Privacy Policy

Last updated: May 20, 2026

Glwup is operated by GLOW UP AI LTD EOOD, a company registered in Bulgaria (UIC 94292446). For the purposes of EU/UK data-protection law, GLOW UP AI LTD EOOD is the data controller. This Privacy Policy explains how Glwup collects, uses, and protects your personal information when you use our AI photo generation service.

1. Information We Collect

Account Information

When you create an account, we collect your email address and a unique user ID. This information is used to identify your account and provide you with access to the service.

Photos and Biometric Data (Special Category — GDPR Article 9)

You upload selfie photos so we can train a personal AI face model. Face photos are classified as biometric data under GDPR Article 9 ("special category data"). We process this data only with your explicit consent, which you provide via the consent dialog shown before the first photo upload. Your photos are stored encrypted in AWS S3, processed by our AI sub-processors (listed below) solely to generate images for your account, and erased on account deletion.

Usage Data

We collect anonymized usage data such as which features you use, generation counts, and app interaction patterns. This helps us improve the app experience.

Purchase Information

Subscription and purchase records are managed through Apple's App Store. We receive confirmation of your subscription status but do not have access to your payment details such as credit card numbers.

2. How We Use Your Information

We use the information we collect to:

Process your photos through AI models to generate stylized images
Manage your account and authenticate your identity
Process and verify your subscription status
Analyze usage patterns to improve app performance and features
Communicate important service updates

3. Sub-Processors (Third Parties)

We use the following sub-processors to operate Glwup. Each receives the minimum data necessary to perform its function. Several are based outside the EU/EEA — transfers to these processors are protected by Standard Contractual Clauses (SCCs) where required:

Firebase (Google, US) — authentication, account management, push notifications
AWS S3 (Amazon, US/EU) — encrypted cloud storage for your photos and generated images
Supabase (US/EU) — primary database for accounts, generations, subscriptions
Replicate (US) — AI image generation. Receives your face photos + style prompt to produce the output image. Privacy policy: replicate.com/privacy
Anthropic (US) — powers the in-app AI support chat. Receives the message you type. Does not receive your photos.
OpenAI (US) — fallback for in-app support. Receives text only.
Mixpanel (US) — anonymized usage analytics. No photos or personally identifiable content.
Adapty (US) — subscription receipt verification with Apple. Receives your Adapty profile ID and subscription status.
Resend (US) — transactional email delivery for support replies and account notifications.
Railway (US) — application hosting infrastructure.

None of these processors are permitted to use your data for their own purposes, including training general-purpose AI models on your photos.

4. Photo Handling

Your photos are uploaded to our secure cloud infrastructure (AWS S3) for AI model training and image generation. Photos are processed through our AI providers solely to deliver the service to you. We do not share your photos with any third parties except as necessary for AI processing. Your photos are never used to train general-purpose AI models or shared for advertising purposes.

5. Data Security

We implement industry-standard security measures to protect your data, including encrypted storage, secure data transmission, and access controls. While no system is perfectly secure, we take reasonable steps to safeguard your personal information.

6. Data Retention

We retain your data for as long as your account is active:

Uploaded photos and AI face model: kept until you delete your account, then erased within 30 days from primary storage and within 90 days from encrypted backups.
Generated images: kept until you delete them individually or delete your account.
Subscription records: retained for 7 years after account deletion for tax/accounting compliance (legal obligation, GDPR Art. 6(1)(c)).
Anonymized analytics: aggregated, cannot be linked back to you after account deletion.

7. Your Rights Under GDPR

If you are in the EU, UK, or another GDPR-equivalent jurisdiction, you have the following rights:

Right of access (Art. 15): in-app Profile → "Export My Data" downloads everything we hold for you as JSON. Alternatively email contact@glwupai.com.
Right to rectification (Art. 16): edit your display name, gender, and preferences in Profile.
Right to erasure (Art. 17): Profile → Delete Account permanently removes all your data.
Right to restrict processing (Art. 18): email us and we'll suspend processing while a dispute is resolved.
Right to data portability (Art. 20): the export above is machine-readable JSON.
Right to withdraw consent (Art. 7): stop using the app and delete your account. Photos are erased per the retention policy above.
Right to lodge a complaint: with the Bulgarian Commission for Personal Data Protection (cpdp.bg) or your local supervisory authority.

8. Lawful Basis for Processing

We process your data under the following GDPR lawful bases:

Consent (Art. 6(1)(a) + Art. 9(2)(a)): for biometric data (face photos and the AI model derived from them).
Contract (Art. 6(1)(b)): for delivering the subscription service you signed up for.
Legitimate interests (Art. 6(1)(f)): for anonymized analytics, fraud prevention, and improving the app.
Legal obligation (Art. 6(1)(c)): for retaining tax/billing records.

9. Children's Privacy

Glwup is rated 17+ on the App Store and is not intended for users under 16. Under GDPR Article 8, processing the personal data of a child under 16 requires parental consent in many EU member states. We do not knowingly collect data from anyone under 16. If you believe a child under 16 has provided personal information, contact us at contact@glwupai.com and we will delete it promptly.

10. International Data Transfers

Some of our sub-processors (notably Replicate, Anthropic, OpenAI, Mixpanel, and Adapty) are based in the United States. When personal data is transferred from the EEA/UK to the US, we rely on the European Commission's Standard Contractual Clauses (SCCs) as the transfer mechanism. By using Glwup, you acknowledge that your photos and generated images will be processed in the United States by these sub-processors.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes (especially to sub-processors, retention periods, or consent requirements), we will notify you through the app and ask you to re-consent where required. Your continued use of Glwup after changes are posted constitutes acceptance of the updated policy.

12. Contact Us

Questions about this Privacy Policy or to exercise any of your GDPR rights:

Email: contact@glwupai.com
Data Controller: GLOW UP AI LTD EOOD, Sofia, Bulgaria (UIC 94292446)

We respond to data subject requests within 30 days as required by GDPR Article 12.