Privacy policy

Last updated: 17 October 2026

1. Controller and contact

Email: info@meinwimmelbild.de

Use the contact details above for privacy questions or deletion requests. Include your order number if available. Do not send additional photos or private access codes unless needed for your request.

2. What data we process and why

Visiting the website generates technical connection data, including your IP address, request time, requested URL and browser and device information. We need this data to deliver and secure the website. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is an available service protected against misuse.

For your order, we process your people and location photos, image and file information, optional wishes, email address, order number, processing status and access permissions. Generation produces further data, including prepared reference images, characters, scene plans, model requests and responses, and the finished picture. This serves the creation and delivery you requested under Article 6(1)(b) GDPR.

The people operating the service can view inputs, intermediate outputs and results for troubleshooting and quality analysis. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is fixing errors and checking the test service's functionality and output quality. This does not make your order pictures public examples.

Only upload photos you are permitted to use for this purpose, and inform the people pictured about processing. For photos of children, the required permissions from those with parental responsibility must be in place. Avoid sensitive information, such as health or religion, in your wishes. This policy does not replace the permission required to use photos of other people.

Providing this data is not a legal requirement. Without the required photos, email address and technical processing, we cannot fulfil your order. Additional wishes are optional. No automated decision with legal or similarly significant effects within the meaning of Article 22 GDPR takes place.

3. Local storage and access

Before submission, selected photos and form inputs remain as a draft in your browser's IndexedDB. Drafts are intended to be recoverable for up to 24 hours; expired content is discarded during subsequent use. You can also remove local data through your browser's website data settings.

An essential session cookie named __Host-wimmel-session associates orders with your session and enables protected access. It is valid for seven days and uses Secure, HttpOnly and SameSite=Strict. After email confirmation, previous results still available for that address can also be shown. A single result link or access code grants access only to that picture. Keep these credentials private.

Necessary storage or access on your device serves the service you expressly requested (section 25(2)(2) TDDDG). Subsequent processing fulfils your order under Article 6(1)(b) GDPR and secures operation under Article 6(1)(f) GDPR. Google Analytics 4 is loaded only with explicit consent. No analytics requests are made without consent. We do not load external fonts.

Google Analytics 4 (optional)

With your explicit consent, we use Google Analytics 4 (Google Ireland Limited, Dublin, Ireland) to analyse page views, visit sources, devices and anonymised picture creation events. Identifiers may be stored in cookies on your device. The legal bases are your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Google may also process data outside the EEA. We do not use advertising personalisation or send photos, names, email addresses, free text, order identifiers or private result links to Analytics. Consent is optional and can be withdrawn for the future at any time using Cookie settings in the footer. The retention period for user-level event data must be checked in the Google Analytics property and set as short as possible. Further information: Google privacy policy.

4. Service providers

Cloudflare: website, storage and abuse protection

We use services from Cloudflare, Inc., USA: Workers for the website and processing, D1 for order data, private R2 storage for images and Images for image preparation. The R2 bucket is configured with EU jurisdiction. This does not mean all data is processed exclusively in the EU; network, security and support processing in particular may take place outside the EU.

In the creation form, Cloudflare Turnstile uses technical browser, device and connection information to check whether a request is automated or abusive. This includes the IP address and interactions with the security check. We also use time-limited request counters, an IP address hash and email-related usage limits. The legal basis for abuse protection is Article 6(1)(f) GDPR; our legitimate interest is protection against automated orders, spam and uncontrolled usage costs.

Further information: Cloudflare privacy policy, Turnstile privacy policy and Cloudflare data processing addendum.

OpenAI: creating your personalised picture

For live generation, we use the OpenAI API. The photos required to create your picture, prepared references and your wishes are sent to and processed by OpenAI. For customers in the European Economic Area, the OpenAI agreement names OpenAI Ireland Ltd., Ireland, as the contracting party; affiliates and subprocessors outside the EEA may also be involved. The legal basis is fulfilment of your creation request under Article 6(1)(b) GDPR.

Under OpenAI's published terms, API content is not used to train models by default. This does not mean there is no provider-side storage. Under the API data rules, content may generally be retained for up to 30 days for security and abuse monitoring; legal obligations and security exceptions may require longer periods. In the labelled example mode, an existing example is processed instead and no OpenAI request is made.

Further information: OpenAI API data controls and OpenAI data processing addendum.

Resend: confirmation and result emails

Resend (Plus Five Five, Inc., USA) sends our confirmation and result emails. It receives the recipient address and message content, including the private confirmation or result link. Photos are not sent as attachments. Technical sending and delivery information is generated. We do not use open or click tracking. The legal basis is Article 6(1)(b) GDPR; the emails confirm and deliver your order and are not advertising.

Further information: Resend privacy policy and Resend data processing agreement.

Processing outside the European Economic Area

These services may process data particularly in the USA. The published data processing agreements provide EU standard contractual clauses and, where applicable, adequacy decisions for such transfers. See the agreements linked above for details and contractual texts. You can also request information about the providers and transfer safeguards used for your order via our privacy contact.

5. Retention and deletion

• Browser draft: intended to be recoverable for up to 24 hours; local cleanup takes place when using the website or deleting website data in your browser.
• Unaccepted uploads: expire after 24 hours, particularly if the email has not been confirmed.
• Accepted orders: generally 90 days from acceptance. The specific expiry date is shown with the order. Access then ends; an automatic cleanup process progressively removes photos, inputs, intermediate outputs and results.
• Session and technical verification: sessions are valid for seven days and email confirmation links for 30 minutes. Expired verification records and counters are cleaned up automatically. Reduced technical order data may be retained for usage limits until its counting or retention period ends.
• Contact requests: we keep correspondence as long as necessary to handle the request and, where applicable, meet legal obligations or clarify legal claims.

You can cancel orders that have not started and delete their inputs using the provided process. Orders already started cannot be cancelled this way. Contact us for early deletion of other orders. The contact channel remains available without a session cookie. Access is blocked upon deletion; physical cleanup may be delayed by technical issues. Our order retention periods do not replace providers' separate security and legal retention periods. Download your finished pictures in time; we do not provide a permanent archive.

6. Your rights

Subject to the GDPR, you have rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). Where processing is based on consent, you may withdraw it at any time for the future; this does not affect the lawfulness of previous processing.

Right to object: You may object under Article 21 GDPR to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. Please use the contact details above.

You may also complain to a data protection supervisory authority (Article 77 GDPR), particularly where you live or work or where an alleged infringement took place. For Karlsruhe, the competent authority is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg .