Privacy Policy

1. Who we are

DittoPix (dittopix.ai) is operated by SVK Consultants Ltd, a company registered in England & Wales (Company No. 07950345), which is the data controller for the purposes of the UK GDPR.

• Contact / data requests: privacy@dittopix.ai
• Registered address: [registered company address]
• ICO registration number: [ICO registration reference]

2. What we collect

Account data — your name and email (to create and secure your account), and payment details (handled by our payment processor, Stripe — we never see your full card number).

Face & body data (special-category biometric data) — the face photo or selfie scan you provide to create your avatar, and the physical details you optionally give (e.g. height, weight, age) so your avatar matches your true proportions. We derive a mathematical body descriptor from these to steer generation.

Your creations — the images, reels, movies, animations and other content you generate. These are private to your account unless you choose to share them.

Usage data — standard analytics (pages visited, features used, device/browser info) and, when you contact support, your messages.

3. Why we can process your face data (legal basis)

Because your face is special-category data, our legal basis is your explicit consent (UK GDPR Article 9(2)(a)). Before any face data is processed you give a specific, informed, affirmative opt-in — a separate consent from our Terms — and you confirm the face is your own (or that you have the pictured person's permission) and that you are 18 or older. You can withdraw consent at any time by deleting your avatar, which deletes the underlying face data. For account, payment and analytics we rely on contract and legitimate interests respectively.

4. How we use your face data

• To create your DittoAvatar (a digital likeness of you).
• To generate the images, reels, movies and animations you ask for, featuring your likeness.
• To keep your likeness consistent across your creations.

We do not sell your face data. We do not use it to train AI models for other users. We do not use it for identification, surveillance, or advertising. You may only create an avatar of yourself, or of someone who has given you explicit permission — never of a real named person without consent.

5. Who processes your data (sub-processors)

We keep your data lean and use a small set of trusted service providers strictly to run DittoPix, each under a data-processing agreement. Being straight with you: to generate an image or video, your reference image is sent to our AI-rendering provider — this is how the product works, and it is done only to produce the output you requested, never to train shared models.

• Cloudflare R2 — encrypted storage of your images, creations and account files.
• Supabase — our application database (EU region).
• Replicate — runs the AI models that render your creations; receives your reference image at generation time to produce your output (US-based; see international transfers).
• Anthropic — helps interpret your text prompts (text only — it does not receive your face data).
• Stripe — payments. SendGrid — transactional email.

6. How we protect and store your data

Face data is encrypted in transit (TLS) and at rest, stored in your private account space, with access restricted to the systems that render your creations. No one at DittoPix views your face data unless you ask us to help with an issue with your avatar.

7. How long we keep it

• Face & body data: kept while your account is active. Deleted when you delete your avatar or account (the underlying image files are physically removed), and auto-deleted after 12 months of inactivity.
• Creations: kept while your account is active; removed when you delete them or your account.
• Consent records: retained (in minimised form) for up to 6 years to evidence lawful processing.

8. International transfers

Some processors (e.g. Replicate) are based in the United States. Where data leaves the UK/EEA it is protected by appropriate safeguards — UK International Data Transfer Agreement / EU Standard Contractual Clauses, or an adequacy decision where one applies.

9. Where DittoPix is available

We are launching UK- and EU-first. To respect specific biometric-privacy laws, avatar/face features are not currently offered in certain US states (including Illinois). You can still use non-face features elsewhere.

10. AI-generated content

Everything created on DittoPix is AI-generated. Outputs carry a visible or embedded "Made with AI" indication. When you post creations to platforms such as TikTok, Instagram or YouTube, you're responsible for using their AI-content labels where required.

11. Your rights (UK GDPR)

You have the right to access, rectify, erase, and port your data; to withdraw consent at any time (by deleting your avatar); and to object to certain processing. You can do most of this yourself in Settings (download your data, delete your avatar, delete your account) or by emailing privacy@dittopix.ai. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

12. Children

DittoPix is for adults. You must be 18 or older. We do not knowingly collect face data from anyone under 18; if we learn we have, we delete it.

13. Reporting harmful content

If you believe content on DittoPix uses your likeness without consent, or is otherwise harmful, report it at safety@dittopix.ai — you do not need an account. We review reports promptly and remove content that breaches our Terms.

14. Changes to this policy

We'll notify you of material changes by email and/or in-app. Continued use after notice means you accept the updated policy.