CMeIn Privacy Policy

Data we collect

We collect only what we need to operate the service.

• Account info: email, display name, and either a hashed password or an OAuth identifier (Google / Facebook) if you sign in with one of those.
• Photos you upload: source images you submit so we can generate new images for you.
• Generated photos: images CMeIn creates from your uploads, plus prompt metadata (keywords, styling, dimensions).
• Usage data: credits balance, generation history, batches, follows, messages, feedback, reviews you give or receive, optional location for mentor matching.
• Wingman conversations: if you use Wingman, the messages in a conversation you bring to us, including what the other person wrote, along with the lines we suggested, the reasoning we showed you, and whether you edited a line before sending it. We also keep short notes we write about the other person from what she said, so the assistant remembers the conversation. We do not store screenshots; only the text you copy across from them.
• Payment data: when you buy credits or unlocks, our payment processor handles the card details directly. We receive only the transaction confirmation (amount, currency, status, processor's transaction ID).
• Technical logs: user agent, request timestamps, and error stack traces. Used for security, abuse prevention, and debugging. We do not store your IP address. We read it at the time of a request to derive an approximate location at country level (a two-letter country code), which we keep for site measurement; the address itself is discarded. IP geolocation by DB-IP.
• Verification & likeness data: if you use selfie verification, the selfie you submit and a match score; to pick the best reference photos we may also derive facial-structure descriptors from your uploads. Used only to generate and verify your own photos: never for advertising, never shared beyond the processors listed below, never used to train AI models.
• How you found us: if you arrive from a link or ad, we record the campaign parameters (source, medium, campaign, referrer URL) with your account, to measure which channels work.

What is sent to AI providers: to generate your images we transmit your uploaded reference photos and your prompt/scene selections to Microsoft Azure OpenAI or OpenAI (listed below). Generated results come back to us and are stored in our own infrastructure. If you use Wingman, the text of a conversation is sent to the same providers so the assistant can suggest a reply, and that includes what the other person wrote. Before the first generation, the app asks for your explicit permission for this processing, and both providers are contractually bound to equivalent data protection and do not train on this data.

How we use it

• To run the service: authenticate you, generate the images you ask for, deliver messages and notifications.
• To process payments and grant credits / unlocks.
• To prevent fraud, abuse, and unauthorized access.
• To improve the service: measure performance, fix bugs. We do not train AI models on your uploads or generated images.
• To communicate with you about your account (security notices, terms updates, transactional emails).

Third parties we share data with

CMeIn never sells your data. We use the following processors strictly to operate the service:

• Microsoft Azure: hosting, database, blob storage, and Azure OpenAI for image generation. Subject to Microsoft's privacy statement.
• OpenAI: when configured as the image / text provider, prompts and source images are sent to OpenAI for inference. Subject to OpenAI's privacy policy. OpenAI does not train on API data by default.
• Google: Google Sign-In (for OAuth login), Google Places API (for mentor location lookups), and Google Analytics / Google Ads for the site measurement described under Cookies. Subject to Google's privacy policy.
• Meta / Facebook: Facebook Login (if you use it) and the Meta Pixel for the site measurement described under Cookies. Subject to Meta's privacy policy.
• Reddit: the Reddit Pixel for the site measurement described under Cookies. Subject to Reddit's privacy policy.
• Lemon Squeezy: payment processing for credit packages and unlocks. Subject to Lemon Squeezy's privacy policy.
• Email providers: for transactional emails (account confirmations, password resets, receipts).

Each processor receives only the minimum data needed to perform its function.

Retention

We keep your data only as long as you have an active account, plus a short window after deletion for backup recovery:

• Active account: all data is retained until you delete the account.
• After deletion: encrypted backups containing your data are retained for up to 30 days, then permanently overwritten.
• Wingman conversations: kept until you delete the conversation or your account. Nothing expires on a timer. Deleting a conversation permanently removes its messages and the notes we wrote about the other person.
• Legal / financial records: payment receipts may be retained longer where tax or accounting law requires (typically up to 7 years), in anonymized form where possible.
• Technical logs: IP-level access logs are kept for up to 90 days for security purposes.

Your rights

Under GDPR (EU/UK), the CCPA (California), and similar laws elsewhere, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data: update your email or display name on the Account page anytime.
• Delete your account and data: instant via self-service, or by request.
• Export a copy of your data: email support@cmein.com and we'll respond within 30 days.
• Object to or restrict certain processing.
• Withdraw consent at any time where processing is consent-based.
• Lodge a complaint with your local data protection authority.

Security

Data in transit is encrypted with TLS. Passwords are stored hashed (bcrypt). Photos and generated images are stored in Azure Blob Storage with private access. Only signed URLs unlock individual files. We use the principle of least privilege for internal access.

No service can promise zero risk. If we ever discover a breach affecting your data, we will notify you and the relevant authorities promptly, in accordance with applicable law (e.g. GDPR Article 33 within 72 hours).

International transfers

CMeIn operates from Israel, and our hosting and AI providers may process data in the EU, the US, and other Microsoft Azure regions. Where data is transferred outside the EEA / UK, we rely on Standard Contractual Clauses or equivalent safeguards.

Children's privacy

CMeIn is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us their data, contact us and we will delete it.

Cookies & local storage

We use browser localStorage to keep you signed in (JWT token) and to remember small preferences (referral codes, redirect-after-login intent). Some embedded third-party features (e.g. Lemon Squeezy checkout, Facebook Login) may set their own cookies on their domains during the moment you interact with them.

Analytics and advertising. cmein.com can load four third-party measurement tags: Google Analytics 4 and Google Ads, the Meta Pixel, and the Reddit Pixel, but only if you accept them. Nothing is loaded and no cookie of theirs is set until you choose, and declining is one click. You can change your answer at any time with the button at the end of this section. They record that a page was viewed and, when you create an account or buy credits, that the signup or purchase happened, so we can tell which channels and campaigns bring people to CMeIn. They set cookies of their own (Google’s _ga and _gcl_*, Meta’s _fbp, and Reddit’s equivalent). These are analytics and advertising cookies: unlike the Pose Maxing cookie described below, they are not strictly necessary to run the service.

These tags never receive your uploaded photos, your generated images, your facial data, or the contents of your account. Nothing on CMeIn stops working if you decline them or block them. The site’s own visitor counting runs on our servers, sets no cookie, and keeps nothing that identifies you.

Change my cookie choice

If you use one of our free tools without signing in (Pose Maxing, AI Headshot, Background clean-up, Style Maxing, Dating profile review, Better Side or Best Angle), we store one cookie on your device to record that you have already had a free run. It exists only so we can apply the free limit: it holds a random identifier, nothing about you and nothing about your photo, and it cannot be read by any other site. It is deleted after 90 days, after which you can have another free run. We also apply the same limit per internet connection, but we do not store your IP address or any hash of it to do so; that count is held in memory only and is forgotten when our servers restart. These are strictly necessary to provide the free service you asked for, so we do not ask for separate cookie consent for them.

The photo you upload without an account, and the photo we generate from it, are deleted within 24 hours.

Changes to this policy

If we change this policy in a way that materially affects how we use your data, we will update the "Last updated" date above and, for significant changes, notify you in-app before the changes take effect.

Who decides how your data is used, and why we are allowed to

CMeIn is the data controller for the personal information collected through the service. We decide what is collected and what it is used for, and we are responsible for it under applicable law.

Depending on the situation, we rely on one of these legal bases:

• Performing our contract with you: running your account, generating the images you ask for, processing payments and credits.
• Your consent: sending your photos to AI providers for generation, marketing where the law requires consent, and non-essential cookies.
• Complying with a legal obligation: tax and accounting records, and lawful requests from competent authorities.
• Our legitimate interests: keeping the service secure, preventing fraud and abuse, and measuring and improving performance.

Where processing is based on consent, you can withdraw it at any time. Withdrawing consent does not affect processing that already happened lawfully before you withdrew it. Inside CMeIn, access to personal information is limited to the people and providers who need it to operate, secure, and support the service.

Reference photos and generated images

Reference photos are processed for one purpose: analysing the visual characteristics needed to generate the images you request, and providing the features built around that.

To generate an image, your reference photos and your prompt are transmitted to our AI infrastructure providers, Microsoft Azure OpenAI and/or OpenAI, who process them on our behalf under contractual data-protection obligations.

We do not use your reference photos or generated images to train our own AI models, and we do not permit our AI providers to use them to train theirs.

Your reference photos and generated images are private to your account. They are not publicly displayed, used in advertising, or published by CMeIn without your authorisation or another lawful basis. A generated photo appears in the public feed or on your public profile only while you have chosen to publish it, and you can change that at any time.

Facial images and biometric information

The photos you upload contain your face and other physical characteristics, and the service necessarily processes them in order to generate the images you request. That processing includes analysing your uploads to describe pose, face visibility, and physical characteristics, so the system can choose the best reference photos for a given result and keep your likeness consistent across generations.

That is what the processing is for. We do not use your photos to identify you against any external database, to recognise you anywhere outside your own account, or to match you against other users. We do not share this analysis with anyone beyond the AI providers listed above, who process it on our behalf in order to produce the image you asked for. Where we offer an optional identity-verification feature, it is described in the Terms of Service and it operates only within your own account.

Where applicable law treats this processing as biometric or otherwise sensitive information, we handle it according to the requirements that apply to that category.

Other people in your photos and messages

You should only upload reference photos of yourself.

If you provide us with information or content relating to another person, you are responsible for making sure you are legally permitted to do so and that you have obtained any consent the law requires. If you believe an image on CMeIn depicts you without your consent, email support@cmein.com and we will review it promptly.

Wingman conversations contain someone else's words. When you bring a conversation to Wingman so we can help you reply, the other person's messages come with it. She has no account with us and did not agree to anything, so we hold her words only to do the one job you asked for, we never use them to train AI models, we never use them for advertising, and we do not use them to build any profile of her beyond the conversation you are in.

You can delete any conversation at any time, which removes her messages and our notes about her permanently. If you are the other person in such a conversation and you want her side removed, email support@cmein.com and we will act on it. We will need enough detail to find the conversation, and we will not disclose anything about the account that holds it.

Where your information comes from

• Directly from you: when you create an account, upload photos, write prompts, buy credits, or contact support.
• Automatically: through technical and usage data generated when you use the website or the app.
• From authentication and store providers: Google or Facebook when you sign in with them, and Apple or Google when you install or purchase through their app stores.
• From payment and transaction providers: confirmation of the payments you make.
• From the hosting, analytics, security, and support providers we use to run the service.

Marketing communications

Subject to applicable law, we may use the contact details you gave us to tell you about CMeIn, new features, offers, and promotions. Where the law requires consent, we send these only after you have given it.

You can opt out at any time using the unsubscribe link in the message or by emailing support@cmein.com. Opting out of marketing does not stop the operational, transactional, and security messages we need to send about your account.

Business transfers and professional advisers

If CMeIn is involved in a merger, acquisition, financing, restructuring, or sale of assets, personal information may be disclosed or transferred as part of that transaction, subject to applicable law. We may also disclose information to legal, accounting, audit, and insurance advisers where reasonably required.

Neither of these changes the rest of this policy: we still do not sell your reference photos, your generated images, or any other personal information.

Further purposes, and the preferences we record

In addition to the purposes listed under How we use it, we also process personal information in order to:

• Provide customer support: responding to your inquiries, support requests, and feedback.
• Store and deliver your images: keeping your generated images available so you can view and download them from your account.
• Create statistical, aggregated, or anonymised information for analytics, research, security, and business planning. Once information is aggregated or anonymised so that it no longer reasonably identifies anyone, it is no longer personal information and this policy stops applying to it.
• Comply with the law: legal obligations, tax and accounting duties, and lawful requests from competent authorities.
• Protect our legal rights and resolve disputes: including establishing, exercising, or defending legal claims.

Consent and preference records. We also keep a record of the privacy, cookie, marketing, and permission choices you make, so that we can honour them and show that we did. That record is itself personal information, and it is kept for as long as we need to prove the choice was respected.

Definitions used in this policy

• Personal information: information relating to an identified person, or to a person who can be identified directly or indirectly, including by a name, an identification number, contact details, location data, an online identifier, or other data relating to that person's identity.
• Sensitive information: personal information of a sensitive nature as defined under applicable law, meaning information that the law places under enhanced protection.
• The Services: the CMeIn website, the mobile applications, the AI image-generation service, user accounts, credit purchasing, and any related feature CMeIn offers from time to time.
• User: any individual who accesses or uses the Services.
• Processing: any operation performed on personal information, including collection, storage, use, transfer, disclosure, deletion, and destruction.
• Platform: the website, the mobile applications, and any other digital interface through which the Services are made available.
• Data controller: the party that decides the purposes and the means of processing. For everything described in this policy, that party is CMeIn.