Privacy Policy

The data controller responsible for the processing of your personal data within the meaning of Art. 4 (7) GDPR is:

Dovydas Jakstas (sole trader)
Hedwig-Porschütz-Straße 11
10557 Berlin
Germany
Email: hello@chamolist.com

We process the following categories of personal data:

• Account & profile data — email address, optional display name, authentication identifiers from Apple if you use Sign in with Apple, the credit balance on your account.
• Photos you upload — the original images you bring into a batch (raw uploads), the background-removed cutouts we generate, and the final composited images. All photos are stored under your account in Firebase Storage and are not visible to other users.
• Custom content — any custom template backgrounds you upload, branding logo files, and the configuration you choose for them (position, opacity).
• Generated outputs — final images we produce from your inputs, including AI-generated scenes.
• Usage & device data — feature usage, model selections, generation counts, app version, device model and OS version, anonymised IP address.
• Purchase history — credit-pack purchases (productId, transaction or session ID, amount, currency, timestamp). Card details are processed by Apple or Stripe; we never see them.
• Diagnostic data — crash reports and non-fatal error events including a hashed user ID and the call-site context, used to detect and fix bugs.

• To operate the service and deliver the features you request — Art. 6 (1) (b) GDPR (performance of contract).
• To process credit-pack purchases — Art. 6 (1) (b) GDPR.
• To detect, prevent, and address fraud, abuse, and security incidents — Art. 6 (1) (f) GDPR (legitimate interest).
• To improve product quality through anonymised analytics and crash reporting — Art. 6 (1) (f) GDPR.
• To comply with legal obligations, including tax-law retention of purchase records — Art. 6 (1) (c) GDPR.

Your uploaded photos and generated outputs are never used to train AI models, by us or by our processors. AI calls forward your image at request time only; processors do not retain it beyond the response.

We rely on the following service providers, each bound by a data-processing agreement:

• Google Firebase (Google Ireland Ltd.) — authentication, database, file storage, analytics, crash reporting, hosting.
• Apple (Apple Distribution International Ltd.) — Sign in with Apple, App Store in-app purchase verification.
• Stripe (Stripe Payments Europe Ltd.) — web credit-pack payments only.
• AI processing partners — background removal and AI scene generation. Photos are sent at request time only and are not retained beyond the response.

Some of our processors are based outside the European Economic Area, primarily in the United States. Transfers rely on the European Commission's Standard Contractual Clauses (Art. 46 GDPR) and, where available, the EU–US Data Privacy Framework (adequacy decision of 10 July 2023).

• Account, photos, generated outputs, and credit balance: retained while your account is active. Deleted within 30 days after you delete your account in-app.
• Purchase records: retained for 10 years per German tax law (§ 147 AO).
• Crash and diagnostic logs: retained for 90 days.

Under GDPR you have the right to:

• Access the personal data we hold about you (Art. 15).
• Request rectification of inaccurate data (Art. 16).
• Request erasure (Art. 17). You can also delete your account directly from Settings.
• Restrict or object to processing (Arts. 18 & 21).
• Receive your data in a portable format (Art. 20).
• Withdraw consent at any time, where processing is based on consent.

Submit requests to hello@chamolist.com. We respond within 30 days.

You may lodge a complaint with the supervisory authority for the controller's establishment:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstraße 219, 10969 Berlin
www.datenschutz-berlin.de