Privacy Policy

• Account details — your name and email. To create and secure your account and to contact you about the service.
• Photographs you upload — the images used to build your twin. To generate your persona’s face. These can include biometric-style facial data, which is why we ask for your consent and, for a twin of a real person, that person’s consent.
• Personas and generated content — the images, text and settings you create. To provide the service and show them back to you.
• Billing information — your plan, and payment records from Stripe. To take payment and meet our accounting and tax duties. We never receive or store your full card number or bank details; Stripe does.
• Usage and technical data — basic logs, credits used, and errors. To run, secure and improve the service.

• Contract — to give you the service you signed up for: your account, personas, generation and billing.
• Consent — for the photographs and the facial data used to build a twin. You can withdraw consent by deleting the persona. Deleting your account also deletes every twin of you, including one in a workspace you share with other people.
• Legal obligation — to keep invoice and tax records for as long as the law requires.
• Legitimate interests — to keep the service secure and working, and to prevent abuse, balanced against your rights.

We use a small number of processors, each under a data-processing agreement:

• Supabase — our database, authentication and file storage (the photos, images, videos and profile pictures you upload or we make for you), hosted in the EU.
• Stripe — payments and affiliate payouts. Stripe is the processor for card and bank data and is a controller of that data in its own right.

Where a processor moves data outside the EU/EEA, that transfer is covered by the standard contractual clauses or an equivalent safeguard. We do not sell your data.

Which services receive what, depending on the feature you use. Google (Gemini) and OpenAI make and edit images and, for Google, some voice and picture styles (see below). Anthropic (Claude) writes captions and checks images; that includes looking at your pictures to pick a photo or check a background. Higgsfield and Kling turn your twin’s still pictures into video. Each receives only what that feature needs. Their own retention and training terms apply to what they receive, we do not control them, and we will tell you what a provider’s terms say if you ask.

Image generation. To create and edit pictures of your twin we send the photos you uploaded for your twin, your twin’s description and the text of each request to OpenAI (OpenAI, L.L.C. and its group companies), our image-generation service provider, and to Google (Gemini), depending on the picture style. They process this data only to produce your images, under a data processing agreement and, for transfers outside the EEA, standard contractual clauses. By default OpenAI does not use API data to train its models. It may keep requests, including uploaded photos, in safety logs for up to 30 days to detect abuse, and keeps anything flagged as child-safety material for review. We never send photos of anyone else unless you confirm you have that person’s consent. You can delete your twin and its photos, or your whole account, at any time. Deleting them removes our copies, and OpenAI’s own retention period then applies to anything it already received.

• Account, personas and generated content: for as long as your account is open.
• After you delete your account: your personas, photos, generated media, community posts and profile are deleted straight away, and conversations your personas had on Instagram within 30 days, except what we must keep (next two lines).
• A minimal record that a twin was consented to (the wording, its version and the dates, with your name and email removed): kept for 3 years, so we can show that consent was given.
• Invoices and payment records: kept for the period Swedish accounting and tax law requires (currently seven years). This includes the billing name, email and address our payment provider (Stripe) holds on them; they are kept as the law requires, not erased.
• Backups: rotated out on our normal backup cycle.

Under the GDPR you can:

• See the data we hold about you, and get a copy: use Download my data on Edit profile for a file you can keep and move.
• Correct data that is wrong.
• Delete your data (“right to be forgotten”), subject to what we must keep: use Delete account on Edit profile, or delete a single twin and its photos at any time.
• Object to, or ask us to limit, certain processing.
• Withdraw consent at any time, without affecting what we did before you withdrew it.
• Ask for your data in a portable form: Download my data gives you one JSON file with your account, workspaces, personas and their texts, credit and invoice records, and short-lived links to your files.
• Complain to a supervisory authority — in Sweden, the Integritetsskyddsmyndigheten (IMY).

Sign in, open Edit profile and choose Delete account. You type DELETE to confirm, and the dialog lists exactly what is deleted and what is kept before anything happens. It deletes your account and every workspace you are the only member of, with its personas, photos, generated media, community posts and settings, and ends any paid plan immediately (the unused part of the period is not refunded). We cannot delete a workspace that other people belong to, or one with commission not yet paid out, until that is sorted; the dialog then tells you what to do. You can also email support@forsmangruppen.com and we will do it for you.

What we keep is limited to what the law and other people’s payouts require. Invoices and payment records are kept for seven years as the law requires, including the billing name, email and address our payment provider (Stripe) holds; they are not erased. The record of credit movements, any sale or commission others are paid from, our own cost records and the minimal consent record described above are kept with your name, email and workspace name removed from our side. Posts already published to Instagram or other platforms stay there until you delete them on the platform.

Persona Studio is not for anyone under 18, and we do not knowingly collect their data.

If we change this policy in a way that matters, we will tell you. For any privacy question, or to use one of your rights, email support@forsmangruppen.com. Our full details are on the contact page.