Privacy Policy

The controller within the meaning of the GDPR is: Ferkelkram GmbH Ruffiniallee 30A 82166 Gräfelfing Germany E-mail: [email protected] Telephone: +49 89 2173212

If a data protection officer has been appointed, they can be contacted at: [Name oder Stelle des Datenschutzbeauftragten] [Anschrift] [E-Mail-Adresse]

As a rule, we obtain personal data directly from you, for example when you register, purchase credits, use the AI tools or contact us. Technical usage data is collected automatically by your device and our systems when you access and use the service.

If you use Google Sign-In, we receive the data required for sign-in from Google. We receive payment-related information from the payment service providers we use. Hosting, e-mail, infrastructure or AI service providers may also provide us with security, delivery and status information.

Uploads may contain personal data relating to other individuals. In that case, the data originates from content provided by a user. The uploading user must be authorised to transmit the data and have it processed, must inform the data subject of this Privacy Policy where necessary and, in particular, must have obtained the data subject's valid consent. Using depictions of real people without their consent, especially for intimate depictions, impersonation or deepfakes, is prohibited.

Where it is not possible to provide information directly to a person who is identifiable in an upload, or where doing so would involve disproportionate effort, we provide the information required under Article 14 GDPR by means of this publicly available Privacy Policy. This does not affect any statutory information obligations of the uploading user.

Data subjects may include, in particular, website visitors, registered users, purchasers of credits, persons who communicate with us, persons submitting reports, and individuals who are lawfully depicted or otherwise identifiable in an upload.

Depending on how you use the service, we process the following data in particular:

– Master data and contact details, especially your e-mail address, internal user ID and, where applicable, your name or other information included in an enquiry.

– Authentication data, especially your password or authentication data derived from it, e-mail confirmation status, session data and, when you use Google Sign-In, the identifier transmitted by Google and the profile data you have chosen to share.

– Contract, order and payment data, especially purchased credit packs, price, currency, date and time, transaction and payment status, invoice details and information concerning refunds. Complete payment instrument details are generally processed by the payment service provider and are transmitted to us only to the extent required for processing and evidentiary purposes.

– Studio and content data, especially text inputs, prompts, negative prompts, settings, uploaded images or other files, images and videos generated from them, preview data, file metadata and information concerning downloads and deletion.

– Usage and credit data, especially the features and models used, the date, time and status of a generation, credits used or automatically recredited because a generation failed, error messages and technical events.

– Device, connection and log data, especially your IP address, date and time, URL accessed, referrer URL, browser, operating system, language setting, device information, request and response status, and security and error logs.

– Communications data from support, privacy and legal enquiries, as well as reports of unlawful or prohibited content, including submitted evidence and our processing notes.

– Consent and preference data, especially your language setting, cookie choices, the date, time and version of consent, and evidence of its withdrawal.

Images and videos do not constitute biometric data within the meaning of Article 9 GDPR merely because they depict individuals. We do not use them to identify a person biometrically. However, content may reveal special categories of personal data, such as information concerning health, racial or ethnic origin, religion, sexual orientation or sex life. Such data may be uploaded only where there is a valid legal basis for doing so. Where the processing of special categories of personal data is deliberately contemplated, explicit consent under Article 9(2)(a) GDPR must, in particular, be obtained in advance unless another exception under Article 9(2) GDPR applies.

When you access ferkelkram.de, we process connection and log data to deliver the website, establish a secure connection, identify errors and prevent attacks or abusive access.

To the extent that processing is necessary to provide the website or studio requested by you, it is based on Article 6(1)(b) GDPR. Measures relating to security, stability and protection against misuse are based on Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and commercially efficient operation of our service and the protection of our systems and users.

Recipients include, in particular, our hosting provider [Hosting-Anbieter] and Cloudflare. As a content delivery, security, DNS and protection service, Cloudflare may process connection data to deliver content and block malicious traffic.

When you register using an e-mail address and password, we process your e-mail address, authentication data, confirmation status and technical registration data. Confirmation of your e-mail address is used to activate and secure your account. Once confirmation has been completed successfully, a small amount of starter credit may be added to the account.

Alternatively, you may use Google Sign-In. In that case, following your selection, Google transmits to us, in particular, a unique user identifier, your e-mail address and the profile data you have chosen to share. Google thereby learns that you are signing in to Ferkelkram. Google is responsible for any further processing it carries out in accordance with its own privacy information.

The legal basis is Article 6(1)(b) GDPR because the processing is necessary to create, authenticate and manage your user account and to perform the user agreement. Security logs and measures designed to prevent account takeovers or repeated misuse are additionally based on Article 6(1)(f) GDPR.

Recipients are our hosting provider [Hosting-Anbieter], where applicable our e-mail service provider [E-Mail-Dienstleister] for confirmation and transactional e-mails, and, if you voluntarily use Google Sign-In, Google Ireland Limited and, where applicable, affiliated companies within the Google group.

When you submit text inputs, images or other files to the tools, we process that content together with your selected settings to perform the requested image or video generation, image editing, photoshoot feature, outfit change, or duo or kiss scene. Inputs and results are associated with your account and stored in your private library so that you can view, download and delete them.

The legal basis for generation, storage and provision is Article 6(1)(b) GDPR. We also process technical logs for error analysis, the recrediting of failed generations and ensuring operational availability under Article 6(1)(b) GDPR and, to the extent that such processing additionally serves security or improved reliability, under Article 6(1)(f) GDPR.

To perform a generation, prompts, uploads, settings and, where applicable, technical identifiers are transmitted to selected AI model and inference providers. These may include, in particular, providers of models such as ByteDance Seedream and Alibaba Wan or Qwen, as well as the inference platforms used in each case. Before the service goes live, the specific list of providers used, subprocessors, processing locations and retention periods must be added at [Liste der KI- und Inference-Anbieter].

Content is not published or shared with other users. Your prompts, uploads or results will be used to train our own or third-party AI models only if there is a separate legal basis for doing so and you have been informed of this transparently in advance. Contracts with the AI providers used must prohibit them from using the data for their own training purposes unless separate, valid consent has been obtained.

Prompts and uploads are screened automatically to determine whether they concern, in particular, minors or persons who appear to be minors, non-consensual intimate depictions, identity misuse, deepfakes of real people, violence, hatred or other unlawful or prohibited content. A flagged request may be refused, content may be removed, or the request or content may be marked for further review.

The processing serves to perform the contract and enforce the agreed rules of use in accordance with Article 6(1)(b) GDPR. To the extent that it serves to protect affected persons, prevent misuse, ensure platform and legal security, or establish, exercise or defend legal claims, it is based on Article 6(1)(f) GDPR. Where we are legally required to review, block, retain or report content, the legal basis is Article 6(1)(c) GDPR.

In the event of serious or repeated violations, content may be removed and accounts may be restricted or suspended. Unlawful content may be disclosed to competent authorities or reporting bodies to the extent provided for by law. Measures that have a significant effect on an account should not be taken solely on the basis of an automated screening result and should be subject to human review.

We do not engage in decision-making based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. Automated moderation checks are used to identify and refuse individual requests and to prepare for possible manual action.

When you purchase a one-time credit pack, we process order, price, currency, transaction, invoice and payment status data. Payment is processed through [Zahlungsdienstleister]. The payment service provider processes the payment details you enter in accordance with its own privacy information and transmits to us the information required to confirm and record the payment.

The legal basis for performing the purchase contract is Article 6(1)(b) GDPR. Compliance with retention obligations under tax and commercial law is based on Article 6(1)(c) GDPR. Fraud prevention, payment security and the establishment, exercise or defence of legal claims are based on Article 6(1)(f) GDPR.

We maintain a credit account recording purchases, usage and automatic recredits for failed generations. This processing is carried out to perform the contract pursuant to Article 6(1)(b) GDPR.

Recipients are [Zahlungsdienstleister], participating banks and payment networks and, where necessary, tax advisers, auditors, legal advisers and tax authorities. Whether the parties involved in payment processing act as processors or independent controllers depends on the respective service and must be disclosed at [Datenschutzhinweise des Zahlungsdienstleisters].

We use [E-Mail-Dienstleister] for e-mail confirmations, transactional messages and other communications necessary to perform the contract. The data processed includes, in particular, your e-mail address, the content and type of message, the time it was sent, and delivery and error status information. The legal basis is Article 6(1)(b) GDPR; security and delivery logs are additionally based on Article 6(1)(f) GDPR.

If you contact us at [email protected] or by other means, we process your contact details, the content of your enquiry, associated account and case data, and our correspondence. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries and Article 6(1)(f) GDPR for other matters. Our legitimate interest is the proper handling and documentation of enquiries.

Reports concerning unlawful or prohibited content may be sent to [email protected]. In this context, we process information concerning the reporting person, the reported content, reasons, evidence and processing notes. The legal bases are Article 6(1)(c) GDPR where statutory review or action obligations apply and, in all other cases, Article 6(1)(f) GDPR. Our legitimate interests are enforcing our rules, protecting affected persons and preventing unlawful use.

Recipients may include our e-mail service provider [E-Mail-Dienstleister], hosting and support providers, legal advisers, courts, supervisory and law enforcement authorities, and other legally competent bodies. Data is disclosed to public authorities only where we are legally required to do so, in response to a lawful request, or where disclosure is permitted for reporting or preventing serious infringements of the law.

We use cookies and similar technologies, especially browser local storage. Access to information on your terminal device and the storage of information on it are governed by section 25 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG). Any subsequent processing of personal data is governed by the GDPR.

We use strictly necessary technologies to the extent required for the service expressly requested by you. These include, in particular, session and security data, language settings and storage of your cookie choices. Storage or access is based on section 25(2), no. 2 TDDDG. Depending on its purpose, subsequent data processing is based on Article 6(1)(b) or Article 6(1)(f) GDPR.

Optional analytics and marketing technologies are activated only if you have given prior consent through the cookie banner. The legal bases are section 25(1) TDDDG for access to your terminal device and Article 6(1)(a) GDPR for further processing. Without your consent, these services will not be loaded unless, exceptionally, they are used for a separately identified, technically necessary function.

Depending on your consent, the following services may be used:

– Google Tag Manager: Management and activation of approved measurement and marketing tags. The provider is Google Ireland Limited; data may be transferred to Google LLC and other companies within the Google group. Tag Manager may activate optional tags only after you have given consent.

– Microsoft Clarity: Analysis of website use, aggregated usage statistics, session diagnostics and identification of technical or design problems. The provider is Microsoft Ireland Operations Limited; data may be transferred to Microsoft Corporation and affiliated companies.

– Meta Pixel: Measurement of reach, registrations or purchases, attribution of actions to advertisements and creation of advertising audiences. The provider is Meta Platforms Ireland Limited; data may be transferred to Meta Platforms, Inc. and affiliated companies. For certain processing activities, Meta may act as an independent controller or as a joint controller with us.

Optional analytics and marketing services do not receive prompts, uploads or generated content. However, potential data may include your IP address, cookie or device identifiers, browser and device information, pages accessed, referrer, dates and times, interactions, and approved events such as registration or purchase. The final list of events and parameters must be reviewed at [Tracking-Konfiguration] before the service goes live.

You may change your selection at any time through “Cookie Settings” in the footer or withdraw your consent with effect for the future. Withdrawing consent is as easy as giving it. The lawfulness of processing carried out before withdrawal is not affected. You may also delete cookies already stored through your browser.

The cookies used, providers, purposes, durations and recipients must be listed fully and kept up to date in the cookie banner or at [Cookie-Liste/Cookie-Einstellungen]. The retention periods include, in particular: session cookies [Laufzeit], language setting [Laufzeit], consent record [Laufzeit], Google services [Laufzeiten], Microsoft Clarity [Laufzeiten] and Meta Pixel [Laufzeiten].

We disclose personal data only to the extent necessary to provide the service, where you have consented, where there is a legitimate interest, or where we are legally required to do so. Where service providers process data on our behalf, we enter into agreements pursuant to Article 28 GDPR. As a rule, service providers may process the data only on our instructions and for the agreed purposes.

Categories of recipients include, in particular:

– Hosting and technical infrastructure: [Hosting-Anbieter] for servers, databases, file storage, backups and application operations.

– Content delivery, network and security services: Cloudflare, especially for content delivery, DNS resolution, encryption, attack detection and blocking malicious traffic.

– AI model and inference providers: especially providers or operators of ByteDance Seedream, Alibaba Wan or Qwen, and [weitere Anbieter], to the extent necessary for the requested generation.

– Authentication providers: Google when you use Google Sign-In.

– Payment service providers: [Zahlungsdienstleister] and participating banks and payment networks.

– E-mail service providers: [E-Mail-Dienstleister] for confirmation, transactional and other operational e-mails.

– Analytics and marketing providers: Google, Microsoft and Meta, solely with your consent and to the extent described above.

– Professional advisers and public authorities: tax advisers, auditors, lawyers, courts, supervisory, tax and law enforcement authorities, to the extent that disclosure is necessary or legally required.

– Corporate transactions: potential acquirers, investors or advisers in connection with restructuring, financing or a transfer of the business, to the extent legally permissible and subject to appropriate confidentiality measures.

The complete list of processors and subprocessors must be added at [Liste der Dienstleister und Unterauftragsverarbeiter] before publication.

Some service providers or their subprocessors may process personal data outside the European Union and the European Economic Area, especially in the United States, China or other countries for which there may be no adequacy decision by the European Commission. This may particularly concern Cloudflare, Google, Microsoft, Meta, AI model and inference providers, the e-mail service provider, the hosting provider or payment service providers.

Personal data is transferred to a third country only if the requirements of Articles 44 to 49 GDPR are met. Depending on the provider, we base a transfer on:

– an adequacy decision by the European Commission under Article 45 GDPR, especially the EU-US Data Privacy Framework in the case of validly certified US companies;

– the European Commission's Standard Contractual Clauses under Article 46(2)(c) GDPR, where applicable together with a transfer impact assessment and supplementary technical or organisational safeguards;

– binding corporate rules or other approved safeguards under Article 46 GDPR, where available;

– in specific exceptional cases, a condition under Article 49 GDPR, such as a transfer expressly requested and necessary for the performance of the contract, or explicit consent given after you have been informed of the risks.

Supplementary measures may include encryption in transit and at rest, access restrictions, data minimisation, short retention periods, pseudonymisation and contractual prohibitions on using the data for the provider's own purposes or for model training.

Before the service goes live, the legal entity, country of processing, any certification under the EU-US Data Privacy Framework, Standard Contractual Clauses used, supplementary measures and subprocessors must be conclusively documented for each provider at [Drittland- und Transferübersicht]. You may request copies of the relevant safeguards or information on where they can be obtained by contacting [email protected].

We retain personal data only for as long as necessary for the relevant purposes or for as long as statutory retention requirements, the need to preserve legal claims or compelling security grounds require continued storage. The data is subsequently deleted or anonymised.

– Account data is generally retained for the duration of the user account. If you delete your account, the account data will be removed after the expiry of technically necessary deletion periods unless statutory retention requirements or pending legal matters prevent deletion.

– Prompts, uploads and generated content are stored in your private library until you delete them individually or your account is deleted. Deleted content may remain in backups for [Backup-Frist] and will not be restored to or used again in the live production system.

– Data transmitted to AI and inference providers is stored by them for [Speicherfrist je Anbieter, möglichst keine Speicherung/Zero-Retention]. The retention periods and any log data for each provider must be stated at [KI-Anbieterliste].

– Credit, order, invoice and payment evidence data is generally retained for up to eight years in accordance with retention periods under tax and commercial law and may be retained for longer in individual cases. Different statutory periods may apply to other commercial and business correspondence.

– Server, security and error logs are stored for [Speicherfrist]. If a security incident is identified, relevant logs may be retained for longer until the incident has been investigated and addressed and for the establishment, exercise or defence of legal claims.

– Support and other communications are retained for the duration of their handling and then for [Speicherfrist]. Where they are relevant to a contract, taxation or legal dispute, the applicable longer statutory or limitation periods apply.

– Reports of prohibited or unlawful content and related review notes are retained for [Speicherfrist] or for as long as necessary to comply with statutory obligations, protect affected persons or defend legal rights.

– Records of consent are retained for the duration of the consent and subsequently, as a rule, until the relevant limitation and evidentiary periods have expired. The withdrawal itself may remain documented to ensure that the consent is not treated as active again.

– Cookie and tracking data is retained for the periods stated in the cookie banner. You may delete it earlier through your browser.

Statutory retention obligations and the standard limitation period under civil law may require continued storage. During such retention, the data will be restricted to the necessary purposes.

We implement appropriate technical and organisational measures pursuant to Article 32 GDPR to protect personal data against loss, alteration, unauthorised disclosure or unauthorised access. Depending on the required level of protection, these measures include, in particular, encryption in transit, access restrictions, authorisation policies, logging, backups, security updates and procedures for handling security incidents.

No data transmission or storage can be guaranteed to be completely free from risk. You should choose a strong password used only for this service and keep your login details confidential.

Where the statutory requirements are met, you have the following rights in particular:

– access under Article 15 GDPR to the personal data we process and further information about the processing;

– rectification of inaccurate data and completion of incomplete data under Article 16 GDPR;

– erasure of your data under Article 17 GDPR, provided there are no legal grounds for continued processing;

– restriction of processing under Article 18 GDPR;

– notification of recipients regarding rectification, erasure or restriction under Article 19 GDPR;

– data portability under Article 20 GDPR for data you have provided to us that is processed by automated means on the basis of consent or a contract;

– objection under Article 21 GDPR to processing based on Article 6(1)(e) or (f) GDPR. In that case, we will no longer process the relevant data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims;

– objection at any time to processing for direct marketing purposes; in that case, the data will no longer be processed for direct marketing;

– withdrawal of consent under Article 7(3) GDPR at any time with effect for the future. The lawfulness of processing carried out before withdrawal is not affected;

– the right to lodge a complaint with a data protection supervisory authority under Article 77 GDPR.

To exercise your rights, you may contact [email protected]. We may request additional information where necessary to verify your identity and protect other individuals' data. Statutory restrictions on data subject rights remain unaffected.

You have the right to lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

The supervisory authority competent for Ferkelkram GmbH is: Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA) Promenade 18 91522 Ansbach, Germany www.lda.bayern.de [email protected]

The competent authority must be verified once the company's registered office has been entered in the commercial register and added before publication.

Certain account, authentication, content, contract and payment data must be provided in order to register, use the AI tools or purchase credits. Without this data, we cannot provide the account, the requested generation or the purchase.

Optional information and consent to analytics or marketing technologies are voluntary. Refusing or withdrawing such consent does not affect the service's basic functionality.

The service is intended exclusively for adults. We do not intend to process account data relating to persons under the age of 18. If we become specifically aware that a minor is using the service or that data concerning a minor has been processed in a prohibited manner, we may suspend the account and delete the data unless a statutory obligation to preserve evidence or submit a report prevents us from doing so. Information may be sent to [email protected].

We may amend this Privacy Policy if the service, the providers used, the purposes of processing or the legal position changes. The current version will be published on this page and will show a new revision date.

If a change requires new consent, we will obtain it before the relevant processing begins. We will provide appropriate notice of material changes, for example through the website, within the user account or by e-mail.