How Imya handles account data, uploaded media, AI processing, retention, and deletion
2026/07/12
This Privacy Policy explains how Imya collects, uses, shares, retains, and protects personal information when you use our website and AI generation services.
Depending on how you use Imya, we may collect:
We use this information to:
Only upload media you own or have permission to use.
Uploaded media is normally processed automatically. We do not routinely review your photos. Access is restricted to authorized personnel and may occur only when reasonably necessary to provide support you request, investigate security or abuse, maintain or recover the service, or comply with legal obligations.
Imya does not sell your uploaded media or use it to train models owned by Imya. Third-party AI processing providers handle task data under their own terms and policies.
Imya uses third-party AI processing providers to perform requested generation tasks. These providers receive the media and task instructions needed to complete a request, which may be delivered through short-lived access links. Under current provider policies, a provider may retain processed media for up to 14 days and task logs, text, and metadata for up to 2 months. These are the provider's independent maximum periods and are separate from the Imya-controlled storage periods below.
The following periods currently apply to media uploaded and generated through the private-media flow identified in the AI Face Swap product. Other Imya tools may display different retention terms before upload or generation.
Media handled by other Imya tools is not covered by the Face Swap schedule above. Unless that tool shows a specific retention period, its uploads or results may remain in Imya-controlled storage until operational cleanup or a verified deletion request. You can contact us to request removal.
Deleting media from Imya-controlled storage does not change a third-party AI provider's separate retention period. Provider-held media and task information expire according to the provider periods described above.
Media deletion does not necessarily remove non-media records. We may retain generation status, credit and refund records, security logs, payment records, and limited error information where reasonably necessary for account history, fraud prevention, security, accounting, dispute resolution, or legal compliance.
We may use service providers for AI processing, private storage and content delivery, authentication, email, payments, analytics, customer support, fraud prevention, and security. They receive only the information needed to provide their service and handle it under their own contractual and legal obligations.
Imya uses cookies or similar storage where needed for sign-in, account security, language preferences, abuse prevention, and limited free-trial controls. Microsoft Clarity and Google Analytics are always enabled and may use pseudonymous visitor and session cookies to collect pages visited, navigation, clicks, scrolling, traffic sources, device data, and approximate location data. We use this information to connect activity across pages, create session replays, measure traffic and visitor journeys, improve the service, and find bugs. Selecting Continue in the experience analytics notice enables other optional experience features, including additional analytics and attribution functionality and the optional Google sign-in prompt. You can review the notice from the website footer and manage cookies through your browser settings, although blocking cookies may make analytics less complete and blocking essential cookies may prevent account or generation features from working.
Results remain private by default. If you actively create a public share link, anyone with that link can view the final result until you revoke it, delete the result, or its retention period ends. The public share page is designed not to expose source uploads, target faces, prompts, account details, task identifiers, or provider URLs. Search engines are instructed not to index share pages, but a public link should not be treated as secret once you send it to someone else.
A public share link never extends the underlying result's storage period. Free-account links expire no later than the applicable 7-day result period, and active subscriber or lifetime-member links expire no later than the applicable 30-day result period. Revocation or deletion makes the controlled link unavailable immediately, while physical storage cleanup may finish asynchronously.
To attribute referral credits and prevent abuse, Imya may store a signed first-party referral token for up to 7 days and process limited account, visit, generation-status, IP, browser, and reward-ledger signals. Raw IP addresses are not used as the sole basis for a reward decision. Pseudonymous share-visit and attribution audit records are automatically removed within 60 days after a link is revoked or fails. Awarded credit-ledger entries may be retained with account and financial records where reasonably necessary for accounting, disputes, fraud prevention, and enforcement of the referral rules.
Where applicable law requires a legal basis, we process data to perform our contract with you, based on your consent, to comply with law, or for legitimate interests such as security, fraud prevention, support, and service improvement. Imya and its service providers may process data in countries other than your own. Where required, we use appropriate safeguards for international transfers.
We use safeguards designed to protect personal information, including private media storage, short-lived provider access links, and access controls based on operational need. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.
You may delete supported private generation media through the product controls. Depending on where you live, you may also have rights to access, correct, delete, restrict or object to processing, request portability, withdraw consent, opt out of certain marketing or data uses, and appeal a decision about a privacy request. Requests may require identity verification and remain subject to exceptions permitted by applicable law. Privacy and deletion rights are not limited to VIP users.
Imya is not intended for children who are not old enough to consent to online services under applicable law. Do not upload a child's photo unless you are legally authorized to do so. Contact us if you believe a child provided personal information without valid authorization.
We may update this Privacy Policy as our services, providers, or legal obligations change. We will post the revised policy and update the date shown above.
If you have questions or want to exercise a privacy right, please contact us or email support@imya.ai.
