Privacy Policy

We process personal data, including your photos, only to run Filumi, and we store it in the European Union. This policy explains what we collect, why, who receives it, how long we keep it and how to use your rights. It applies to everyone who uses filumi.ro and its apps, wherever they are. We follow Regulation (EU) 2016/679 (GDPR) and Romanian data protection law.

1. Who is responsible

The data controller is S.C. Digital Garden Global Network S.R.L., Timișoara, Tristan Tzara 17, ap. 3, Romania, Trade Register no. J35/1968/2020, fiscal code RO42823924 ("we", "us").

For any question or request about your data, write to gdpr@filumi.ro or to the address above.

2. Data we collect

• Account data: name, email address, password (stored in encrypted form), language and account settings.
• Photos and content: the photos you upload, inspiration images, the Results generated from them, saved Looks, edit settings and the order of your slides. Photos can show you or other people and may contain metadata such as date, device or location.
• Purchase data: offers bought, credits added and used, invoices, billing name and address, country, VAT details and transaction status. Card details are entered directly with our payment provider; we do not see or store your full card number.
• Usage and technical data: IP address, device and browser type, operating system, pages visited, features used, generation history, error logs and approximate location derived from your IP address.
• Communications: messages you send us, support requests, complaints, feedback and survey answers.
• Marketing data: whether you subscribed to our newsletter, and how you interact with our emails and ads, if you consented.
• Cookie data: as described in our Cookie Policy.

You do not have to give us personal data, but without account data, photos and payment data we cannot provide the Service.

2.1 Where the data comes from

• From you: when you register, upload photos and inspiration, buy, contact us or answer surveys.
• Automatically: from your device and browser when you use Filumi, through server logs, cookies and similar technologies.
• From third parties: payment providers (payment status, fraud signals, country of the card), login providers if you choose to sign in with an external account (name, email, profile picture), and advertising platforms (which ad led you to us, where you consented to advertising cookies).

2.2 Photo metadata and location

Photo files often contain metadata (EXIF), such as the date, camera or phone model and, if enabled on your device, the GPS location where the photo was taken. We do not use location metadata for any purpose. We may remove metadata from files during processing; downloaded Results may not keep the original metadata. If you do not want to share location data, turn off location tagging on your camera or remove it before uploading.

2.3 Sensitive information in photos

Photos can reveal information such as health, religious beliefs, ethnic origin or sexual orientation, for example through clothing, symbols or context. We do not intend to collect such information and do not analyse, infer or use it for any purpose. It is processed only incidentally, as part of the image you chose to edit. Please do not upload photos you do not want processed.

3. Why we use your data and on what legal basis

Where we rely on legitimate interest, it is our interest in running a secure, working and improving service, and you can object (see section 9). Where we rely on consent, you can withdraw it at any time; this does not affect processing done before.

We do not sell your personal data and we do not use your photos or Results to train our own AI models. We will not use your photos in marketing without your separate, express permission.

3.1 Personalisation

To suggest styles, we analyse the visual qualities of your photos and inspiration images, such as colour, light and contrast, and your past choices and saved Looks. This is limited to improving your experience in Filumi. With your consent, we may also group users by general interests or behaviour to send more relevant offers. You can turn off marketing personalisation at any time.

3.2 No automated decisions with significant effects

We do not take decisions based solely on automated processing that have legal or similarly significant effects on you, within the meaning of GDPR art. 22. Our automated anti-fraud and content moderation tools may flag or block an action; you can ask for a human review as described in our Terms.

4. Photos of people and AI processing

4.1 How your photos are processed

To edit a photo, we send it with your chosen settings to an AI image model, which returns a new version. This processing is automated, but it only changes how images look. It does not make decisions about you that have legal or similarly significant effects.

4.2 No facial recognition

We do not use your photos to identify people, recognise faces or build biometric profiles. Faces are processed only as part of the image, so that the edit preserves them.

4.3 Other people in your photos

If your photos show other people, you are responsible for having a lawful basis to upload them, such as their consent, especially for children. For those people, we act on your instructions to edit and store the photos. If someone shown in a photo asks us to remove it, we may delete it and inform you.

4.4 Children

Filumi is for adults. Only people aged 18 or over can create an Account, and we do not knowingly collect data from anyone under 16. Photos showing children may be uploaded only by their parent or legal guardian or with their permission. If you believe a child has given us personal data, contact gdpr@filumi.ro and we will delete it.

5. Who receives your data

We share data only as needed to run Filumi, with:

• Hosting and storage providers, which store the Platform, your photos and Results on servers in the European Union;
• AI model providers, which process your photos and settings to generate Results;
• Payment providers, which process payments and prevent fraud; for card data they act as independent controllers under their own policies;
• Email, customer support, analytics and advertising providers, for the purposes in section 3; advertising providers only with your consent;
• Professional advisers, such as accountants, auditors and lawyers;
• Public authorities and courts, where the law requires it or to protect our rights;
• A buyer or successor, if our business or part of it is reorganised, merged or sold, under the same protections.

Our providers act as processors on our behalf under written data processing agreements. They may use your data only on our instructions, keep it confidential and protect it. A current list of our main providers is available on request at gdpr@filumi.ro.

If you share a Result or download link with others, or post Results on social networks, you decide who sees them, and those networks process them under their own policies.

5.1 Our role and the role of providers

We are the controller for the data described in this policy. Our hosting, storage, AI model, email and support providers are processors: they act only on our documented instructions, under contracts that meet GDPR art. 28, and must apply appropriate security measures and help us respect your rights. They may use sub-processors only under equivalent obligations.

Payment providers, and advertising platforms for their own purposes, act as separate controllers and are responsible for their own processing under their privacy policies.

5.2 Advertising platforms

If you accept advertising cookies, platforms such as Meta and TikTok receive information about your visit, for example the pages you viewed and whether you bought, to measure and improve our ads. For the collection and transmission of this data we may act as joint controllers with those platforms, under agreements that set out each party's responsibilities. Their further processing is governed by their own policies. You can withdraw this consent at any time in the cookie settings.

6. Where your data is stored and international transfers

6.1 Stored in the European Union

Your Account data, photos and Results are stored on servers located in the European Union.

6.2 Transfers outside the EEA

Some providers, for example AI model, email, analytics or advertising providers, may process data outside the European Economic Area (EEA), including in the United States. Photos sent for AI processing are transferred only for the time needed to generate the Result. We transfer data outside the EEA only where:

• the European Commission has decided that the country ensures an adequate level of protection, including the EU–US Data Privacy Framework for certified companies; or
• we have signed the European Commission's Standard Contractual Clauses with the recipient, with additional safeguards where needed; or
• another legal ground under GDPR chapter V applies.

You can ask for a copy of the relevant safeguards at gdpr@filumi.ro.

6.3 If you live outside the EU

Filumi is available worldwide but run from Romania. If you use it from outside the EU, your data is transferred to and stored in the EU, and processed elsewhere as described above. We apply the protections of this policy to everyone, whatever their country. If the law where you live gives you additional rights, for example in the United Kingdom, Switzerland, or US states such as California, we will honour them.

6.4 Information for users outside the EU

United Kingdom and Switzerland. You have rights equivalent to those in section 9 under the UK GDPR and the Swiss Federal Act on Data Protection. Transfers from these countries to the EU are covered by adequacy decisions. You can complain to the UK Information Commissioner's Office (ICO) or the Swiss Federal Data Protection and Information Commissioner (FDPIC).

United States. If you live in a US state with a consumer privacy law, such as California, Colorado, Connecticut, Virginia or Texas, the following applies to you:

• the categories of personal information we collect, their sources and purposes are described in sections 2 and 3;
• we do not sell personal information for money;
• if you accept advertising cookies, this may count as "sharing" for cross-context behavioural advertising or "targeted advertising" under some state laws. You can opt out at any time by rejecting advertising cookies in the cookie settings, and we treat a Global Privacy Control (GPC) signal from your browser as a valid opt-out;
• we do not use or disclose sensitive personal information for purposes that require an opt-out right;
• you have the right to know, access, correct and delete your personal information, to opt out as described above, and to appeal our decision on your request by replying to it;
• you may use an authorised agent, who must provide written permission from you; we may still verify your identity directly;
• we will not discriminate against you for exercising your rights.

Other countries. If you live in a country such as Brazil, Canada, Australia, Japan or South Korea, local law may give you additional rights. We will respect them, and you can exercise them by writing to gdpr@filumi.ro. By using Filumi, you understand that your data is processed in the EU and elsewhere as described in section 6.2.

7. How long we keep data

You can delete photos and Results earlier yourself, or ask us to. Backups are overwritten in the normal backup cycle, within 30 days after deletion. We may keep data longer only where the law requires it or to establish, exercise or defend legal claims.

8. How we protect your data

We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), access controls, limited staff access, encrypted password storage and regular backups. No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the authority and, where required, you, as the law requires.

8.1 Measures we use

• encrypted transfer of data between your device and our servers;
• data stored in professional data centres in the EU with physical access controls;
• access to personal data only for staff and providers who need it, protected by strong authentication;
• passwords stored only in hashed form;
• separation of user files, so each user can access only their own;
• monitoring, logging and regular updates to detect and fix vulnerabilities;
• regular backups and procedures to restore the Service after an incident;
• confidentiality obligations for everyone who works with personal data.

8.2 Data breaches

If a personal data breach occurs, we will act quickly to contain it, assess the risk and fix the cause. Where required, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and inform you without undue delay if the breach is likely to result in a high risk to your rights and freedoms.

8.3 Your part

Use a strong, unique password, do not share your login details, log out on shared devices and tell us immediately at gdpr@filumi.ro if you suspect unauthorised access to your Account.

9. Your rights

Under the GDPR, and subject to its conditions, you have the right to:

• access your data and get a copy;
• rectify inaccurate data;
• erase your data;
• restrict processing;
• data portability, receiving data you gave us in a common format;
• object to processing based on legitimate interest, and at any time to direct marketing;
• withdraw consent at any time.

Many of these you can do yourself in your Account, for example deleting photos or your Account. For the rest, write to gdpr@filumi.ro. We may ask you to confirm your identity. We will answer within one month; this can be extended by two more months for complex requests, in which case we will tell you.

You also have the right to complain to a data protection authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, www.dataprotection.ro. You may also complain to the authority in the country where you live or work.

9.1 How we handle requests

• Requests are free of charge. If a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee or refuse it, and will explain why.
• To protect your data, we may ask for information to confirm that the request comes from you, usually by replying from the email address linked to your Account.
• If we cannot fully comply, for example because we must keep invoices by law or because a request would affect other people's rights, we will tell you the reasons.
• When you ask us to erase or correct data, we will also inform the providers we shared it with, unless this is impossible or requires disproportionate effort.

9.2 Data protection officer

We have not appointed a data protection officer, as we are not required to. The person responsible for data protection can be reached at gdpr@filumi.ro.

9.3 Requests about other people

If you appear in a photo uploaded by another user, you can ask us to delete it by writing to gdpr@filumi.ro, describing the photo and, where possible, the user who uploaded it. Requests about a deceased user may be made by their heirs or legal representatives, as Romanian law allows, with proof of their capacity.

10. Newsletter and marketing

We send marketing emails only if you subscribed or, where the law allows, about similar services you bought from us. Every email contains an unsubscribe link, and you can also unsubscribe from your Account settings.

11. Changes to this policy

We may update this policy. The current version is always on filumi.ro with its effective date. If we make material changes, we will inform registered users by email or in the app before they take effect.

12. Contact

S.C. Digital Garden Global Network S.R.L., Timișoara, Tristan Tzara 17, ap. 3, Romania · gdpr@filumi.ro