Privacy Policy

This Privacy Policy explains how gorm the old LLC collects, uses, stores, and shares data for Gorm Studio and Gorm University.

1) Notice at collection
We collect identifiers (name/email/account ID), internet and device data (IP address, user agent, session and security logs), payment and subscription records, prompts and AI request metadata, user-uploaded files, generated media, and moderation/reporting submissions. We use this data to provide the service, process payments, prevent abuse and fraud, enforce policies, and comply with legal obligations.

2) Data categories and purposes
Account and profile data is used for authentication, access control, and customer support. Billing records are used for subscription management, invoicing, tax handling, and dispute response. Prompts/uploads/outputs are used to fulfill generation requests and provide user history features. Security and usage logs are used for reliability, abuse prevention, and incident response.

For Gorm Character Swap, source videos and reference photos may contain faces, voices, and other personal information. We process these files with your prompt to replace characters in a scene and retain job status, credit transactions, and your rights/Terms confirmation for service operation and dispute handling. Submit only information you have a lawful basis to share for this purpose.

3) Processors and sharing
We disclose relevant data to service providers only as needed to run the product:

• Supabase: account authentication, database records, and user/access state.
• Stripe: payment processing, subscriptions, invoices, and billing portal management.
• Cloudflare/R2: uploaded and generated media storage, secure asset delivery, and edge protection.
• OpenAI: processing prompts and related request metadata for text and image generation.
• AtlasCloud (or successor video model provider): processing prompts and generation metadata for video outputs.
• fal.ai and the model services it uses, including MiniMax for Character Swap: processing source videos, reference photos, prompts, and request metadata to generate replacement-character videos. Inputs are uploaded to fal's storage for processing, and generated video links are returned through that provider.
• Hosting/infrastructure providers: app hosting, operational logs, and uptime/security monitoring.
• Support email provider: handling user support and legal/privacy requests sent to our contact inbox.

We do not sell personal data.

4) Cookies and local storage
We use essential cookies/session tokens for login and security. We may store draft/workspace state in local storage to preserve your in-progress work.

5) Retention
Data is retained for as long as needed for account operation, subscription records, legal compliance, fraud/security response, and dispute resolution. Uploaded/generated assets remain until deleted by the user or removed under policy.

Character Swap outputs are saved to your Studio library using Cloudflare R2 when storage is available. If saving is pending, a provider-hosted download link may be shown instead and may expire. Removing a library file does not automatically erase job, billing, consent, or legal-report records or copies already processed by a generation provider. Contact us about deletion requests; provider retention and deletion are also subject to their policies and applicable legal obligations.

New Character Swap jobs also retain the original scene and character photos privately in Cloudflare R2 so you can restore and edit a past swap. Saved inputs count toward your account's storage limit; identical files within your account can share one stored copy. Deleting a generated output does not delete these saved inputs. Contact us to request deletion of saved inputs. Older jobs may only retain their prompts and settings if their uploads were not saved.

6) Your privacy rights
Depending on your location, you may request access, correction, deletion, or export of personal data, and may request information about categories of data collected, used, or disclosed. We may keep limited records where required for security, billing, tax, or legal compliance.

7) Children and age limits
The service is intended for adults (18+). We do not knowingly allow minors to create paid subscriptions or use the service. If we learn that a minor account was created, we may suspend the account and delete related data as permitted by law.

8) Security
We use reasonable administrative, technical, and organizational safeguards, but no method of transmission or storage is 100% secure.

9) International transfers
Data may be processed in the United States and other countries where our processors operate.

10) Changes and contact
We may update this policy from time to time. Material changes are effective when posted. Contact: gormtheold25@gmail.com

Business correspondence
Gorm the Old LLC
330 S Second Ave
Suite 200 1898
Minneapolis, MN 55401
United States