Version 2026-07-26. Effective from the date it is published at https://darkstudio.photo/privacy.

The short version

Dark Studio trains an AI model on photos you upload so it can generate new photos of the same person. That means we handle photographs of people's faces, which is sensitive data, so this policy explains exactly what happens to them.

• Your photos train a model that only you can use. We never use them to train shared or public models, and we never sell or license them.
• Your photos are private. They are stored in a private area and are only ever served to your browser through personal links that expire after one hour. They never have a public address.
• You can delete them. Deleting a person removes their uploaded photos, their generated photos, and the trained model itself, straight from the app. This is permanent. To close your whole account, write to us — see section 8.
• Only upload photos of yourself, or of an adult who has agreed. Never photos of a child.
• We never see your card details. Payments go directly to Stripe.

The rest of this policy is the detail behind those points. It is the version that governs.

1. Who is responsible for your data

The data controller is:

Contact for anything in this policy, including requests about your data: contact@darkstudio.photo.

2. What we collect

Account data. Your email address and display name, and which sign-in methods you have connected (Google, Apple, or Microsoft). We receive these from the provider you sign in with — we never receive or store your password for those accounts. If you use Apple's Hide My Email, we receive and store Apple's private relay address rather than your real one.

Training photos. The photos you upload to create a person. You choose these and can delete them.

Trained models. For each person you train, we create and store a model adapter — a file that encodes that person's likeness so it can be reproduced. See section 3.

Generated photos. The images the service produces for you, and the template and appearance choices used to produce them.

Credits and payments. Your credit balance and a transaction history (top-ups, and charges and refunds for training and generation). When you buy credits you are sent to Stripe's own checkout page. Card numbers never reach our servers — we receive only a confirmation that a payment succeeded, the amount of credits purchased, and Stripe's own identifiers for the transaction.

Technical and usage data. Standard server logs, and privacy-preserving page-view analytics from Vercel Analytics. Our analytics configuration strips identifying detail from event data before it is sent. We do not build advertising profiles and we do not use third-party advertising or tracking cookies.

3. Photos and face models — sensitive data

This section matters more than the others, so it is separate.

When you train a person, the service produces a model adapter that encodes what that person looks like specifically enough to reproduce them. Under the GDPR, data processed to uniquely identify a person by their physical characteristics is biometric data, and biometric data is a special category of personal data (Article 9). We treat both your uploaded photos and the resulting trained models as special-category data.

Special-category data may only be processed with a narrow legal basis. Ours is your explicit consent under Article 9(2)(a). This is why the service asks you to accept this policy before you can use it, and asks you to separately confirm, for each person you train, that you have that person's agreement.

What we do with these photos and models:

• Train a model adapter for the person, used only for your account.
• Generate photos when you ask for them, by loading that adapter.
• Nothing else. We do not use your photos or trained models to train shared, general, or public models, we do not use them to improve the service for other users, and we do not sell, license, or publish them.

You can withdraw this consent at any time by deleting the person in the app, or by asking us to close your account (section 8). Withdrawing consent does not affect processing that already happened, but it stops all future processing and removes the underlying data as described in section 7.

4. Why we process your data, and on what legal basis

We do not make automated decisions producing legal or similarly significant effects about you. Generating an image at your request is not such a decision.

5. Who else handles your data

We use a small number of service providers. They process data on our instructions and are bound by contract; they are not permitted to use it for their own purposes.

Photos and models are sent to the compute provider only for the duration of a training or generation job, and only through links that expire. We do not give any provider standing access to your storage.

Transfers outside the EEA. Some of these providers process data in the United States or other countries outside the European Economic Area. Those transfers rely on the European Commission's standard contractual clauses, or on an adequacy decision where one applies. You can ask us for details of the safeguards for any specific transfer.

We will also disclose data where we are legally required to — for example in response to a valid order from a competent authority.

6. How we protect your photos

Photos and trained models are handled as private data by design, not by policy alone:

• They are stored in a private storage area, physically separate from the public assets the site serves (such as sample images in the template gallery).
• They are never given a public address. Every time a photo is shown to you, the service mints a fresh personal link that expires after one hour and is issued only after checking that the data belongs to your account.
• That ownership check is applied in more than one layer, so that a mistake in one place does not expose another user's data.
• Links given to the compute provider are similarly time-limited and are never handed to a browser.
• All traffic is encrypted in transit, and storage is encrypted at rest by our storage provider.

No system is perfectly secure, and we do not claim otherwise. If a breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and, where the risk is high, notify you directly.

7. How long we keep things

Nothing here expires on a timer. We keep your photos, your trained models and your generated photos until you remove them — either by deleting the person in the app, or by asking us to close your account. We do not currently delete data for inactivity, and we would change this policy and tell you before we started to.

Payment records retained under the second-to-last row contain the fact and amount of a transaction. They do not contain your photos.

8. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you, and receive a copy.
• Correct data that is wrong or incomplete.
• Delete your data ("right to be forgotten"). You can delete individual people, and with them their photos, trained models and generated photos, from within the app at any time. To have your whole account deleted, write to us — see below.
• Withdraw consent for the processing of your photos and trained models, at any time, without giving a reason.
• Restrict or object to processing based on our legitimate interests.
• Portability — receive the data you gave us in a machine-readable form, or have it sent directly to another provider where technically feasible.

How to exercise them. Deleting a person is self-service, in the app. Everything else, including account deletion, access and portability requests, is handled by us by hand: write to contact@darkstudio.photo. We will respond within one month, and complete an account deletion within 30 days of confirming the request. There is no charge, unless a request is manifestly unfounded or excessive.

You also have the right to complain to a supervisory authority. In Poland this is:

You may also complain to the authority in your own country of residence.

9. If someone else uploaded a photo of you

You may be reading this because you were told, or discovered, that someone has uploaded photos of you to this service.

Our terms require every user to confirm that they have the agreement of any person whose photos they upload, and to upload photos of adults only. We cannot verify that independently, and we do not have a way to contact you unless you contact us — which is why this section exists.

You have the same rights described in section 8, and you do not need an account to use them. Write to contact@darkstudio.photo with enough detail for us to identify the material. We will investigate, and where the photos are of you and you do not consent, we will delete them and the model trained from them, and we may suspend the account responsible.

10. Cookies and local storage

We use only what the service needs to function:

• Sign-in tokens, stored in your browser so you stay signed in. Without these you cannot use the service.
• Interface preferences, such as which introductory dialogs you have dismissed.
• Vercel Analytics, which measures page views without cookies and without building a profile of you across sites. Identifying detail is stripped from the event before it is sent.

We do not use advertising cookies, and we do not share data with advertising networks.

11. Age

Dark Studio is for adults. You must be 18 or over to create an account. Do not upload photos of anyone under 18, including your own children, under any circumstances — this is an absolute rule with no exceptions, because a trained model of a minor's face is not something we are willing to hold.

If we learn that an account belongs to someone under 18, or that photos of a minor have been uploaded, we will delete the data and close the account.

12. Changes to this policy

We may update this policy. Each version has a date, and previous versions are kept.

If a change is material — a new use of your data, a new provider, or a change to your rights — we will ask you to review and accept the new version the next time you open the app, before you continue using it. Minor corrections that do not change meaning are published without a new prompt.

13. Contact

Questions, requests, or complaints about this policy or your data:

contact@darkstudio.photo