Privacy Policy
Effective date: August 26, 2026
This Privacy Policy explains what personal data 9frame ("we", "us", or "our") collects when you use the 9frame AI photo studio at 9frame.ai (the "Service"), how we use and protect it, who we share it with, and the rights you have. We are committed to handling your data honestly and carefully, especially your uploaded photos.
1. Who Is Responsible for Your Data
9frame is operated by an individual entrepreneur registered in Ukraine, who acts as the data controller for the personal data described here. The operator's full legal name and registered address are available on request at hello@9frame.ai. For any privacy question or request, contact hello@9frame.ai or Telegram t.me/nineframe_support_bot.
Please note that payment data is handled by our payment provider as an independent controller for that data (see Section 6).
2. Data We Collect
- Account data: your email address and basic account settings.
- Uploaded selfies: the photographs of your face that you upload so the Service can generate images of you. These are photographs of an identifiable individual and can reveal facial characteristics, so we treat them as sensitive, biometric-adjacent personal data and handle them with extra care.
- Generated images: the AI-generated photos created from your uploads.
- Usage analytics: basic, privacy-friendly usage statistics (such as pages visited and general activity) collected through our self-hosted Umami analytics. We do not use third-party advertising trackers or sell your behavior to advertisers.
- Support communications: messages you send us by email or Telegram.
- Payment data: handled by our payment provider, not by us. We receive only limited billing confirmation information (for example, that a subscription is active), never your full card details.
3. How and Why We Use Your Data (Legal Bases)
We use your data for the following purposes, relying on the legal bases indicated:
- To provide the Service, including processing your selfies to generate images and delivering your results (legal basis: performance of our contract with you).
- To manage your account, subscription, and access to features (contract).
- To process payments and prevent fraud, which is carried out by our payment provider (contract and legitimate interests).
- To send you essential transactional emails, such as account and billing notices, via our email provider (contract).
- To understand and improve how the Service is used, through privacy-friendly analytics (legitimate interests in operating and improving the Service).
- To keep the Service safe, enforce our Terms, and prevent abuse, including detecting prohibited content (legitimate interests and legal obligation).
- To comply with legal obligations that apply to us.
We use your selfies solely to generate images of you, deliver them to you, and support your account. We do not use your face data to identify or authenticate you, and we do not sell, rent, or otherwise profit from it. We do not use your uploaded selfies or generated images to train our own or any third party's generalized or foundation AI models, and we contractually require our AI model providers not to use your face data to train their generalized models.
4. Sharing With Service Providers (Sub-processors)
We use a small number of trusted third parties to run the Service. They process data on our behalf under appropriate agreements, and only as needed to perform their function:
- AI model providers (for example, fal.ai): your uploaded selfies are sent to these providers so they can generate your images. This is a core part of how the Service works.
- Cloudflare R2: cloud storage where your uploaded selfies and generated images are stored.
- Our payment provider (acting as our Merchant of Record): processes payments, billing, tax, and invoicing.
- Resend: our transactional email provider, used to deliver account and billing emails.
- Sentry: our error-monitoring provider. It receives technical error reports both from our servers and from your browser — the error message and stack trace, the request route and method, browser and device information, and connection metadata such as IP address — so that we can diagnose and fix failures.
- Self-hosted Umami: our own analytics, hosted by us rather than by a third-party ad network.
We do not sell your personal data, and we do not share it with advertisers.
5. International Data Transfers
We and some of our service providers operate outside Ukraine and the European Economic Area, including in the United States. This means your personal data, including your uploaded selfies, may be transferred to and processed in countries whose data protection laws differ from those of your own country. Where such transfers happen, we rely on appropriate safeguards (such as standard contractual clauses or equivalent mechanisms offered by our providers) to protect your data.
6. Payments
Payments are handled by our authorized payment provider (acting as our Merchant of Record and reseller). When you make a purchase, you provide your payment details directly to our payment provider, and the payment provider processes that data under its own privacy policy and as an independent data controller. 9frame does not receive or store your full payment card information.
7. Data Retention
- Uploaded selfies: we keep your uploaded selfies only as long as needed to provide the Service to you — primarily so you can keep generating new images while your account is active. You can delete your uploaded selfies at any time from your account, and we will remove them from active storage. When you delete your account, your selfies are removed from active storage promptly.
- Generated images: we retain your generated images so you can access them while your account is active. They are deleted when you delete them or when you delete your account.
- Account and billing records: we may keep limited account and transaction records for as long as needed to comply with legal, tax, and accounting obligations, even after account deletion.
- Backups: after deletion, residual copies of your selfies and generated images may persist in encrypted backups for a limited period (no longer than 90 days) before being overwritten.
8. Your Rights
Depending on where you live, and in particular under the GDPR, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete your data ("right to be forgotten"), including your uploaded selfies and account.
- Restrict or object to certain processing, including processing based on our legitimate interests.
- Data portability: receive certain data in a portable format.
- Withdraw consent where we rely on it, without affecting processing already carried out.
You can exercise most of these rights directly in your account (for example, deleting selfies or your account). For anything else, email hello@9frame.ai and we will respond within the timeframes required by law. You also have the right to complain to your local data protection authority.
9. Security
We take reasonable technical and organizational measures to protect your data, including encrypted connections (HTTPS), access controls, and storing files with a reputable cloud provider. No online service can be completely secure, but we work to protect your uploaded photos and account data and to limit access to them.
10. Children
The Service is intended only for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected data from a minor, we will delete it.
11. Cookies and Analytics
We use only the cookies and local storage needed to run the Service (for example, to keep you logged in) and our self-hosted, privacy-friendly Umami analytics. We do not use third-party advertising or cross-site tracking cookies.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective date" above and, where appropriate, notify you. Please review it periodically.
13. Contact Us
For any privacy question or to exercise your rights, contact us at hello@9frame.ai or on Telegram at t.me/nineframe_support_bot.