Privacy Notice
1. Controller and scope
9CUES LIMITED, a company registered in England and Wales, company number 17462592, trading as PoseChapter.
Registered office and postal contact: 124 City Road, London, United Kingdom, EC1V 2NX.
Email: support@posechapter.com. Our service and contract language is English.
9CUES LIMITED is the controller of personal information used to operate PoseChapter. Contact the email above for privacy questions or requests. This notice covers the customer studio and communications about it. Other 9Cues products have their own notices; using PoseChapter does not enrol you in them.
2. Information we use
We receive your email and account identifiers; uploaded reference images and filenames; pet images; photo-planning choices and instructions; generated images; save/pass choices and generation history; credit balances and transaction references; and support messages or image reports. Payment providers may supply payment status, payer details and fraud/dispute information. We do not receive your full card number or security code in the studio.
When shared sign-in protection is enabled, we store keyed hashes of email addresses and attempt counts to limit abuse. These counters expire after one hour and are removed on the next sign-in attempt; we do not store raw emails or IP addresses in that counter table.
Our hosting, authentication and delivery providers also process connection and security information such as IP addresses, request times, browser/device information, authentication events and delivery logs. Information comes from you, your browser, our service's operation and the providers described below.
Images can reveal personal characteristics. Our purpose is to generate your requested portraits, not to identify you against a database of other people, authenticate you by face, or infer health, ethnicity, sexual orientation or other sensitive characteristics. Please do not submit medical records, intimate imagery, identity documents, information about your sex life or other unnecessary sensitive information in prompts. Selecting “Dating” is a photo-purpose choice; we do not use it to determine sexual orientation. If prohibited or unnecessary sensitive material is brought to our attention, we assess it for restriction or deletion.
3. Purposes and lawful bases
| Purpose and information | Legal basis |
|---|---|
| Create your account, send sign-in codes and maintain your session using email and authentication information. | Contract: necessary to supply the account you request. |
| Create and store requested portraits using references, instructions and preferences; maintain saves, jobs and credits; resolve service requests. | Contract: necessary to deliver your chosen studio functions and purchases. |
| Process orders, payments and refunds using order and transaction details. | Contract; legal obligation for required accounting and tax records. |
| Prevent unauthorised access, abuse and payment fraud; investigate image reports and technical faults using relevant logs, identifiers and, when necessary, affected content. | Legitimate interests in a safe, reliable service and protecting customers and our business; balanced against your privacy. |
| Handle complaints, maintain evidence of agreements and establish or defend legal claims using relevant correspondence and transaction records. | Legitimate interests in resolving disputes and protecting legal rights; legal obligation when required by law. |
| Comply with lawful regulatory, court or tax requests. | Legal obligation. |
| Optional marketing, public testimonials or any separately offered optional use of your photographs. | Consent where required, obtained separately before that use. A purchase is not consent. |
Your email is required to operate the account. Suitable reference photos are required for personalised generation, and payment information is required for purchases. Optional notes and pet photos are not required. You can omit them. Without required information we cannot supply the relevant feature; there is no general legal obligation to upload your photos.
4. AI processing and access to photographs
When you request generation, selected reference images and your instructions pass through our application to fal (Features & Labels, Inc.) and the model provider. The current route is fal's Nano Banana 2 image-editing service, based on Google's image model. Generated files return through that route to your private account storage. Saving a photo does not post it publicly.
Our studio does not operate a model-training pipeline using your uploads. We do not sell your photographs or use them in PoseChapter advertising without separate permission. We do not make an unconditional promise that every external model has zero retention or identical training restrictions. Provider processing, safety checks, retention and permitted use depend on the model-specific service terms and applicable processing agreements; generic provider website privacy notices do not replace those agreements. Ask us for the current arrangements for your generation route before uploading if this matters to your use.
Authorised personnel may access information where necessary to investigate a problem you report, protect the service, fulfil a data request or comply with law. “Private account” means access is restricted; it does not mean the AI providers or authorised support can never process or view a submitted image.
5. Providers and other recipients
| Recipient | Role and data |
|---|---|
| Cloudflare Turnstile (when enabled) | Sign-in bot protection: browser, device and connection signals needed to check a request. Reference photographs are not submitted to the security widget. |
| Supabase | Account authentication, database and private photo storage: account information, photos, jobs, credits and orders. |
| Render | Application hosting and operational logs: requests, connection data and information processed through the hosted app. |
| fal and the relevant model provider, currently Google through the Nano Banana 2 route | Image generation, safety processing and delivery: selected references, prompts, request identifiers and outputs. |
| Resend | Delivery of authentication and purchase-confirmation emails through our configured email service: recipient address, order details, accepted purchase terms, email content and delivery information. Purchase emails do not include your photos or generation prompts. |
| Google Play (Android purchases) | Purchase processing, receipts, verification and refunds. We send a pseudonymous account identifier and verify purchase tokens and order references with Google; our purchase ledger retains a token hash and the credit grant, including after account deletion where needed to prevent duplicate grants and handle accounting or disputes. Google handles your payment details under its own privacy information. |
| Stripe and its payment partners (web purchases) | Checkout, payment security, receipts, refunds and disputes. Stripe also acts as a controller for purposes described in its own privacy notice. |
| Our business-email provider and authorised support personnel | Correspondence you send to support and information necessary to address it. Avoid sending unnecessary photos or sensitive documents by email. |
| Professional advisers, authorities and a prospective business successor where necessary | Limited information needed for advice, legal compliance or a safeguarded business transfer. A transfer does not itself authorise incompatible new use of your photographs. |
Providers may use authorised subprocessors. We require processing on our behalf to be governed by appropriate contractual and confidentiality terms. Provider information: Cloudflare, Supabase, Render, fal API terms, fal processing agreement, Resend Stripe and Google.
6. International processing
The service uses international infrastructure and providers, including infrastructure in Singapore and providers operating in the United States. Authorised support may also work outside the UK. Information is not guaranteed to remain in the UK or Europe. Storage region alone does not determine every location used for support or model processing.
For a restricted transfer we require an applicable UK adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or EU Standard Contractual Clauses with the UK Addendum, together with assessment and additional protections where required. Contact us for details or a copy of the safeguards relevant to your data, subject to necessary confidential information being removed. We will not treat your acceptance of this notice as a substitute for required transfer safeguards.
7. Retention and deletion
| Information | Retention approach |
|---|---|
| Account, reference photos, generated photos and saved choices | Kept to provide your account library until you delete them or close the account, subject to necessary, limited legal or security retention. There is no automatic inactivity-deletion promise in this version. Passing or unsaving is not deletion. |
| Pending or uncertain jobs and temporary uploads | Kept while needed to confirm delivery, avoid duplicate charges, resolve errors and complete cleanup. If automated resolution stalls, contact support for manual reconciliation and deletion assistance. |
| Order, refund and accounting records | Minimum records needed for accounting are normally retained for six years from the end of the relevant company financial year, and longer where tax law or an active dispute requires. Photo files are not retained for that period merely because a purchase occurred. |
| Support, safety and dispute records | Kept while the matter is open and for the period reasonably necessary to evidence its resolution, handle related claims or meet legal duties. We consider sensitivity, applicable claim periods and whether identifiers or images can be removed sooner. |
| Technical logs, provider records and backups | Retention depends on the provider, configured backup/log schedule and purpose. These may outlast deletion from the active studio. We seek deletion or restriction where required and do not promise immediate deletion from every provider system. |
Individual deletion removes the item from the account and schedules underlying storage cleanup where needed. Account deletion requires verification of identity. Active or uncertain jobs may block the self-service button; this does not prevent an email request or suspend our legal obligations. We assess each request, reconcile pending work and explain any limited information that must remain. Downloads you or others hold separately are outside our control. Necessary accounting records may remain in payment or accounting systems after the studio account is removed.
8. Your rights
Depending on the circumstances, you can request access, correction, erasure, restriction of processing and a portable copy of information you provided. You can withdraw consent for optional processing without affecting its earlier lawfulness. Contact support@posechapter.com; we may ask for proportionate information to verify your identity. We normally respond within one month, subject to lawful extensions or exceptions, which we will explain.
Your right to object: you can object to processing based on legitimate interests on grounds relating to your situation. We must stop unless a lawful overriding reason applies. You can object to direct marketing at any time, and we will stop using your information for that purpose.
You may complain to the UK Information Commissioner's Office or another competent supervisory authority. You do not have to complain to us first, although we welcome the opportunity to resolve your concern.
9. Automation, security and changes
AI automatically creates images from your request. Automated security and payment checks may delay or block an action; contact us for review. We do not use portraits to decide eligibility for employment, insurance, credit or healthcare. Protecting access involves encrypted connections, account checks and private storage permissions, but no internet service can guarantee absolute security.
We explain browser storage in the Cookie & Browser Storage Notice. Material changes to processing will be brought to your attention where required, and fresh consent obtained where necessary. The version and publication date identify this notice; changes will not retrospectively legitimise an incompatible use of your data.