Privacy Policy

1. Data we collect

1.1 Data you give us

• Email address
• Password (stored only as a cryptographic hash, never in readable form)
• Where you sign in with Google: your name and profile picture from your Google account

1.2 Data created or captured automatically

• A normalised version of your email address, used to prevent duplicate accounts
• An automatically generated username
• Whether your email address has been verified
• Registration date
• IP address
• Browser and device information (user agent)
• Session and email verification tokens
• Where you use Google sign-in: Google access and refresh tokens, and the permissions you granted

1.3 Data used to protect free credits from abuse

To stop the same person claiming free registration credits repeatedly, we keep a separate set of records in pseudonymised form, meaning the original values are transformed and are not directly readable:

• Transformed email address, Google account identifier, IP address, browser string, and network range
• The decision made on a credit request, whether granted, denied, or held for review
• The reasons for that decision, and any rule applied
• The credits issued and when

These records remain personal data under UU PDP even in transformed form, and are covered by this Policy.

1.4 Optional information

If you complete our onboarding survey, we collect your country, gender, occupation, seniority, industry, and how you heard about us. This is optional and you may skip it.

You may also add a biography and cover image to your profile.

1.5 Content you submit and generate

• Prompts and other text you enter
• Images and video you upload, including reference material
• Images and video generated for you
• Workspace, folder, and session structure

1.6 Payment data

Payments are processed by our payment provider. We receive confirmation of a transaction and its status. We do not receive or store your card number or bank details.

2. Biometric data

Some features, including Motion Control, the Image Editing Suite, and Design Board, may involve processing images you upload that contain a person’s face. Under UU PDP, biometric data is treated as specific personal data and receives stronger protection.

What we do with it. Face images you upload are transmitted to the third-party AI provider that performs the requested generation, and are stored in your workspace asset library so you can reuse them. We do not use them for identification, verification, or matching, and we do not build facial recognition profiles.

Consent. Because biometric data requires explicit consent, we ask for it separately when you create your account, alongside but distinct from your acceptance of our Terms of Service. Consent is required to use the Service. You may withdraw it at any time by contacting us at privacy@gamgen.ai, which will close your account. We keep a record of when consent was given or withdrawn.

Your responsibility. You may only upload an image containing a person’s face where you are that person, or where you have that person’s explicit permission. Our Terms of Service and Acceptable Use Policy set out this obligation in full.

If your likeness has been used without your consent. You do not need a Gamgen account to contact us. Write to abuse@gamgen.ai and we will remove the content and any copies. Where the report concerns intimate imagery, we act within 48 hours.

Retention. Images containing faces are currently retained on the same basis as other uploaded material, described in section 8: they remain in your workspace asset library until you delete them, and deleting an asset removes the underlying file from our storage. You can delete any uploaded image at any time. We are introducing a defined retention limit for images containing faces and will update this Policy when it takes effect.

3. Why we process your data, and on what basis

Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect processing carried out before withdrawal, and may mean you can no longer use the feature concerned.

We do not use your data, your uploads, or your generated content to train AI models. We do not sell your personal data, and we do not share it for third-party advertising.

4. Who we share data with

We use the following categories of service provider. Each processes data only as needed to provide their service to us.

We use several third-party AI providers to run generation requests. Which one handles a given request depends on the model you select. These providers act as processors on our behalf and are not permitted to use your data for their own purposes.

We may also disclose personal data where required by law, court order, or a valid request from a competent authority, and where necessary to investigate a serious violation of our Acceptable Use Policy or to protect someone from harm.

If our business is transferred through a merger, acquisition, or sale of assets, personal data may transfer as part of it. We will notify you before that happens.

Business customers who require a named list of our processors as part of a data processing agreement can request one at privacy@gamgen.ai.

5. International transfers

Our infrastructure runs in Singapore. Our AI model providers, analytics, and error monitoring services operate from various countries.

This means your personal data is transferred outside Indonesia. Where we transfer personal data internationally, we take steps to ensure it receives an adequate level of protection, including contractual safeguards with the recipient.

We transfer personal data internationally on the basis of contractual safeguards agreed with each recipient, as permitted under UU PDP.

6. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your preferences, keep the Service secure, and understand how it is used.

We use analytics services to understand usage patterns in aggregate, and error monitoring services that capture technical information when a fault occurs so we can diagnose it.

When you first visit the Service, we ask for your choice on non-essential cookies. You can change that choice at any time through our cookie settings, and you can also control cookies through your browser. Essential cookies are required to sign in and cannot be disabled without preventing access to your account.

7. Security

We protect personal data using access controls, encryption in transit, and the security measures provided by our infrastructure providers. Passwords are stored as cryptographic hashes.

No system is completely secure. If a personal data breach occurs that risks harm to you, we will notify you and the relevant authority within 3 x 24 hours as required under UU PDP.

8. How long we keep data

Account data is kept while your account is active.

Assets, including uploaded and generated images and video, are kept while they remain in your workspace. When you delete an asset, the underlying file is deleted from our storage.

Account deletion. When you delete your account, your personal data is removed from our database, and your stored files are deleted from storage.

Workspace deletion. When a workspace is deleted, its records and its stored files are deleted.

Abuse prevention records. The pseudonymised records described in section 1.3 are retained for one month after account deletion, to prevent an account being deleted and immediately recreated to claim free credits again. This is the minimum data needed for that purpose.

Legal and financial records. Transaction records are retained for as long as required by Indonesian tax and accounting law.

Data held by our providers. Deletion in our systems does not automatically delete data held by third parties such as our payment provider, where they retain records under their own legal obligations.

9. Your rights

Under UU PDP you have the right to:

• Be informed about how your personal data is processed
• Access your personal data and obtain a copy
• Correct inaccurate or incomplete data
• Delete your personal data
• Withdraw consent where processing is based on consent
• Object to processing based on legitimate interest
• Restrict processing in certain circumstances
• Receive your data in a portable format and transmit it elsewhere
• Lodge a complaint and seek compensation for a breach

Some of these can be exercised directly in the Service through your account settings. For anything else, contact us at privacy@gamgen.ai. We will respond within 30 days.

We may need to verify your identity before acting on a request, to make sure we are not disclosing or deleting someone else’s data.

10. Children

The Service is not intended for anyone under 18 years old. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy. Where changes are material, we will notify you through the Service or by email before they take effect.

12. Contact

For questions about this Policy or to exercise your rights:

Data protection enquiries: privacy@gamgen.ai
Reporting misuse of your likeness: abuse@gamgen.ai

PT Sinapsis Teknologi Asia
Jalan Siaga Raya No. 77M, Komplek 77, Kelurahan Pejaten Barat, Kecamatan Pasar Minggu, Kota Administrasi Jakarta Selatan, Provinsi DKI Jakarta 12510, Indonesia