Privacy Policy
Effective date: 30 June 2026 · AIFolio Ltd
1. Who Is the Data Controller?
AIFolio Ltd (“we”, “us”) is the data controller for personal
data processed through AIFolio. ICO registration number:
.
2. What Data We Collect
- Account data: email address, password (hashed), account creation date.
- Source Images: photographs you upload for AI training and generation.
- Generated Portraits: AI-produced images created from your Source Images.
- Payment data: billing records and transaction references (card data held by Stripe, not us).
- Usage data: job logs, photo balance, generation history, browser/device type, IP address.
- Communications: support emails and any correspondence with us.
3. How We Use Your Data
- Contract performance: to train your AI model, generate Portraits, and manage your photos.
- Legal obligation: VAT records, fraud prevention, and compliance with court orders.
- Legitimate interest: service security, abuse detection, and product improvement (aggregated, never individual profiling for marketing).
- Consent: if you opt in to marketing emails (you may withdraw at any time).
4. Source Images and AI Training
Your Source Images are used exclusively to train a personal AI model for your account.
They are stored securely and automatically deleted 90 days after your
last session or on account deletion — whichever comes first. We do not use your images
to train shared or public models.
5. Sharing Your Data
We share data with:
- Stripe — payment processing (their Privacy Policy).
- RunPod — GPU compute for AI training and generation (data processed in the EU/US).
- Cloudflare R2 — secure object storage for images and model weights.
- Brevo (Sendinblue) — transactional email delivery.
We do not sell your data. We do not share it for third-party advertising.
6. International Transfers
Some processors are based outside the UK/EEA. We rely on Standard Contractual Clauses (SCCs)
or adequacy decisions to protect your data in these transfers.
7. Retention
- Source Images and model weights: deleted 90 days after last session.
- Generated Portraits: retained while your account is active; deleted on account closure.
- Financial records: 7 years (UK HMRC requirement).
- Support correspondence: 3 years from last contact.
8. Your Rights
Under UK GDPR you have the right to:
- Access — request a copy of your personal data.
- Rectification — correct inaccurate data.
- Erasure — request deletion of your data (“right to be forgotten”).
- Restriction — ask us to pause processing.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — at any time, where processing is consent-based.
To exercise any right, email support@aifolio.co.uk.
We will respond within 30 days. You also have the right to lodge a complaint with the
Information Commissioner’s Office (ICO).
9. Cookies
We use strictly necessary session cookies for authentication and CSRF protection.
We do not use third-party tracking or advertising cookies. No cookie banner is shown
because no consent-dependent cookies are set.
10. Security
All data is transmitted over HTTPS. Source Images and model weights are stored in private,
access-controlled storage buckets. We apply role-based access controls and rate limiting.
In the event of a data breach affecting your rights, we will notify you and the ICO as
required by law.
11. Changes to This Policy
We will notify you by email at least 14 days before material changes take effect.
The effective date at the top of this page will be updated.
12. Contact
Data protection queries: support@aifolio.co.uk
Suite 5, 1-2 Leonard Place
Westerham Road
Keston, Kent
BR2 6HQ
United Kingdom