing to contact@fattly.app.

We process face photos and voice recordings solely to perform the Generation you request (e.g. face swap, animation, dubbing, voice clone). We do not use them to identify people or verify their identity, we do not train models on them and we do not sell them. We pass them to the model provider only to perform the Generation. We delete the files together with the Generation (after 30 days) or earlier if you delete the Generation or your account. If you save a voice clone, we keep it until you delete the voice or your account. If the material shows another person, you must have their consent (§10 of the Terms).

We use only cookies and browser storage that are necessary for the Service to work: keeping you signed in, security (including bot protection — Cloudflare Turnstile), remembering your language and settings, and saving drafts in the tools. We collect visit statistics without cookies (Vercel Web Analytics). We do not use advertising cookies or tracking pixels. If we ever start using them, we will ask for your consent first.

The Service is intended only for adults (18+). We do not knowingly collect children’s data; if we learn of such an account, we will delete it.

We apply technical and organisational measures to protect data, including encrypted transmission, two-factor authentication, access restrictions, storing files in private storage accessed via temporary signed links, and abuse-prevention mechanisms.

We apply the same standard of protection (GDPR) to all users, regardless of their country. We do not sell personal data or share it for behavioural advertising. Users in the United Kingdom have the rights provided by the UK GDPR.

This Policy may be updated. We will inform you of significant changes in the Service or by email. The other rules for using the Service are described in the Terms.