Privacy Policy

This Privacy Policy explains how gorm the old LLC collects, uses, stores, and shares data for Gorm Studio and Gorm University.

1) Notice at collection
We collect identifiers (name/email/account ID), internet and device data (IP address, user agent, session and security logs), payment and subscription records, prompts and AI request metadata, user-uploaded files, generated media, and moderation/reporting submissions. We use this data to provide the service, process payments, prevent abuse and fraud, enforce policies, and comply with legal obligations.

2) Data categories and purposes
Account and profile data is used for authentication, access control, and customer support. Billing records are used for subscription management, invoicing, tax handling, and dispute response. Prompts/uploads/outputs are used to fulfill generation requests and provide user history features. Security and usage logs are used for reliability, abuse prevention, and incident response.

3) Processors and sharing
We disclose relevant data to service providers only as needed to run the product:

• Supabase: account authentication, database records, and user/access state.
• Stripe: payment processing, subscriptions, invoices, and billing portal management.
• Cloudflare/R2: uploaded and generated media storage, secure asset delivery, and edge protection.
• OpenAI: processing prompts and related request metadata for text and image generation.
• AtlasCloud (or successor video model provider): processing prompts and generation metadata for video outputs.
• Hosting/infrastructure providers: app hosting, operational logs, and uptime/security monitoring.
• Support email provider: handling user support and legal/privacy requests sent to our contact inbox.

We do not sell personal data.

4) Cookies and local storage
We use essential cookies/session tokens for login and security. We may store draft/workspace state in local storage to preserve your in-progress work.

5) Retention
Data is retained for as long as needed for account operation, subscription records, legal compliance, fraud/security response, and dispute resolution. Uploaded/generated assets remain until deleted by the user or removed under policy.

6) Your privacy rights
Depending on your location, you may request access, correction, deletion, or export of personal data, and may request information about categories of data collected, used, or disclosed. We may keep limited records where required for security, billing, tax, or legal compliance.

7) Children and age limits
The service is intended for adults (18+). We do not knowingly allow minors to create paid subscriptions or use the service. If we learn that a minor account was created, we may suspend the account and delete related data as permitted by law.

8) Security
We use reasonable administrative, technical, and organizational safeguards, but no method of transmission or storage is 100% secure.

9) International transfers
Data may be processed in the United States and other countries where our processors operate.

10) Changes and contact
We may update this policy from time to time. Material changes are effective when posted. Contact: gormtheold25@gmail.com