Privacy Policy
Last updated: October 30, 2026
This Privacy Policy describes how personal data is processed by DISINDEX S.R.L. in accordance with the General Data Protection Regulation (EU 2016/679 - GDPR), Italian Legislative Decree 196/2003, Law 23 September 2025, n. 132, and the EU AI Act (EU Reg. 2024/1689).
1. Data Controller & GDPR Roles (B2C Users & B2B Clients)
The Data Controller for account management, billing, and platform security is DISINDEX S.R.L., Via Renzo e Lucia 9, 20142 Milan (Italy), VAT IT11611310969, REA MI-2614128 (Email: info@disindex.com). Regarding uploaded images, user text prompts, and generated outputs: (a) for B2B and professional Clients, the Client acts as independent Data Controller and DISINDEX S.R.L. acts strictly as Data Processor pursuant to Art. 28 GDPR, processing data solely upon the user's automated instructions (submitting prompts and images via the UI); (b) for B2C end-users generating images for strictly personal and private use, processing falls under the household exemption of Art. 2(2)(c) GDPR; if a B2C User publicly shares or publishes images depicting third parties or public figures on open social media or the web, the User acts as an independent Data Controller towards the depicted third parties, exempting DISINDEX S.R.L. as a neutral cloud infrastructure provider.
2. Categories of Data, Biometrics & Exclusion of Third-Party Identification (Recital 51 GDPR)
We collect account identifying data (email, name), technical system logs, and facial photographs uploaded by the user. Where the AI pipeline requires temporary extraction of vector facial features of the user (facial landmarks or face embeddings) to preserve likeness from the uploaded selfie, such processing is qualified as biometric data under Art. 9 GDPR and occurs solely upon the user's explicit consent. Pursuant to Recital 51 GDPR, generative graphic synthesis from an open text prompt does not constitute biometric processing aimed at uniquely identifying a natural person and does not involve creating biometric templates or profiling third parties or public figures named by the user.
3. Legal Bases & User Warranty on Third-Party Data
We process personal data on the following legal bases: Contract Performance (Art. 6.1.b GDPR) for delivering SaaS services requested by the user; Explicit Consent (Art. 9.2.a GDPR) for processing the user's facial data; Legitimate Interest (Art. 6.1.f GDPR) for platform security and abuse prevention; Legal Obligation (Art. 6.1.c GDPR). Any user uploading images or entering text prompts referring to third parties warrants holding a valid legal basis and consent from the data subjects.
4. Data Retention Policy & Hard Reset
Transient single-session uploads and API transit files are permanently purged within 24 hours of rendering. Saved profile reference photos are retained in the user's private area with explicit consent until the user triggers Hard Reset or deletes their account. Non-image technical logs are retained for cybersecurity and statutory compliance.
5. API Sub-Processors, Extra-EU Transfers & Zero Data Training Guarantee (EDPB Opinion 28/2024)
To provide high-speed AI generation and secure hosting, data is processed in real time (stateless API execution) by our vetted sub-processors bound by Data Processing Agreements (DPAs under Art. 28 GDPR): Supabase Inc. (Authentication, Database, and EU Cloud Storage), Google Cloud / Vertex AI EU (visual analysis and generative AI synthesis), Fal.ai (cloud AI visual inference infrastructure), OpenAI (multimodal processing and AI synthesis), and Stripe Inc. (Payment processing). Transfers to the United States are safeguarded under the EU-US Data Privacy Framework (DPF) and European Commission Standard Contractual Clauses (SCCs, Art. 46 GDPR). In compliance with EDPB Opinion 28/2024, neither DISINDEX S.R.L. nor our API providers ever use uploaded images, text prompts, or generated outputs to train, re-train, or fine-tune foundation AI models.
6. Data Subject Rights, Right to Erasure & Takedown Requests
Users and any affected third parties are guaranteed the rights of access (Art. 15 GDPR), rectification (Art. 16), erasure/Hard Reset (Art. 17 GDPR), restriction (Art. 18), portability (Art. 20), objection (Art. 21), and consent withdrawal (Art. 7) at any time. Any third party or public figure who believes content stored on the platform infringes their image rights or personal data protection may request immediate removal via our Single Point of Contact: info@disindex.com.
✨7. Transparency, Labeling & EU AI Act Role Allocation (EU Reg. 2024/1689)
In accordance with Article 50 of EU Regulation 2024/1689 (EU AI Act), Lovvai explicitly informs users that all images generated or edited via the platform are synthetic content produced by artificial intelligence systems. Pursuant to Art. 50(2), all downloaded files embed machine-readable technical metadata (C2PA/IPTC/EXIF) certifying their AI origin. Pursuant to Art. 50(4), if the user chooses to publish, share, or distribute externally a generated image depicting real people or appearing photorealistic (deepfake), the user acts as the final Deployer and is legally required to preserve C2PA/IPTC metadata and clearly and visibly disclose the artificial origin of the content.
DISINDEX S.R.L.
Via Renzo e Lucia 9, 20142 Milano (Italy)
P. IVA: IT11611310969 | REA: MI-2614128
Email: [email protected]