← Back to home

Privacy Policy

privacy-v1 · 2026-07-16

Your privacy matters. This notice explains what we actually collect, why, where it is stored, who processes it, and your full rights — in line with Jordan's Personal Data Protection Law (No. 24 of 2023) and EU GDPR standards.

1. What we collect

We collect only what the service needs to work:

  • Account data: your phone number (for OTP sign-in), your name, store name, preferred language
  • Your images: product photos (front and back views), reference images, scene backgrounds, your brand logo
  • Generated images and their settings: prompt, marketing text, feature used, aspect ratio
  • Credit & payment data: your credit ledger, plan, CliQ payment records (amount, date, optional reference) — we never see or store card details
  • Community & referral data: your gallery shares, remixes, referral code and who invited you
  • Support and suggestion messages you send us
  • Operational data: standard server logs and usage counters (e.g. today's generation count) for abuse protection

2. What we do NOT collect

  • No biometric data and no face recognition — the models feature uses fully AI-generated characters
  • No ad tracking, no third-party analytics, no marketing cookies
  • No location, no contacts, no device file access beyond what you choose to upload

3. Why we process your data (legal bases)

  • Contract performance: running your account, generating your images, managing your credits and plan
  • Your consent: sharing your images to the community gallery (revocable), and accepting the terms and policies at signup
  • Legitimate interest: fraud and abuse prevention, usage limits, service quality
  • Legal obligation: keeping payment records for accounting and tax purposes

4. Where your data is stored

The database, storage and authentication run on Supabase in Frankfurt, Germany (EU). Application servers run on cloud infrastructure (Railway and Vercel).

5. Who processes your data (processors)

We use trusted providers to run the service:

  • Supabase (EU) — authentication, database and image storage
  • fal.ai (US) — AI processing: your product photo and prompt are sent to generate the result, via OpenAI's GPT Image model
  • Railway and Vercel — server and app hosting
  • CliQ via your bank — money transfers (entirely outside our systems)
  • WhatsApp — if you choose to message us for payment receipts or support

6. The community gallery (what becomes public)

Nothing of yours appears publicly except a share you agreed to (the option is on by default when generating and can be turned off), and only after our manual approval of each share.

A published share displays: the output image, your "before" photo if you allowed it, your store name (or "a Sawwir merchant" if unset), and the prompt. The newest approved shares may also appear on our public landing page (without prompts).

Unsharing from the app removes it from the gallery immediately.

7. Retention

  • Your account data and images: for the life of the account, fully erased when you delete it
  • Payment records: deleted from our systems with your account; the bank transfer record itself stays with your bank, outside our systems
  • Temporary protection counters (like the daily cap): expire automatically within hours
  • Unsaved assets may be cleaned up periodically per the policy shown in-app

8. Your rights (complete, and in-app)

Under Jordanian law and the GDPR you have the following rights — most are one button in Settings:

  • Access & portability: "Download my data" gives you a JSON file of everything we hold about you
  • Erasure: "Delete account" permanently wipes your account, images, records, and sign-in identity
  • Withdraw consent: unshare any image at any time, or turn off sharing before generating
  • Rectification: edit your name and store name directly in Settings
  • Objection & complaint: contact us via "Support & suggestions", and you may complain to the Personal Data Protection Unit at Jordan's Ministry of Digital Economy and Entrepreneurship

9. Security

Connections are encrypted (HTTPS), access to your data is governed by signed sessions and row-level permissions, image links are signed and short-lived, and sign-in code guesses are limited and auto-locked.

10. Children

The service is for people aged 16 and over. If we learn of an account below that age we will delete it.

11. Changes to this notice

For any material change we bump the notice's version number and ask for your agreement again in-app.

12. Contact

For any privacy question: the in-app "Support & suggestions" button, or the WhatsApp number on the subscription page.