Skip to content
Yumeforge

Privacy policy

Last updated
This policy explains which personal data Yumeforge processes, why, and what rights you have. We collect as little as we can and never sell your data.

Who is responsible

The controller for your personal data is Zornyx Studio, De Nieuwe Erven 3, Unit 151102, 5431 NV Cuijk, Netherlands, KvK 42140443. For any privacy question or request, email support@yumeforge.com.

What data we process

  • Account data: email address, name (optional), a secure hash of your password, the date you accepted our terms, your role and credit balance, and your email settings, including whether and when you subscribed to our newsletter.
  • Security data: your login sessions, and if you turn on two-step login, the secret key of your authenticator app and hashed recovery codes (see below).
  • Billing details (optional): the name or company, address, country and VAT number you enter for your invoices, and the invoices themselves.
  • Profile data (optional): your handle, profile picture and bio, and whether your profile is public.
  • Community data: which results you liked, which profiles you follow, and which results you entered in challenges.
  • Content: the files you upload, the prompts and settings you use, the characters, products and styles you save, and the results you generate.
  • Marketplace, reviews and rewards: templates you sell or buy, ratings and reviews you write, daily bonus claims, streaks and badges.
  • Developer and affiliate data: your API keys (stored as a hash only), and if you join the affiliate program, your payout details and earnings.
  • Payment data: which pack, plan or gift card you bought, the amount, the date and the payment or invoice reference, the status of your monthly plan, and which gift cards and promo codes you redeemed. Your card or bank details are handled by Stripe; we don't see or store them.
  • Technical data: IP address, browser type, and logs of requests, used to keep the service secure and to prevent abuse such as mass account creation.
  • Messages: what you send us when you contact support or report content.
  • Browser notifications: if you turn on push notifications, the push address of your browser and its keys.

Cookies and the app

  • Login cookie: one strictly necessary cookie keeps you logged in.
  • Invite cookie ("yf_ref"): if you open Yumeforge through a friend's invite link, we store their invite code in a cookie for 30 days. We use it only to credit the friend who invited you when you sign up. It holds no other information and is deleted after 30 days. Share links you copy from a result carry the same invite code and use the same cookie.
  • Affiliate cookie ("yf_aff"): if you open Yumeforge through an affiliate's link, we store the affiliate's code in a cookie for 30 days. If you then create an account, we record which affiliate brought you in, so we can pay them a commission. The first link you opened counts. It holds no other information.
  • Installable app: you can install Yumeforge as an app on your phone or computer. It uses a service worker that caches only static files, such as icons, styles and an offline page, so it opens faster, and shows push notifications if you turned them on. It never stores your account data, prompts or results on your device.

We don't use advertising or tracking cookies. If you add analytics later, update this section and, where needed, ask for consent.

Sharing to Explore

Your results are private by default. Only results you choose to share, or enter in a challenge, appear on the public Explore page, together with the prompt and the name of the model you used. They are shown anonymously, unless you turned on a public profile (see below). We never show your name or email address with them. You can stop sharing a result at any time from your library, and it disappears from Explore straight away. We may also take shared results off Explore, for example when they break our rules.

Public profile, likes and follows

Your profile is off by default. If you turn on a public profile, anyone can see:

  • your handle, profile picture and bio;
  • how many followers you have and how many public profiles you follow;
  • your shared results and challenge entries, how many there are and how many likes they received;
  • your handle next to your shared results and challenge entries, including on leaderboards.

When you like a result or follow a profile, we store that. Others only see the total number of likes and followers, not who gave them. If you turn your public profile off, your results become anonymous again and your profile page disappears. We may hide a profile or remove a handle, bio or picture that breaks our rules.

Challenges

When you enter a result in a challenge, it becomes public on Explore and on the challenge page, with your handle if you have a public profile, and anonymously otherwise. To rank entries we count the likes each entry received before the end time. Prizes are booked as bonus credits in your credit history. Winners are shown by their entry; we never show a winner's name or email address.

Featuring on our website and social media

When you create an image or video you can tick the box that allows us to feature it. If you do, the result and its prompt may appear in the community feed on our homepage, on our Featured page, on Yumeforge's social media accounts and in our marketing. Your handle is only mentioned if you have a public profile; otherwise the result is shown without your name. We never show your name or email address. If your result is picked as the favourite of the week, we email you and add the prize to your credit history.

You can withdraw permission for a result at any time in your library. It then disappears from our website, we stop using it for new posts, and on request we make a reasonable effort to remove existing posts. Social media platforms such as Instagram have their own privacy policies, which apply to what they do with posts and to your use of their service.

Gift cards

When you buy a gift card, you can enter the recipient's email address and a personal message. We send these to Stripe with the payment, as payment details (metadata). After payment we use them once to email the code to the recipient through our email provider; the buyer gets a copy of the code too. Only enter the email address of someone who expects a gift from you. We keep a record of the gift card, who bought it and who redeemed it.

Invites

When you invite a friend, we record which account invited which, so we can give you both the invite reward after their first purchase. To stop abuse we compare the network the sign-up came from; invites from the same network don't count. Your friend doesn't see your email address, and you only see how many friends joined, not who they are.

Waitlists (Academy and desktop app)

If you join the Academy or desktop app waitlist, we store your email address, the courses you picked and the network you signed up from (to stop automated sign-ups). We only use it to tell you when the Academy or the app is available, and delete it when the list is no longer needed or when you ask us to.

Emails and the newsletter

  • Service emails: we send emails you need to use Yumeforge, such as a welcome email, password resets, receipts, gift card codes, replies to support tickets and security emails. When it is on, we also email you when a long video or a batch is ready, and once a month at most when your credits run low after you bought before. You can turn those job and low-credit emails off on your account page.
  • Newsletter: off by default. We only send news, tips and our weekly digest if you ticked the box when you signed up or turned it on in your account. We store that you agreed and when. Every newsletter has an unsubscribe link, and most email apps show an unsubscribe button too; one click is enough. You can also turn it off on your account page. On the unsubscribe page you can choose to stop all emails we can stop, including job emails.
  • To avoid sending the same email twice, we keep a short log of which automatic email went to which account, and when.

Push notifications

You can turn on push notifications on your account page, per browser. Your browser asks for permission first. We then store the push address (endpoint) and the encryption keys your browser gives us, linked to your account. We use them only to tell you that a result or a batch is ready or could not finish. The notification is delivered through the push service of your browser maker, for example Google, Apple, Mozilla or Microsoft; it carries a short title and text, never your prompt or your result. Turn it off in your account or your browser settings. We delete the address when you turn it off or when your browser tells us it is no longer valid.

Separately, while the studio is open in a background tab, your browser can show a notification itself. That stays on your device.

Two-step login and sessions

  • Sessions: each time you log in we create a session. We store only a hash of the session token, when it was created and when it ends; no device or location details. On the Security page you see your active sessions and can log out all other devices.
  • Two-step login: if you turn it on, we store the secret key that your authenticator app also holds, and your recovery codes as a hash only. A used recovery code is removed. During a login we briefly keep a short-lived record of the pending second step.
  • Security emails: we email you when two-step login is turned on or off, and when a recovery code was used to log in.

Invoices and billing details

We make an invoice for every paid payment, with an invoice number, the amount and the VAT. If you are a business, you can add a name or company, an address, a country and a VAT number on the Invoices page; we show them on your invoices. We only check that a VAT number looks right; we don't look it up. Tax law requires us to keep invoices and payment records for 7 years.

Saved characters, products and styles

You can save sets of your own pictures with a name and a short description, to reuse them in any model. We store them with your account until you delete them or close your account. Only you can see them.

Uploaded video and audio

When you add a video or audio file to a tool that is priced per second, we read the length of the file, to set the price and check the maximum length. We read only the technical data needed for that, not what is in the file.

Marketplace

If you sell a template, we store the template (title, description, tags, model, prompt and settings) and the result you chose as its preview. When it is published, others see the template and the preview, with your handle if you have a public profile, and anonymously otherwise. We record who bought which template, the price and the platform fee. Sellers don't see who bought their template, only the number of sales. Our team reviews templates before they go live and may write a note on a template.

Ratings and reviews

You can rate a model you used, with stars and an optional short review. Reviews are public on the model page. They show your handle only if you have a public profile; otherwise they say "Verified creator". We never show your name or email address. You can change or delete your review. We may hide a review that breaks our rules.

Daily bonus, streaks and badges

When you claim the daily bonus, we store the day you claimed and your streak, and book the credits in your credit history. We also record the badges you earn and when. To stop abuse, we only let accounts that are at least a day old and have made something or bought credits claim the bonus.

Affiliate program

If you apply as an affiliate, we store your affiliate code, your status and commission rate, the payout email and the note you give us, your earnings and your payout requests. For customers who sign up through an affiliate link, we record which affiliate brought them in, and for 12 months after sign-up we calculate a commission on their payments. Affiliates see their number of sign-ups and the amounts they earn, but never who the customers are. To stop abuse, we compare the network a sign-up came from with the affiliate's. We use payout details only to pay you, by bank transfer or PayPal.

API keys

If you create an API key, we show the full key once and then store only a hash of it, with its name, its first characters (so you can recognise it), when you created it and when it was last used. Jobs you start through the API are stored like any other generation. A revoked key stops working at once.

Support tickets

When you contact us through the help center, we store your ticket: your email address, the topic, the subject, your messages and our replies, and the result you linked, if any. We use it to help you and to improve the service. We keep a ticket while it is open and for a reasonable period after it is resolved, in case you come back to it.

Why we use it, and on which legal basis

  • To provide the service (your account, running generations, storing results, handling payments): performance of our contract with you, Article 6(1)(b) GDPR.
  • To keep records for tax and accounting: legal obligation, Article 6(1)(c) GDPR.
  • To prevent fraud and abuse, keep the service secure and enforce our content rules, including checking prompts against blocked terms and handling reports: our legitimate interest, Article 6(1)(f) GDPR.
  • To report illegal content such as child sexual abuse material to the authorities: legal obligation and legitimate interest.
  • To show results you shared on Explore or allowed us to feature, your public profile, likes, follows and challenge entries, and to run the invite programme, challenges and the weekly social media pick: performance of the contract, at your request.
  • To deliver a gift card to the recipient you named: performance of the contract with the buyer, and our legitimate interest in delivering the gift the buyer paid for.
  • To run the marketplace, reviews, the daily bonus and badges, saved characters, API keys, two-step login and the affiliate program, and to answer support tickets: performance of the contract, at your request.
  • To send service emails and push notifications such as password resets, receipts, security emails and, if you turned them on, messages when a result is ready: performance of the contract. Security emails also serve our legitimate interest in keeping accounts safe.
  • To send the newsletter and weekly digest: your consent, Article 6(1)(a) GDPR. You can withdraw it at any time with one click; that doesn't affect emails we sent before.

We don't make decisions about you that have legal or similarly significant effects based solely on automated processing. Automatic checks can block a prompt; you can always contact us about it.

Who processes data for us

We use carefully chosen service providers (processors) that only act on our instructions, under a data processing agreement:

  • Hosting and storage: Vercel Inc. (United States) hosts the website and stores copies of your results; a managed database provider stores the database. Name your database provider and the regions you use.
  • Payments: Stripe Payments Europe Ltd. (Ireland) processes payments, monthly plans and the billing portal where you manage your plan. We give Stripe your email address, your name if you entered one, and an account reference; for gift cards also the recipient's email address and your message. For fraud prevention and its legal obligations Stripe also acts as an independent controller.
  • AI model providers: to create a result, your prompt and any files you add are sent to the provider that runs the model you chose, and the result is sent back. The same goes for the safety checks on prompts, uploads and results, and for Improve prompt. Providers may only use this data to process your request. List the AI infrastructure providers you use.
  • Email delivery: Resend (United States) sends our service emails, security emails and the newsletter. It receives your email address, your name if you entered one, and the content of the email.
  • Push services of browser makers: if you turn on push notifications, the short notification text goes through the push service of your browser (for example Google, Apple, Mozilla or Microsoft). These companies run that service under their own terms.
  • Payouts: if you are an affiliate, we pay you by bank transfer or PayPal. The bank or PayPal receives the payout details you gave us and the amount.

Some of these providers are located outside the European Economic Area, for example in the United States or China. We only transfer data there with appropriate safeguards, such as an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses. Email us for a copy of the safeguards.

How long we keep data

  • Account and profile data: as long as your account exists. After you close your account we delete it within 30 days. Closing your account also cancels your monthly plan.
  • Uploads, saved characters, products and styles, and results you keep: until you delete them or close your account. We don't remove uploads or results you keep after a set time.
  • Results you deleted: removed from your library straight away, and the files and records are erased about 30 days later. Failed generations are erased after 30 days. We keep a deleted result longer only while it is needed for a report, an open support ticket or a template preview.
  • Likes you gave, likes on your results, follows (both ways), reviews, badges, and the gift cards and promo codes you redeemed: until you remove them or close your account.
  • Newsletter consent: until you unsubscribe. The record of which automatic emails we sent: as long as your account exists.
  • Push addresses: until you turn push off, your browser drops them, or you close your account.
  • Sessions: until they end or you log out. Two-step login data: until you turn it off. API keys: until you revoke them or close your account.
  • Payment and invoice records, including billing details on invoices, plan invoices, gift card purchases, marketplace sales and affiliate payouts: 7 years, as Dutch tax law requires, also after you close your account.
  • Support tickets: while open, and for a reasonable period after they are resolved.
  • Security logs: up to 6 months, unless needed longer to investigate abuse.
  • Reports and moderation decisions: as long as needed to handle them and to defend legal claims.

Your rights

You have the right to:

  • access your data and get a copy (you can download an export from your account page);
  • correct wrong data;
  • have your data deleted (you can close your account yourself);
  • restrict processing, or object to processing based on our legitimate interest;
  • receive your data in a machine-readable format (data portability);
  • withdraw consent you gave, at any time.

Email support@yumeforge.com to use these rights. We reply within one month. We may ask you to confirm your identity first.

Complaints

If you're not happy with how we handle your data, please tell us first. You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or to the supervisory authority in the EU country where you live.

Security

We protect your data with encryption in transit, hashed passwords, session tokens, recovery codes and API keys, optional two-step login, access controls and regular updates. If a data breach puts your rights at risk, we will tell you and the authority as the law requires.

Children

Yumeforge is only for people aged 18 and over. We don't knowingly process data of children.

Changes

We may update this policy. The date at the top shows the latest version; we announce important changes by email.