Privacy Policy

Who we are

PHORM (phorm.to) is operated by Individual Entrepreneur "Phorm," registered in the Republic of Kazakhstan, IIN 000725500103, address: 24 Tulebayev St., apt. 25, Almaty, Republic of Kazakhstan. Questions about this policy and your data: [email protected].

What we collect

Your account details: email address and a hashed password — we never store passwords in plain text. If you sign in with Google, we receive your name, email address, and Google account identifier from Google instead of a password. The content you give us to work on: photos you upload (which may show you or other people), text descriptions you type, and mesh files you send for repair. What the Service produces for you: AI photos, generated models, repair reports, printability verdicts. Billing events: your plan, model and photo balance, purchases, and refunds. Payments themselves are handled by our online reseller and merchant of record, Dodo Payments (Dodo Payments Inc. and its affiliates) — card numbers never reach our servers. Gallery activity: the gallery models you like, save, and download. Usage analytics: pages visited, the plans and model packs you are shown and choose, generations started and finished, errors — and, with your consent where the law requires it, recordings of how you move through the site (pages, clicks, and scrolling), in which your photos, models, email address, and everything you type are hidden. Technical data: IP address and browser information, used for security and to keep the Service running. Support correspondence: what you write to us and our replies. Consent records: which version of our documents you accepted, when, and from which IP address. Where you came from: when you create an account, the tags of the link that first brought you to the site (such as utm_source), the domain of the website that sent you (never its full address), the page you arrived on, and the invitation or promo code you used; your answers to the two optional questions after registration (how you heard about PHORM and what describes you); and the links to posts you send us for a reward (Terms §5.10).

What we use it for

Running the Service: your photos and descriptions are sent to our compute providers only to create the photo or model you asked for or, when you engrave text from a photo, to read that text from a cropped part of your photo; they are also checked by automatic moderation (see "Safety"). Billing: keeping your balance and purchase history correct. Safety: uploaded images, text descriptions, and AI photos pass automatic moderation before any 3D generation starts, uploaded 3D files are checked (by their previews) before they are repaired, and AI photos are checked before they are shown to you; blocked attempts are logged with the reason. Improving the product: aggregated usage analytics and aggregated, de-identified operational data (mesh statistics, validation outcomes, error rates) — this data does not include your images or models. Session recordings show us where the site gets in people's way; they are used for nothing else. Where you came from: to learn which channels and partners bring people to PHORM, to count what each partner brought, and to credit the rewards of our Terms (§5.10) and prevent their abuse. We do not sell personal data and we do not show ads.

Photos of people

A photo of a person is that person's personal data. We use it only to make the model or photo you asked for, to read engraving text from a part of the photo you select, and to run moderation. We do not try to find out who the people in photos are and do not keep face or other biometric data. If a photo shows someone other than you, you confirm under our Terms (§8.3) that they agreed — or, for a child, that you are their parent or legal guardian. If you are shown in a photo someone else uploaded, or your child is, write to [email protected] — you do not need an account: we disable access to it within 2 business days and then delete the photo and everything made from it.

Sensitive data

Please do not upload identity documents, medical images, or other sensitive personal data; we do not knowingly process such data and will delete it if we find it.

Security

Data is encrypted in transit; passwords are stored only as hashes; access to production data is limited to the people who need it to operate the Service; download links to your models are private to your account and expire after a short time (share links you create work as described under "Your results are private"). No system is perfectly secure — if a breach affects your data, we notify you and the competent authorities as the law requires.

Training

We do not use your uploads or results to train machine-learning models. Content can be used for training only if you explicitly opt in to a voluntary data-sharing programme: opting in is off by default and revocable at any time with effect for the future.

Your results are private

On every plan, your photos and models are visible only to you, and we do not publish them. If you create a share link to a model, anyone with that link can view it in 3D, and anyone signed in to PHORM can download it, until you stop sharing or delete the model; share links are kept out of search engines. The models in the gallery and the examples elsewhere on our website are our own; the gallery shows only totals of likes, saves, and downloads, never who made them.

Invitations and promo codes

If you joined through someone's invitation link, the person who invited you sees in their account that an account joined through it — shown as a partly hidden email address (for example, m***@gmail.com) — when, and whether the reward for your first payment (a plan or a model pack) was credited or later removed. If you used a partner's promo code, your account, its first payment, and what it paid count in our figures for that partner; the partner receives only totals, never your email address or other details.

Who else touches your data

Generation compute: your photos and descriptions are sent to providers of AI models — including API platforms that run models developed by other companies — for 3D generation, image generation and editing, background removal, upscaling, object detection, and reading text from photos for engraving, and to backup providers of the same kind that take over when the main one is unavailable. Each of them processes your data to perform your request under its own terms. The current list of these providers is available on request at [email protected]. Moderation: uploaded images, previews of uploaded 3D files, text descriptions, and AI photos may also be checked by an automated content-moderation provider. Payments: Dodo Payments, our online reseller and merchant of record, handles checkout, invoices, taxes, refunds, and order-related inquiries under its own privacy policy. Infrastructure: DigitalOcean (servers and file storage) and Cloudflare (delivery, security, and cookie-free web analytics). Sign-in: Google, if you choose Sign in with Google. Analytics: Google Analytics 4 (Google) and PostHog (PostHog Inc.; product analytics and session recordings), only with your consent where the law requires it. PostHog knows a signed-in user by their account number, never by name or email address, and uses the IP address only to work out the country — it does not keep it. Email: service messages (purchase confirmations, reminders, and notices about your plan, such as a pack about to expire or an upcoming renewal) are sent through an email delivery provider. We do not send marketing email without your consent.

Where your data goes

We are based in Kazakhstan, and the recipients above operate outside the EU and UK, including in the United States; some AI model providers may process data in other countries, which are named in the provider list available on request. Transfers rely on the EU–US Data Privacy Framework (and its UK Extension) where a US recipient is certified, and otherwise on Standard Contractual Clauses (with the UK Addendum) or the recipient's data-processing terms. By registering, you consent to the processing of your personal data as described in this Policy, including its transfer to the recipients described above, as the law of Kazakhstan requires. For users in the EU and the UK, the legal bases are those listed under "Your rights", and transfers rely on the safeguards described in this paragraph.

How long we keep your files

Retention follows the plan you were on at the moment of generation: Free — 30 days, Hobby — 3 months, Maker — 12 months, Studio — 24 months; a model generated from a model pack — 12 months, or longer if your plan keeps it longer. A model you save from the gallery is kept while it remains in the gallery. Photos, text descriptions, and files you upload are kept as long as the model or photo made from them and are deleted with it; uploads that do not lead to a result are deleted after 30 days. Downgrading or cancelling does not shorten the retention of files you already generated. You can download your models and delete any of your files yourself at any time; AI photos and other prepared images are kept in your library but are not offered for download as separate files (a copy is included in a data export on request — see "Your rights"). Unsaved work in the editor is not part of your history.

How long we keep other data

Account data (email address, plan, balance, generation log) — while your account exists and for 30 days after closure; an account with no paid subscription, no files still within their retention period, and no sign-in for 18 months may be closed after notice (Terms §14). Billing records — as long as tax and accounting law requires. Analytics data — up to 14 months in Google Analytics and up to 7 years in PostHog; we delete a person's PostHog data when their account is deleted, or earlier on request ([email protected]); session recordings — up to 30 days. Where you came from, your answers to the questions after registration, invitation and promo-code records, and the links you send for a reward — while your account exists and for 30 days after closure. Your gallery likes, saves, and downloads — while your account exists and for 30 days after closure. Consent records — while your account exists and for as long afterwards as we may need them to show that consent was given. Security, moderation, and server logs — up to 12 months. Support correspondence — up to 2 years after the conversation ends.

When you close your account

A 30-day timer starts; after it, your files and personal data are deleted, and the deletion is logged. Billing records, consent records, logs, and support correspondence are kept for the periods listed above.

Your rights

You can request access to your data, correction, deletion, restriction of processing, or a copy in a portable format — write to [email protected]; we answer within one month. For EU and UK users: our legal bases are contract (running the Service you signed up for, billing, and handling withdrawal and refund requests, and the gallery features you use), legitimate interest (security, moderation, cookie-free product analytics, learning where people come from and preventing abuse of rewards, and processing photos of people other than you, whose consent — or, for your child, your authority as parent or guardian — you confirm under our Terms), legal obligation (tax and accounting records), and consent (analytics cookies — Google Analytics and PostHog, including session recordings — keeping the record of your first visit in your browser before you register, the optional questions after registration, and the voluntary data-sharing programme). Crediting invitation, promo-code, and "Share your print" rewards is part of the contract. You can withdraw consent at any time, and you can complain to your local supervisory authority.

Automated checks

Moderation and the printability check run automatically. Suspending or closing an account for a breach of the Terms is always decided by a person, and you can ask for any automated decision to be reviewed by writing to [email protected].

Right to object

Where we process your data on the basis of legitimate interests, you can object at any time — write to [email protected] — and we will stop unless we have compelling legitimate grounds to continue.

Cookies

Essential cookies and local storage keep you signed in and the site secure. Analytics cookies are optional; in the EU, the EEA, the UK, and Switzerland we ask before setting them. We do not use third-party advertising cookies. Details and choices: /cookies/.

Age

PHORM is for adults: you confirm you are 18 or older when you register. If we learn an account belongs to a person under 18, we close it and delete the associated data. A parent or legal guardian may upload a photo of their child under the rules in "Photos of people" above; the child is not a user of the Service.

Changes

We date every version of this policy and notify you by email about material changes.