Privacy policy

Draft — pending owner review. This version reflects the current service and is awaiting the owner’s review before it is treated as final.

Updated 15 Nov 2026 · pending owner review

This policy describes how Snikkt Oy processes personal data in Imaginum Studio. It reflects the current service and is pending owner review before final publication.

Controller

Snikkt Oy, Business ID 3594010-7, Uusi-Pätiläntie 841, 16800 Hollola, Finland. Privacy: privacy@imaginum.studio. Abuse reports: abuse@imaginum.studio.

Data we process

• Account data: username, email, language, account and session data.
• Security data: password hash, passkey credentials, encrypted TOTP secret and MFA status.
• Content: prompts, reference images, generated images and videos, and metadata.
• Payment data: Stripe customer, payment and invoice identifiers, plan, tax and billing details. We do not store card numbers.
• Usage data: credits, generation history, technical logs, security logs and audit logs.
• Support data: contact requests, abuse reports and related evidence.

Purposes and legal bases

• Performance of a contract: account, generation, credits and support.
• Legitimate interest: security, abuse prevention, product improvement and traceability.
• Legal obligation: accounting, VAT, authority requests and legally required reports.
• Consent: marketing and optional analytics only if introduced and consent is requested.

Recipients and model providers

We use Stripe for payments, invoicing and tax, and Wiro as the production environment for model runs. Through Wiro, prompts, reference images and other model input are passed to model providers. We also use an EU hosting service and an email service.

• We do not sell personal data.
• We enter required data processing agreements with processors.
• Wiro and Stripe may process data outside the EU/EEA. Where they do, we use safeguards required by applicable law.
• More information about transfer grounds is available from privacy@imaginum.studio.

Retention

• Account data is kept while the account is active and for a reasonable period afterwards.
• Generated assets, prompts and reference images are visible to the owner for 30 days. After that the owner receives 404; files and metadata may remain for deletion processing, abuse handling, legal obligations or backups.
• Deletion is primarily soft deletion: the file and metadata remain until a separate deletion process is carried out.
• Temporary model input and output files are deleted after the task where the provider supports it. The provider’s own logs may remain under the provider’s terms.
• Billing and accounting data is kept as required by law.
• Abuse, moderation and audit data is kept as long as processing, legal defence or a legal obligation requires.
• Backups may remain for a limited period before rotation.

Account deletion and data requests

You can request deletion of your account or a copy of your data at privacy@imaginum.studio. We verify the identity of the requester. We delete or anonymise data when it is no longer needed, unless law, abuse handling, a payment dispute or another legitimate reason requires retention. Deletion is currently handled manually.

Security

We use TLS, scrypt password hashing, hashed session and magic-link tokens, MFA, access controls and audited admin access. Security is never absolute; report suspected security issues to privacy@imaginum.studio.

Your rights

• Access, rectification and erasure.
• Restriction of and objection to processing.
• Data portability.
• Withdrawal of consent.
• Complaint to the supervisory authority.

Cookies

We use essential cookies for login and session. Stripe Checkout may set its own cookies during payment. We do not use analytics or marketing cookies without separate introduction and consent.

Minors

The service is a SFW service and minors may use it. We do not direct marketing at minors. A parent or guardian may exercise a minor’s data protection rights by contacting privacy@imaginum.studio.