Privacy Policy
Effective date: 30 June 2026 · AIFolio Ltd
1. Who Is the Data Controller?
AIFolio Ltd (“we”, “us”) is the data controller for personal data processed through AIFolio. ICO registration number: .
2. What Data We Collect
- Account data: email address, password (hashed), account creation date.
- Source Images: photographs you upload for AI training and generation.
- Generated Portraits: AI-produced images created from your Source Images.
- Payment data: billing records and transaction references (card data is held by our payment processor, not by us).
- Usage data: job logs, photo balance, generation history, browser/device type, IP address.
- Communications: support emails and any correspondence with us.
3. How We Use Your Data
- Contract performance: to train your AI model, generate Portraits, and manage your photos.
- Legal obligation: VAT records, fraud prevention, and compliance with court orders.
- Legitimate interest: service security, abuse detection, and product improvement (aggregated, never individual profiling for marketing).
- Consent: if you opt in to marketing emails (you may withdraw at any time).
4. Source Images and AI Training
Your Source Images are used exclusively to train a personal AI model for your account. They are stored securely and automatically deleted 90 days after your last session or on account deletion — whichever comes first. We do not use your images to train shared or public models.
Building your personal AI model involves analysing the facial features in your Source Images, which is biometric data — a special category of personal data under UK GDPR. We only carry out this processing with your explicit consent (Article 9(2)(a) UK GDPR), given separately at upload. You do not have to give this consent, but we cannot provide the service without it, and you may withdraw it at any time as described in our Terms.
5. Sharing Your Data
We do not sell your data and we do not share it for third-party advertising. We share personal data only with service providers who process it on our behalf (our "processors"), each bound by a written data processing agreement. We describe them below by category and purpose, rather than by name, because which specific company handles each category can change as we switch suppliers; this section is updated whenever it does. Where a category's provider is based outside the UK, we say so and name the transfer safeguard that applies.
- GPU compute and model hosting — runs the computing jobs that train your personal AI model and generate your Portraits. Provider based outside the UK: transferred under a UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
- AI image generation service — used for certain image generation requests as part of producing your Portraits. Provider based outside the UK: transferred under a UK IDTA or the UK Addendum.
- Cloud object storage — stores your Source Images, your personal AI model, and your Portraits securely.
- Email delivery — sends account, order and support emails on our behalf.
- Payment processing — handles card payments and billing; we do not hold your card details ourselves.
- Print fulfilment — prints and posts physical copies of Portraits you order as prints.
If you would like the names of the specific organisations we share your data with, email us and we will send you the current list.
We also use hosting and IT infrastructure providers to run the website itself, and may disclose data where required by law, to enforce our terms, or to protect the rights, property or safety of us or others.
6. International Transfers
Where a category of processor above is based outside the UK, we protect your data using a UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or we rely on a UK adequacy regulation where one applies. These safeguards require the receiving organisation to protect your data to a standard equivalent to UK GDPR.
7. Retention
- Source Images and model weights: deleted 90 days after last session.
- Generated Portraits: retained while your account is active; deleted on account closure.
- Financial records: 7 years (UK HMRC requirement).
- Support correspondence: 3 years from last contact.
8. Your Rights
Under UK GDPR you have the right to:
- Access — request a copy of your personal data.
- Rectification — correct inaccurate data.
- Erasure — request deletion of your data (“right to be forgotten”).
- Restriction — ask us to pause processing.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — at any time, where processing is consent-based.
To exercise any right, email support@aifolio.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
9. Cookies
We use strictly necessary session cookies for authentication and CSRF protection. We do not use third-party tracking or advertising cookies. No cookie banner is shown because no consent-dependent cookies are set.
10. Security
All data is transmitted over HTTPS. Source Images and model weights are stored in private, access-controlled storage buckets. We apply role-based access controls and rate limiting. In the event of a data breach affecting your rights, we will notify you and the ICO as required by law.
11. Changes to This Policy
We will notify you by email at least 14 days before material changes take effect. The effective date at the top of this page will be updated.
12. Contact
Data protection queries: support@aifolio.co.uk
Westerham Road
Keston, Kent
BR2 6HQ
United Kingdom