This policy explains what Imaji does with your photos. The short answer is that almost everything happens on your device and we keep none of them — but the AI features do send one image at a time to a processing provider, and you deserve the detail rather than the reassurance.
01Who we are
Imaji is a photo and video editing app published by Kevin Moore, a sole trader trading as Kanda Apps, based in Ireland. For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Kevin Moore is the data controller for the personal data described in this policy.
Contact: support@kandaapps.com
We are not required to appoint a Data Protection Officer, and have not done so. Privacy questions go to the address above and are answered by us directly.
02The short version
- We do not sell your data, and we do not use it for advertising.
- Ordinary editing happens entirely on your device. Nothing is uploaded.
- The AI features send the one photo you selected for processing. We do not keep it.
- We do not use your photos to train AI models — not ours, not anyone's.
- We do not perform facial recognition and do not build face templates.
- Every image sent for AI processing is automatically checked for unsafe content before it is processed. See §06.
- You can edit photos without an account.
03What we collect
Photos and videos you choose to edit. Imported media is stored on your device. We never scan or upload your photo library. Only the specific image you select is ever touched, and it only leaves the device if you use an AI feature (§05).
Account information. If you create an account we store your email address and a user identifier. You may use the editor and the AI features anonymously; an account exists so your work is not tied to a single device.
Subscription status. If you subscribe, our payments provider (RevenueCat, on behalf of Apple or Google) tells us whether your subscription is active and which plan you hold. We never see your card details. Payment is handled entirely by Apple or Google.
AI usage records. For each AI operation we store the operation type, a timestamp, the credits it cost, and your user identifier, so we can apply your monthly allowance accurately. These records do not contain your photo.
Diagnostics. Where enabled in the build, we collect crash reports and error diagnostics to fix faults. These do not contain your photos.
We do not collect: contacts, precise location, health data, browsing history, advertising identifiers, or your photo library as a whole.
04Why we process it, and our legal basis
GDPR requires us to tell you not just what we process but why, and under which lawful basis in Article 6. In plain terms:
| What | Why | Legal basis |
|---|---|---|
| The photo you send to an AI feature | To perform the edit you asked for | Contract (Art. 6(1)(b)) — you asked for the operation and it cannot be done without sending the image |
| Automated safety check on that image | To prevent unlawful and harmful content being generated | Legitimate interests (Art. 6(1)(f)) — operating the service lawfully and protecting users; and compliance with app store rules |
| Account email and identifier | To give you an account and sync entitlements | Contract (Art. 6(1)(b)) |
| Subscription status | To give you what you paid for | Contract (Art. 6(1)(b)) |
| AI usage records and credits | To apply your monthly allowance and prevent abuse | Legitimate interests (Art. 6(1)(f)) — accurate billing and service integrity |
| Crash and error diagnostics | To find and fix faults | Legitimate interests (Art. 6(1)(f)) — keeping the app working |
Before your first AI operation we ask for your explicit consent and explain what will be sent and where. You can withdraw that consent at any time by not using the AI features; doing so does not affect processing already carried out.
05AI features and third-party processing
This is the part most people want to understand, so we are specific about it. Five kinds of feature send an image off your device:
| Feature | What it does |
|---|---|
| Remove Background | Separates the subject from the background |
| Magic Eraser | Removes an object you brush over and reconstructs what was behind it |
| Upscale | Increases resolution |
| AI Styles | Re-renders your photo in a chosen style or scene — changing background, clothing, lighting, era or artistic medium, while preserving the subject's facial features |
| AI Video | Generates a short video clip (about five seconds) from your still photo |
- Nothing is sent until you choose one of those features. Ordinary editing — cropping, filters, exposure, colour — happens entirely on your device.
- Before your first AI operation we ask for explicit consent and explain what will be sent and where.
- The image is sent over an encrypted connection to our processing service (hosted by Supabase), which forwards it to our AI provider, fal.ai (fal.ai Inc., United States), who run the models. Their privacy policy: fal.ai/legal/privacy-policy
- The result is returned and saved on your device.
- We do not store your photos on our servers. The image is passed through for processing, not retained by us.
- We do not use your photos to train AI models, and our agreement with our provider does not permit them to do so either.
- We do not share your photos with anyone other than the processing provider described above, and only for the operation you requested.
What we cannot control: fal.ai processes the image on their infrastructure under their own retention practices. We chose a provider whose terms support this use, but their handling is governed by their policy as well as by our agreement with them.
Before you upload: please be thoughtful about images containing other people, children, identity documents, or anything sensitive — the same care you would take with any online service. If a photo contains someone else, you are responsible for having their agreement to edit it (see the Terms).
06Content moderation
Every image submitted to an AI feature is automatically screened before it is processed. The check is performed by an automated classifier that scores the likelihood of sexual or otherwise unsafe content. If the score exceeds our threshold, the request is refused and no generation takes place.
- The check is fully automated. No human reviews your photo as part of it.
- A refusal does not cost you credits.
- We record that a refusal happened, but we do not keep the image.
- Because the check is automated it will sometimes be wrong in both directions. If a perfectly ordinary photo is refused, please tell us at support@kandaapps.com.
This screening does not produce a decision with legal or similarly significant effects for you within the meaning of Article 22 GDPR; it determines only whether one image is processed by one feature.
07Faces and biometric data
Imaji's AI features work on photographs as images. Some of them are explicitly designed to keep a person recognisable — a style preset changes the scene and the clothing while preserving the subject's facial features, because a result that returns a different face is a failed result.
Preserving how a face looks is not the same as identifying it. We do not:
- perform facial recognition or facial identification,
- create, store or compare face templates, faceprints or biometric identifiers,
- attempt to determine who is in a photograph,
- match faces across photographs or against any database.
A photo of a person is processed as an image, not as a biometric identifier. We do not process biometric data for the purpose of uniquely identifying a natural person within the meaning of Article 9 GDPR, and we do not collect biometric information as defined by the Illinois Biometric Information Privacy Act (BIPA), the Texas CUBI Act, or comparable laws.
08AI-generated and AI-edited content
Imaji's AI Styles and AI Video features are generative. They produce new imagery based on your photo. It is important you understand what that means:
- A result can change almost everything except the subject's face — clothing, pose, background, lighting, era, and the medium the image appears to be made from. Costume and transformation presets do this deliberately.
- AI Video generates motion that did not happen. The subject may appear to move, turn or gesture in ways they never did.
- Results are synthetic. They are not photographs of real events and should not be presented as though they were.
- Results are labelled as AI-generated in the app, and exported files carry standard content-credential metadata where the platform supports it.
What we do not build: we do not offer face swapping — placing one person's face onto another person's body — and we do not offer features whose purpose is to depict a real, identifiable person doing something they did not do. We reserve the right to change what the app does, and this policy will be updated if that happens.
You can report a result you believe is inappropriate from the screen where it appears, or at support@kandaapps.com.
09How long we keep things
| Data | Retention |
|---|---|
| Your photos, videos and edits | On your device until you delete them. Deleting a project in Imaji removes our copy; the original in your camera roll is never touched. |
| Images sent for AI processing | Not retained by us. Passed through for the requested operation only. |
| AI usage and credit records | While your account exists, plus up to 7 years where needed for tax and accounting records. |
| Moderation refusals | The fact of a refusal, for up to 12 months. Never the image. |
| Account information | Until you delete your account, then removed within 30 days. |
| Diagnostics | Retained by our diagnostics provider under their standard retention period, typically 90 days. |
10Where your data goes
We are based in Ireland. Some of our providers are outside the European Economic Area, which means your data may be transferred internationally:
| Provider | Role | Location | Safeguard |
|---|---|---|---|
| Supabase | Database, authentication, processing service | EU (Ireland region) | Within the EEA |
| fal.ai | AI model processing | United States | Standard Contractual Clauses |
| RevenueCat | Subscription status | United States | Standard Contractual Clauses |
| Apple / Google | Payment and app distribution | Global | Their own frameworks; we never receive payment details |
11Your rights
Under GDPR — and, where applicable, the UK GDPR and the California Consumer Privacy Act as amended (CCPA/CPRA) — you have the right to:
- Access the personal data we hold about you,
- Rectify data that is inaccurate,
- Erase your data ("right to be forgotten"),
- Restrict or object to processing carried out under legitimate interests,
- Port your data to another service in a machine-readable format,
- Withdraw consent at any time, without affecting processing already carried out.
California residents additionally have the right to know what is collected, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we have not done so in the preceding twelve months.
To exercise any of these, email support@kandaapps.com. We will respond within one month. You can also delete your account from within the app, which removes your account data without needing to contact us.
12Children
Imaji is not directed at children and is rated accordingly on the app stores. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact support@kandaapps.com and we will delete it.
If you edit a photograph containing a child, please think carefully first. Generative features can place a recognisable person into a scene that never existed, and a child cannot consent to that.
13Security
- All transmission between the app, our service and our providers uses TLS encryption.
- Your photos remain on your device except during an AI operation.
- Access to our database is protected by row-level security, so one account cannot read another's data.
- API keys for AI providers are held server-side and are never present in the app.
No system is perfectly secure. If we become aware of a breach affecting your personal data we will notify the Data Protection Commission within 72 hours where required, and notify you directly where the risk to you is high.
14Complaints
If you are unhappy with how we have handled your personal data, please tell us first at support@kandaapps.com — most things are resolved quickly.
You also have the right to complain to a supervisory authority. Ours is the Irish Data Protection Commission, dataprotection.ie. If you are in another EEA country or the UK, you may complain to your local authority instead — in the UK that is the Information Commissioner's Office, ico.org.uk.
15Changes
We update this policy when the app changes. The date at the top always reflects the current version. If a change materially affects how your data is used — a new provider, a new category of processing, a new kind of AI feature — we will tell you in the app before it takes effect, and where the law requires it we will ask for your consent again.
A note on honesty. An earlier version of this policy said the app would never alter clothing in a photograph. The app now does exactly that, in its costume and transformation presets. Rather than quietly delete the sentence, we are recording that it changed, and §08 now describes what the generative features actually do.