This Privacy Policy explains how Zorzen Studios (“FanLens”, “we”, “us”, “our”), the controller of your personal data, collects, uses, shares and protects that data when you use FanLens at https://fanlens.app and https://web.fanlens.app (the “Service”). It applies to all users and is designed to meet the EU General Data Protection Regulation (GDPR) and applicable national law.
If you have any questions or want to exercise your rights, contact us at privacy@fanlens.app.
1. The essentials
- You upload a selfie; we send it to Google’s Gemini AI to place you into a fan scene, then store the result so you can share it.
- A photo of your face can be biometric / special-category data. We process it only to provide the Service and only with your explicit consent, which you can withdraw at any time.
- We use a small number of trusted providers (hosting, AI, payments, email). We never sell your personal data and we do not use your photos to train our own AI models.
- Free drops are deleted after ~24 hours. You can delete any drop, or your whole account, whenever you like.
2. Information we collect
- Account data — your email address. We use passwordless “magic link” sign-in, so we do not store passwords.
- Photos you upload — the selfie or photo you submit for processing.
- AI-generated images — the output image we create from your photo, plus its scene, category and optional country/team selection.
- Share data — the unique 6-character code and public share page generated for each drop, and view counts.
- Payment data — when you buy Pro or a Drop Pack, our payment processor (Stripe) handles your card details. We receive your plan, subscription status, billing country, the last four digits/brand of your card and a customer reference. We never receive or store your full card number.
- Technical & usage data — IP address, device/browser type, approximate location derived from IP, timestamps, and security and diagnostic logs needed to operate and protect the Service.
- Communications — emails you send us and our correspondence with you.
3. How we use your data and our legal bases
We process personal data for the following purposes, relying on these GDPR legal bases:
- To generate your drops from your photo — your explicit consent under Art. 9(2)(a) GDPR for the biometric aspects, and performance of our contract with you (Art. 6(1)(b)) for the Service generally.
- To create your account and authenticate you — performance of a contract (Art. 6(1)(b)).
- To take payment and manage your plan or credits — performance of a contract (Art. 6(1)(b)) and compliance with tax/accounting law (Art. 6(1)(c)).
- To send transactional email (sign-in links, receipts, billing and account notices) — performance of a contract (Art. 6(1)(b)).
- To secure the Service, prevent abuse and fraud, and keep records — our legitimate interests (Art. 6(1)(f)) in running a safe, lawful Service.
- To comply with legal obligations and to establish, exercise or defend legal claims — Art. 6(1)(c) and Art. 9(2)(f).
4. Your photo and AI processing
To create a drop, your uploaded photo and a text prompt are transmitted to Google’s Gemini API (the model commonly known as “Nano Banana”), which generates the resulting image. We do not use your photos to train any AI model, and we do not use them for any purpose other than generating your drop and operating the Service.
Under Google’s Gemini API terms, on the paid API service Google does not use the inputs you submit (including your photo) or the generated output to train or improve its models, and the content is not reviewed by humans; Google logs it only for a limited period to detect abuse of its services and to meet legal requirements. Google applies these same data protections to all Gemini API use from the EEA, Switzerland and the UK. Your use of the AI features is governed by Google’s Gemini API terms, Privacy Policy and Generative AI Prohibited Use Policy.
Because the Service works with images of your face, the photo and output may constitute special-category (biometric) personal data. We therefore process them only where you have given explicit consent by choosing to upload a photo and create a drop. You may withdraw that consent at any time by deleting your drops or your account, or by contacting us; withdrawal does not affect processing carried out before withdrawal.
5. Cookies and similar technologies
We use only strictly necessary cookies (for sign-in, session security, and secure payment). We do not use advertising or cross-site tracking cookies. See our Cookie Policy for details.
6. Who we share your data with
We share personal data only with the processors below, each acting on our instructions under a data-processing agreement, and only as needed to run the Service:
- Supabase, Inc. — Database, authentication, file storage and application hosting (EU / United States).
- Google LLC (Gemini API) — AI generation of your image from the photo you upload (EU / United States).
- Stripe, Inc. — Payment processing, billing and fraud prevention (EU / United States).
- Zoho Corporation (ZeptoMail) — Sending transactional email (sign-in links, receipts, notices) (EU).
We may also disclose data where required by law, to enforce our terms, or in connection with a merger, acquisition or sale of assets (with notice to you). We do not sell your personal data and we do not share it for third-party advertising.
7. International transfers
Some providers may process data outside the European Economic Area, including in the United States. Where they do, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and, where applicable, adequacy decisions, so that your data receives an essentially equivalent level of protection.
8. How long we keep your data
- Free drops (photo and generated image) are deleted approximately 24 hours after creation.
- Pro / Drop Pack drops are kept until you delete them or close your account.
- Account data is kept while your account is active and deleted on request or after a period of inactivity.
- Payment and tax records are retained for as long as required by law (typically up to 7 years in the Netherlands).
- Residual copies may persist in secure backups for a limited period before being overwritten.
9. Your rights
Subject to the conditions in the GDPR, you have the right to:
- access the personal data we hold about you, and receive a copy;
- rectify inaccurate or incomplete data;
- erase your data (“right to be forgotten”);
- restrict or object to certain processing;
- data portability — receive your data in a structured, machine-readable format;
- withdraw consent at any time, without affecting prior processing.
To exercise any of these, email privacy@fanlens.app. We will respond within one month. You also have the right to lodge a complaint with a supervisory authority — for us, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), autoriteitpersoonsgegevens.nl.
10. Automated decision-making
We use AI to generate images at your request. We do not use your data for automated decisions that produce legal or similarly significant effects about you within the meaning of Art. 22 GDPR.
11. Children
FanLens is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.
12. Security
We use appropriate technical and organisational measures — including encryption in transit, access controls and database row-level security — to protect your data. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the authorities of a personal data breach where the law requires.
13. Changes to this policy
We may update this Privacy Policy from time to time. We will revise the “last updated” date above and, for material changes, take reasonable steps to notify you.
14. Contact
Zorzen Studios, registered in the Netherlands. Privacy contact: privacy@fanlens.app. You may also contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), autoriteitpersoonsgegevens.nl.