Privacy Policy

Important Notice on Translations

This English version is provided for informational purposes only. The German version of these legal documents is the sole legally binding version. In the event of any discrepancy, ambiguity, or conflict between this English translation and the German original, the German version shall prevail.

---

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Roman Moor Game-Design (Sole Proprietorship) Owner: Roman Moor Milbertshofener Straße 54 80807 Munich Germany Email: contact@framo.app

---

2. Purposes of Data Processing

We process personal data for the provision and further development of Framo, in particular for:

• Operation and provision of the Framo platform
• Creation, editing, and generation of AI-powered content
• Storage and management of projects and content
• Registration of user accounts and login (authentication)
• Billing for subscriptions and credits
• Communication with users (e.g., support)
• Detection and prevention of abuse and fraud
• Ensuring IT security (logs, monitoring)
• Improvement and further development of our services
• Optional sending of information and updates (newsletter), where consent has been given

---

3. Categories of Personal Data

3.1 User Data

• Email address
• Password (encrypted)
• Name or other voluntary profile data, where applicable

3.2 Subscription and Billing Data

We collect and process subscription-related data through our payment provider Polar:

• Current subscription plan and tier (Free, Pro, Max, Enterprise)
• Subscription status (active, canceled, past due, revoked)
• Billing interval (monthly or annual)
• Subscription start date, renewal dates, and expiration dates
• Payment method type (not full card details, which are stored by Polar)
• Billing history and invoice records
• Plan change history (upgrades, downgrades, cancellations)
• Grace period status and pending plan changes

3.3 Credit and Transaction Data

We maintain detailed records of credit transactions for account management and audit purposes:

• Current credit balance
• Credit allocation history (monthly allocations, top-up purchases)
• Credit consumption records (operation type, credits used, timestamp)
• Credit adjustments (rollovers, cap applications, forfeitures)
• Credit reservation records for in-progress operations

This transaction logging is necessary for:

• Accurate credit balance tracking
• Dispute resolution and customer support
• Fraud detection and prevention
• Compliance with financial record-keeping requirements

3.4 Content and Project Data

• Content uploaded by the User (e.g., texts, prompts, files)
• AI-generated content
• Project-specific settings and metadata

3.5 Log and System Data

• IP address (truncated where technically possible)
• Date and time of access
• Device and browser information
• Technical usage logs (e.g., error messages, performance data)
• Logs of AI generations (e.g., timestamp, model used, resource consumption)

3.6 Abuse Prevention Data

To protect the free credits we grant on signup, we process two technical characteristics of a registration request:

• Your IP address (IPv4 in full, IPv6 shortened to the /64 network prefix)
• Technical characteristics of your browser (a "browser fingerprint", derived from settings your browser exposes to any website, such as language, time zone, screen properties and rendering behaviour)

Both are stored only as a salted, irreversible hash value. We do not store the IP address or the browser characteristics themselves for this purpose, and the hash values cannot be converted back into them. They are used exclusively to detect misuse of the sign-up mechanism — whether free credits have already been claimed from the same connection or the same device, and whether an address a device tried to register was also tried from a connection or device belonging to an account we suspended for misuse — and for no other purpose — in particular not for advertising, profiling, tracking across websites, or recognising you as a visitor.

These hash values are stored together with the record of the free credit grant and are subject to the retention periods in section 5.

The browser fingerprint is sent by your browser in the framo_dfp cookie (see the Cookie Policy). Registration and sign-in requests are additionally protected by a bot check (Cloudflare Turnstile, see section 6); when it succeeds, we set a short-lived framo_tsp cookie containing a signed, non-identifying confirmation, valid for thirty minutes.

Sign-in and registration events. When one of these checks matches, the free credits of a new account may be held until a member of our team has looked at the registration; the account itself is created and usable. One exception: where the device hash value matches an account that we have already suspended for misuse, the registration is refused rather than held, and no account is created — the refusal notice explains how to contact us if you believe this is a mistake. To recognise repeated misuse of the sign-up mechanism, we keep a record of every sign-in and registration request for 90 days: the outcome (allowed, held for review, or refused) and, where held or refused, the check that decided it; the hash values of the connection and the device described above; a keyed one-way hash of the email address and the email domain; the sign-in method (email link, Google, Apple); and the country and city that our hosting provider derives from the IP address. While we are responding to a wave of misuse from one place, registrations from that country or city may be held for review in the same way; and the free credits may also be held where the part of the email address before the @ does not read like an address a person would type (a score computed from its letters and stored with the record). Neither the IP address nor the email address itself is stored in these records. Requests for sign-in links are also counted per connection and per email address for one hour to limit automated requests; these counters hold hash values only.

We are notified of refused, held and completed registrations by message (see section 6). These notifications contain the email address used for the registration, the check that decided the outcome and the hash values described above — never the name or the IP address. They are delivered by Telegram to a single member of our team, solely for internal fraud-detection and security purposes (see sections 6 and 7).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting the sign-up mechanism from misuse — in particular the repeated claiming of free credits through multiple accounts, which causes us direct costs and is prohibited under our terms of use. If you believe you have been wrongly affected — for example because you share an office network, a device or an email domain with other users — please contact us and we will unblock your organisation.

3.7 Communication Data

• Content of support requests
• Email communication with us
• Newsletter information (registration data, receipt), where applicable

---

4. Legal Bases for Processing

Processing is carried out on the following legal bases, depending on the purpose:

---

5. Storage and Deletion

5.1

Personal data is only stored for as long as necessary for the respective purposes or as we are legally obligated to do so.

5.2

Account and profile data is generally stored for as long as a user account exists. After deletion of the account, the personal data of the account will be deleted or anonymized, unless statutory retention obligations prevent this.

5.3

Content and project data is stored as long as the User maintains it in their account. The User can independently delete their own content and projects. After account deletion, content will – subject to statutory obligations – be deleted or anonymized.

5.4

Billing and booking data (e.g., invoices) is retained in accordance with statutory retention periods, generally up to 10 years.

5.5

Log and system data is stored for a technically necessary and security-relevant period (typically 30–90 days) and then deleted or anonymized, unless longer retention is required in individual cases to investigate security incidents or to assert legal claims.

5.6

Backups: Our infrastructure providers (particularly Convex) maintain automated backups for up to 30 days. Deleted data may persist in these backups until they are automatically overwritten but is not actively used or accessed.

5.7 Data Retention After Account Deletion

When a User deletes their account, we distinguish between data that is deleted immediately and data that is retained for specific purposes:

(a) Data Deleted Immediately:

• All projects, scenes, and creative content
• Uploaded files (models, images, videos, textures, HDRIs, gobos)
• Custom materials and configurations
• Profile information and preferences
• Active session data

(b) Data Retained for Account Reactivation (30 days):

• Your account may be reactivated within 30 days by signing in again
• During this period, minimal account identifiers are retained to enable reactivation
• After 30 days without reactivation, the account becomes permanently inactive

(c) Data Retained for Fraud Prevention (Indefinitely):

To protect our platform and legitimate users from abuse, we retain a record of the free credit grant after account deletion. It contains:

• Email address: The email address the credits were granted to, in a normalised form (lower case; without a + suffix on any domain; for Gmail addresses also without dots), and a keyed one-way hash of it (HMAC-SHA-256 with a key held only by us)
• Authentication provider identifiers: The opaque account identifier your sign-in provider assigns to you (e.g. the Google account ID, a number that is not your email address) and the provider's name
• Connection and device hash values: The salted hash values described in section 3.6, where present
• Welcome credit claim record: When and how many welcome credits were claimed, to prevent repeated claims

Purpose and Legal Basis: This retention is necessary for our legitimate interest in protecting the sign-up mechanism from misuse (Art. 6(1)(f) GDPR). Specifically, it prevents users from repeatedly deleting and recreating accounts to claim free welcome credits multiple times, which constitutes abuse of our service.

Technical Measures: The record is used solely to decide whether welcome credits have already been claimed when a new account is registered. It is not used for advertising, profiling or any other purpose, and it is not shared with third parties beyond the processors in section 6.

(d) Your Rights Regarding Retained Data:

You may request complete erasure of all fraud prevention identifiers by contacting us at contact@framo.app. Such requests will be processed in accordance with Art. 17 GDPR, taking into account any overriding legitimate interests. Please note that if complete erasure is granted and you create a new account in the future, you will still not receive additional welcome credits, as the credit system is designed to provide one-time welcome credits per person.

---

6. Recipients and Categories of Recipients

In the course of operating Framo, we use service providers that process personal data on our behalf (processors):

These service providers process personal data only according to our instructions and on the basis of corresponding contracts pursuant to Art. 28 GDPR.

Note on Polar: As Merchant of Record, Polar acts as an independent controller for payment-related data. For details on how Polar processes your payment information, please refer to Polar's Privacy Policy.

Beyond this, we only transfer data where there is a legal obligation to do so (e.g., to authorities) or where the User has expressly consented.

---

7. Data Transfer to Third Countries

Some of our service providers are located outside the European Union (EU) or the European Economic Area (EEA). Data transfers are based on the following legal mechanisms:

7.1 EU-US Data Privacy Framework (DPF)

The European Commission adopted an adequacy decision for the EU-US Data Privacy Framework on July 10, 2023. Transfers to DPF-certified US companies are therefore permitted without additional safeguards. The certification status of our service providers can be verified at dataprivacyframework.gov/list.

7.2 Standard Contractual Clauses (SCC)

For service providers not covered by the DPF, we use the Standard Contractual Clauses (SCC) provided by the EU Commission pursuant to Art. 46(2)(c) GDPR, supplemented by technical and organizational measures (particularly encryption in transit and at rest, data minimization).

Note: Despite these measures, the level of data protection in third countries may in individual cases be lower than that in the EU (e.g., government access without adequate legal remedies).

---

8. Newsletter and Communication

8.1

We may send newsletters or product information to users who have expressly consented. The legal basis is Art. 6(1)(a) GDPR.

8.2

The User may revoke their consent to receive newsletters at any time with effect for the future, e.g., via an unsubscribe link in the email or by notification to contact@framo.app.

8.3

Contract-related communications (e.g., security-relevant information, changes to GTC or technical features) may be sent independently of the newsletter and are based on Art. 6(1)(b) and (f) GDPR.

---

9. Cookies and Tracking

9.1 Technically Necessary Cookies

Technically necessary cookies (e.g., session cookies for login and security) serve exclusively for the functioning of the platform and are based on Art. 6(1)(f) GDPR (legitimate interest in secure and functional operation).

9.2 Analytics

With your consent (Art. 6(1)(a) GDPR), we use the following analytics services:

• PostHog (PostHog Inc., EU data processing) — product analytics and usage tracking
• Vercel Analytics / Speed Insights (Vercel Inc.) — page performance and web vitals

9.3 Advertising

With your consent (Art. 6(1)(a) GDPR), we use the following advertising technologies:

• Google Ads (Google Ireland Ltd.) — conversion tracking and remarketing. Google processes data in accordance with Google Consent Mode v2.
• Meta Pixel (Meta Platforms Ireland Ltd.) — conversion tracking and advertising measurement.

Data may be transferred to the USA; legal basis for transfer: EU-US Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCC).

9.4 Consent Management

On your first visit, you will be shown a cookie consent banner where you can accept or reject optional cookies by category (Analytics, Marketing). You can change your preferences at any time via the "Cookies" link in the website footer.

Detailed information on all cookies is available in our Cookie Policy.

---

10. AI Processing and Profiling

10.1

Within Framo, content is processed using various AI models provided by third-party providers (e.g., fal.ai). Processing is carried out for the performance of the contract (Art. 6(1)(b) GDPR).

10.2

AI-generated content may be erroneous, incomplete, or biased. Users must independently review all results before further use.

10.3

No automated profiling within the meaning of Art. 22 GDPR takes place that produces legal effects concerning the User or similarly significantly affects them.

---

11. Rights of Data Subjects

Data subjects have, within the scope of the statutory requirements, the following rights in particular:

To exercise these rights, a notification to contact@framo.app is sufficient.

---

12. Right to Lodge a Complaint with Supervisory Authorities

Data subjects have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement.

The competent supervisory authority for us is in particular:

Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht – BayLDA)

---

13. Amendments to this Privacy Policy

We may adapt this Privacy Policy to accommodate changes in the legal situation, technical developments, or new services. The currently valid version is available on our website.

---

Version: December 2025