1. Who is responsible for your data
Two companies sell the service (see the Terms). Each is the controller of the data of its own customers:
- Card customers (euros and US dollars) and users outside Brazil: [Mogra Oy legal name], business ID [Y-tunnus], [registered address], Finland.
- Pix customers (reais) and users in Brazil: [razão social], CNPJ [CNPJ], [endereço], Brazil.
Data protection contact (LGPD encarregado and GDPR contact): [name], [privacy email].
To confirm: Lawyer: confirm the controller for accounts that have not bought anything yet, and whether the two companies are joint controllers for the shared platform.
2. What we collect
- Account: your email, the name you give, your language and theme, the date you joined, your plan.
- Login and security: one-time login codes, sessions, IP address and browser information, and a log of important account and payment events.
- Payments: plan, amounts, currency, dates, status and receipts. For Pix: name, CPF or CNPJ, email, phone and address, which the NFS-e needs. Card numbers go straight to Stripe; we never see or store them.
- Your content: pictures you upload, projects, prompts, marks you draw and the pictures the AI tools make.
- AI use: which tools and models you ran, when, their credits and our cost.
- Your own OpenRouter key, if you connect one: stored encrypted.
- Messages you send us, for example support emails.
We do not sell your data and we do not use your content to train AI models.
3. Why we use it, and on what legal basis
- To give you the service you signed up for: account, projects, storage, AI tools, credits. Basis: performing our contract with you (LGPD art. 7, V; GDPR art. 6(1)(b)).
- To charge you, issue invoices and NFS-e and keep accounting records. Basis: contract and legal obligations (LGPD art. 7, II and V; GDPR art. 6(1)(b) and (c)).
- To keep the service safe: login codes, fraud and trial abuse checks, spending limits, audit log. Basis: legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)).
- To send emails about your account, plan and payments. Basis: contract.
- To improve the service from aggregated, non-identifying usage figures. Basis: legitimate interest.
- News and offers by email only if you agree, and you can stop them at any time. Basis: consent (LGPD art. 7, I; GDPR art. 6(1)(a)).
4. Who processes data for us
These companies process data on our behalf, under contracts that limit them to our instructions:
- Convex: database and back end (accounts, projects, payments records, logs). [Region to confirm.]
- Vercel: hosting of the website.
- Resend: sending login codes and account emails.
- Bunny.net: storage and delivery of your files, in Frankfurt (Germany) with a copy in São Paulo (Brazil).
- Stripe: card payments, receipts and the customer portal (for Mogra).
- Woovi: Pix payments, Pix Automático and NFS-e (for the Brazilian company).
- OpenRouter: passes your Enhance requests (picture, prompt, marks) to the chosen image model, for example ByteDance Seedream.
- Replicate: runs Remove background, Upscale and Boost quality on your pictures.
We may also share data when the law requires it, for example with tax authorities or a court.
5. International transfers
Some of these companies are in the United States or other countries outside Brazil and the EU. When data leaves the EU, we rely on the EU–US Data Privacy Framework where the company is certified, or on the European Commission's standard contractual clauses. When data leaves Brazil, we rely on the standard contractual clauses of the ANPD (Resolution CD/ANPD 19/2024) or another basis of LGPD art. 33.
To confirm: Lawyer: check each processor's data processing agreement and transfer mechanism.
6. How long we keep it
- Account and content: while your account exists. When you delete your account, it is closed at once and your pictures and files are removed from storage within 7 days.
- Archived projects of a deleted account (their settings and history, including prompts and marks): kept for [period, to decide] so the account can be restored if you ask us, then deleted.
- Your email address and the record that the account was deleted: kept for [period, to decide], so the same email cannot start a second free trial. Basis: legitimate interest in preventing trial abuse (LGPD art. 7, IX; GDPR art. 6(1)(f)). You can object to this; see Your rights.
- Payments, invoices and NFS-e: as long as tax and accounting laws require, even after you delete the account ([5 years in Brazil; up to 10 years in Finland], to confirm).
- Security and audit logs: [12 months], unless needed for a dispute.
- Login codes: until used or expired.
To confirm: Lawyer: confirm the retention periods for archived projects and for the email kept after deletion (trial abuse), and whether keeping the email needs a shorter period or a hash instead. Today the code keeps both with no end date (no purge job yet).
7. Your rights
Under the LGPD (art. 18) and the GDPR you can ask us to: confirm whether we process your data; give you access to it or a copy you can take elsewhere; correct it; delete, anonymise or block data that is unnecessary or processed unlawfully; tell you who we shared it with; and stop processing based on your consent. Under the GDPR you can also object to processing based on legitimate interest and ask us to restrict processing.
Write to [privacy email]. We answer within 15 days (LGPD) or one month (GDPR). You can also complain to the data protection authority: the ANPD in Brazil, or the Finnish Data Protection Ombudsman or the authority of your EU country.
Much of this you can do yourself in Account: change your details, download your pictures, disconnect your OpenRouter key and delete your account.
8. Security
Connections are encrypted (HTTPS). Your OpenRouter key is encrypted at rest. Files are served only through signed links that expire. Access to production data is limited to the people who run the service, and important changes are recorded in an audit log.
10. Children
The service is not meant for people under 18, and we do not knowingly collect their data.
11. Changes and contact
If we change this policy in a way that matters, we email you before it applies. Questions: [privacy email].