What Photopurr collects, where it is stored, and who receives it
2026/09/14
Effective date: 2026-09-14 Version: 2026-09-14
This policy explains how Photopurr (photopurr.com, Chinese site paitumao.com) handles your personal information. It is written to meet the requirements of Japan's Act on the Protection of Personal Information.
| Item | Details |
|---|---|
| Personal information handler | Luo Jingyue (a sole proprietor based in Japan; not an incorporated company) |
| Address | Not published on the site. Provided promptly on request |
| Telephone | Not published on the site. Provided promptly on request |
| Enquiries and rights requests | [email protected] |
| Category | Details | Purpose of use |
|---|---|---|
| Account information | Email address, password hash, display name and avatar (if you sign in with Google, Google supplies your email and basic profile) | Creating and verifying your account, signing in, password recovery, service notices |
| Generation content | Your prompts, uploaded reference and person images, virtual model identities, generated images | Generating images, storing them in your library for review and download, reusing model identities as you configure |
| Billing information | Credit balance, every credit movement, purchase records (order id, amount, time, payment status) | Billing, reconciliation, credit returns, invoicing and statutory record-keeping |
| Technical information | Request timestamps, IP address, browser and device identifiers, error logs, API call records | Troubleshooting, security, preventing abuse and fraudulent use |
| Analytics | Page views, referrers, approximate region (nothing that identifies an individual) | Understanding which pages are useful, improving the product |
We do not store your password in plain text. Passwords are one-way hashed and cannot be recovered by us.
We do not use your images or prompts to train any model.
We do not use your personal information for purposes beyond those listed. If the purposes need to be broadened, we will notify you in advance and obtain any consent required.
Generating images necessarily means sending your prompts and reference images to upstream model providers — that is what the Service does. These are all the third-party processors involved (under Japanese law this is entrusted processing, not "provision to a third party", so separate consent is not sought):
| Third party | What they receive | Purpose |
|---|---|---|
| OpenAI | Prompts, reference images | Image generation |
| APIMart | Prompts, reference images | Model routing. It calls Google Gemini / Nano Banana, ByteDance Seedream, Alibaba Qwen and similar models, so your prompts and reference images are sent to the provider of the model you choose |
| Resend | Email address | Verification, password reset and service email |
| Cloudflare | Image files, requests, bot-check interactions | Object storage (R2), bot protection (Turnstile) |
| Supabase | The structured data listed in section 2 | Database hosting |
| Stripe | Email address, order amount and status | Payment collection. Card details are handled by the payment provider directly; we neither see nor store them |
| Umami | Page view records | Analytics. Self-hosted, no cookies, no identification of individuals |
We have data processing terms in place with, or accept the standard terms of, each of these processors, and supervise their handling as required.
We do not sell or rent your personal information, and we do not share it with third parties for marketing. We do not otherwise disclose it except where required by law or by valid legal process (for example a request from a court or regulator).
| Data | Location |
|---|---|
| Structured data: accounts, credits, conversations | PostgreSQL hosted by Supabase, Tokyo region (ap-northeast-1) |
| Reference images, model identities, generated images | Cloudflare R2 object storage |
Images have no public direct links. Every access requires an authenticated session or an API key; we never produce a URL that anyone holding the link can open.
To generate images and run the Service, your data is transferred outside Japan — principally to the United States (where OpenAI, Cloudflare, Supabase, Stripe and Resend operate), and to the country or region of the model provider selected when routing through APIMart. Personal information protection regimes in those countries may differ from Japan's. We rely on our contractual terms with each processor to constrain their handling.
For users in China: the Service is operated from Japan, and your account data and images are stored in Japan, not inside China. By using the Service you understand and accept this.
| Data | Retention |
|---|---|
| Transaction records (purchases, credit movements) | 7 years (Japanese requirements for keeping trading records) |
| Account information, images, conversation history | Kept while the account exists; erased within 30 days of account deletion |
| Technical logs | Kept on a rolling basis for troubleshooting and security auditing |
You can delete an individual image or conversation from your library at any time.
For the personal information we hold about you, you may request:
Email [email protected], preferably from your registered address so we can verify who you are. We will respond within a reasonable time.
There is currently no self-service deletion; please request it by email. We process requests within 30 days. Deletion also removes your images and conversation history, and cannot be undone. Transaction records are retained separately for the period in section 5 to meet statutory requirements.
Service email (verification, password reset, important changes) is necessary to provide the Service and cannot be unsubscribed from separately. If we ever start sending marketing email, we will ask for your consent separately and include an unsubscribe link in every message.
We use only necessary cookies: session state, CSRF protection, Cloudflare Turnstile bot protection, and interface preferences (theme and language). No advertising cookies, no cross-site tracking.
Analytics uses self-hosted Umami, which sets no cookies and does not identify individuals.
See the Cookie Policy for details.
The Service is not intended for anyone under 18, and people under 18 may not register or use it. We do not knowingly collect personal information from minors. If we find that we have, we delete the account and its data.
No system can be absolutely secure. If a breach occurs that may affect your rights, we will report it to the regulator as required by law and notify affected users promptly.
For any material change, we will notify you by in-site notice or email at least 7 days before it takes effect. The revised version is published on this page with an updated effective date and version number at the top.
[email protected]Related pages: Terms of Service ・ Cookie Policy ・ Notice under the Act on Specified Commercial Transactions (Japan)
If the Chinese and English versions differ, the Chinese version prevails.