Privacy Policy

The controller responsible for processing personal data on pipegen.app and in the Pipegen app is:

Alexander Khrisna Hermannstraße 4 34117 Kassel Germany E-mail: info@pipegen.app

No data protection officer has been appointed.

Pipegen is a platform on which you use AI models to create images, videos, voices and 3D sets for films and series. We process your data to provide your account and these features, to bill you, to run the platform securely and — only with your consent — to analyse how it is used.

We name the legal basis for each processing: Art. 6(1)(a) GDPR (consent), (b) (contract and pre-contractual steps), (c) (legal obligation), (f) (legitimate interest). Storing information on your device and accessing it is governed by Section 25 TDDDG (section 17). All recipients with their seat and the basis of each transfer are listed in section 18.

When you open pipegen.app, our server processes technically necessary data: IP address, date and time, the address requested, referrer, browser and operating system. This is needed to deliver the page and to fend off attacks (Art. 6(1)(f) GDPR; legitimate interest in a secure, working service).

The application runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, with whom we have concluded a data processing agreement (Art. 28 GDPR). The servers are located in Hetzner’s data centre in Falkenstein (Germany). Server logs are deleted after 14 days.

To protect against abuse, we limit the number of requests per IP address and per account (rate limits). For this, the IP address or account ID is counted briefly in memory (Art. 6(1)(f) GDPR). All connections to Pipegen are encrypted with TLS.

We store your account, content and files with Supabase (contracting party: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513). Supabase provides the database, sign-in (Auth), file storage, real-time updates and server-side functions and is our processor (Art. 28 GDPR, Supabase's Data Processing Addendum). The data is stored in the Frankfurt am Main, Germany region (eu-central-1). Supabase logs the IP address and browser identifier at sign-in for security. Access from Singapore and the USA (Supabase and its sub-processors) is covered by the European Commission's standard contractual clauses, which are part of our contract with Supabase (section 18).

Registration with e-mail. We process your e-mail address, your password (only as a hash) and, optionally, your first and last name and profile picture to set up your account and sign you in (Art. 6(1)(b) GDPR). We refuse disposable addresses of known providers at registration (Art. 6(1)(f) GDPR, protection against abuse).

Protection against automated sign-ins (Cloudflare Turnstile). On the forms for registration, sign-in and password reset we use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA) to detect bots. Turnstile is loaded only on these forms and processes the IP address and browser and connection characteristics for this. The legal basis is Art. 6(1)(f) GDPR (protecting accounts against automated attacks); reading the device characteristics is strictly necessary for the secure sign-in you requested (Section 25(2) no. 2 TDDDG).

Acceptance of the terms. At registration you accept the Terms of Service. We store the time and the version to be able to prove the conclusion of the contract (Art. 6(1)(b), (c) and (f) GDPR).

Newsletter. If you tick the optional newsletter box, we store this consent with its time (Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG). We currently send no newsletter. Before the first one we will ask you to confirm by e-mail (double opt-in). You can withdraw your consent at any time (Art. 7(3) GDPR), e.g. by e-mail to info@pipegen.app.

First steps. After your first sign-in we ask you, voluntarily, how you heard about Pipegen and what you want to create; you can skip both questions. We use the answers to improve Pipegen and to order the introductory tour (Art. 6(1)(f) GDPR). New accounts receive example content; we store your progress in the tour in your account.

Starter credits only once per e-mail address. New accounts receive free credits once after confirming their e-mail address. So that these starter credits cannot be claimed several times by deleting the account and registering again, we store a hash (SHA-256) of your e-mail address in a normalised form (e.g. ignoring upper/lower case and additions such as “+…”), not the address itself and not linked to your account. The value remains after your account is deleted. Its only purpose is to prevent multiple claims; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in preventing abuse of the starter credits). We delete the value three years after it was last stored (grant of the starter credits or deletion of the account).

Deleting your account and exporting your data. Under Settings → Security & Privacy you can download a copy of your data (Art. 15, 20 GDPR) and delete your account (Art. 17 GDPR). When you delete it, we end a running subscription and send you a confirmation by e-mail.

We store what you create in Pipegen: prompts, uploaded images, videos and audio files, Characters and Souls (collections of images), pipelines, productions (seasons, scenes, cuts, takes), 3D sets, voices and speech, generated results and their metadata (e.g. length, image size). This is necessary for the features you use (Art. 6(1)(b) GDPR). Your content is private; other users do not see it unless you publish something.

Photos of real people. If you upload pictures of people (e.g. for a Character), we process these pictures and send them to the AI providers (section 8) so that the model can depict the person. We do not use the pictures to identify people. You may only upload pictures for which you hold the rights and — for recognisable people — their consent (see the Terms). Whether an uploaded picture shows a face is checked locally on our server; we store your confirmation of the rights as proof, and you can mark a Character as “under 18” (section 19 c, d).

Apps and community. If you publish an App, all signed-in users see it in the gallery with its title, description, cover, example pictures and the first name from your profile. On published Apps, signed-in users can write comments, upvote comments, rate Apps (1–5 stars, only after a run of their own) and report comments. For this we store your user ID, the text or rating and the time; comments show your first name, ratings only the average of all ratings. Reports of comments (reason, optional note) are seen by administrators only. Legal basis: Art. 6(1)(b) GDPR (the feature you use). A deleted comment is hidden at once; your comments, votes, ratings and reports are deleted with your account. Hidden comments are deleted for good six months after their deletion; until then we keep them so that a moderation decision can still be challenged and reviewed (Art. 20 DSA; Art. 6(1)(c) and (f) GDPR).

When you start a generation, we send the data it needs to an AI service provider: the prompt (in the form we prepare), the reference files you chose (images, videos, audio) and the parameters. We store the result in your account. The legal basis is Art. 6(1)(b) GDPR.

The company, address and the basis of the transfer for each provider are listed in section 18. The AI service providers act as our processors (Art. 28 GDPR). According to Runware, it does not use the data it receives to train models. [[PLACEHOLDER: conclude a DPA with Runware (enterprise contract only) and World Labs (not public, request it); set the training opt-out in the World Labs and ElevenLabs (“Data use”) accounts — only then state here that they do not use inputs for training either]]

Depending on the model chosen, Runware passes requests on to the operator of the model. [[PLACEHOLDER: obtain the list of sub-processors/model operators and their countries from Runware; Runware publishes none]] The model catalogue in the app shows which models are available.

The provider makes the results available briefly on its own servers (assets.runware.ai) before we move them into our storage. According to Runware, these files are deleted after 7 days.

Marking as AI-generated. Under Art. 50(2) of the AI Act (Regulation (EU) 2024/1689) we must mark generated content as AI-generated in a machine-readable way. For this we write a signed C2PA manifest (“Content Credentials”) into every generated image, video and audio file, with the statement “AI-generated”, the name Pipegen, the model used, the time of creation and a random generation ID; JPEG and PNG images also carry the IPTC value “trainedAlgorithmicMedia” as XMP metadata. The generation ID is a pseudonym: whoever receives the file cannot link it to a person without our data; we can link it to our account record (e.g. after a report). Prompts, names or e-mail addresses are not included. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 50(2) AI Act.

You pay subscriptions and credit packs through Stripe (Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland). You enter payment data (e.g. the card number) directly at Stripe; we do not receive it. We send Stripe your e-mail address, an internal customer ID and your user ID and receive the payment status, invoice and subscription data from Stripe. Legal basis: Art. 6(1)(b) GDPR (processing the payment), (c) (retention under tax and commercial law), (f) (fraud prevention). Stripe processes data for fraud detection and its own legal obligations partly as a controller of its own; Stripe's privacy policy applies to that.

Before a purchase you confirm that the service should start before the withdrawal period ends; we store this declaration with its time and text version as proof (Art. 6(1)(c) and (f) GDPR). Declarations made through the pages “Withdraw from contract” and “Cancel contracts here” are stored for handling and as proof (Art. 6(1)(c) GDPR).

We send notifications, contract confirmations, the confirmation of an account deletion and messages about content reports (section 19 g) by e-mail through Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as our processor. The e-mail address, name and content of the message are transmitted (Art. 6(1)(b), (c) GDPR). E-mails for signing in (confirmation, password reset) are sent by Supabase Auth (section 5) through the e-mail delivery of Resend (SMTP). You choose in the settings which notifications you receive by e-mail; security notifications are always sent.

To find and fix errors we use Sentry (Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA; data region EU (Frankfurt, Germany)). When an error occurs, technical details are transmitted: the error message, the sequence of events, browser and operating system, the address visited (without the part after “#”) and — if you are signed in — your internal user ID, not your e-mail address and not your IP address. The data goes through our own server (/monitoring) to Sentry. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in an error-free platform). You can object (section 21).

Session replay. Only if you consent to the “Analytics” category does Sentry record the course of a session on a sample basis (session replay); all text is masked and media are hidden. Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG. Retention at Sentry: 90 days (30 days on the free plan), after which Sentry deletes the data.

If you consent to the “Analytics” category, we use PostHog (PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA; servers of PostHog's EU Cloud in Frankfurt am Main, Germany) to understand how Pipegen is used: pages viewed, selected events (e.g. completing the introductory tour), device and browser data. PostHog stores identifiers in your browser (“ph_*”) for this. Without your consent PostHog is not started. Pages with secret identifiers in their address (pairing the phone camera) are never recorded. Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG. You can withdraw your consent at any time through “Cookie settings” in the footer of the website or in the profile menu of the app under “Legal & privacy”. Retention at PostHog: depending on the plan up to 1 year or 7 years, after which PostHog deletes the data.

If you report a bug or send feedback, we process your text, attachments and technical details (time, page) to look into the problem and to credit a bug bounty (Art. 6(1)(b) and (f) GDPR). If you e-mail us, we process the e-mail to answer it (Art. 6(1)(b) or (f) GDPR); our mailbox is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Retention: until the request is settled, then three years (regular limitation period, §§ 195, 199 BGB); longer only where statutory retention duties apply (§ 257 HGB, § 147 AO).

If you pair a smartphone as a virtual camera with a QR code, we transmit the phone's motion and zoom values to your computer over a real-time channel of Supabase. The pairing code is held only in the address and in the browser session. Sensor data is not stored (Art. 6(1)(b) GDPR).

To protect against abuse, we log security-relevant events (e.g. failed payments, blocks, rate limits) and can block accounts (Art. 6(1)(f) GDPR, where applicable (c)).

We keep notifications (e.g. “Generation finished”) for 30 days and then delete them automatically. We send system messages about your account and contract (e.g. changes to the terms, security warnings) on the basis of Art. 6(1)(b) GDPR.

Without consent we store only what is strictly necessary for a function you explicitly asked for (Section 25(2) no. 2 TDDDG): your sign-in, your cookie choice, the language and theme you picked, drafts and settings of the app and small states of the interface. These entries are read by no one but Pipegen and are not used for analytics. Everything else — product analytics and session replay — only after your consent (Section 25(1) TDDDG).

The forms for registration, sign-in and password reset also load Cloudflare Turnstile (section 6). You can change or withdraw your choice at any time through “Cookie settings” in the footer of the website or in the profile menu of the app under “Legal & privacy”. If you withdraw your consent to analytics, we delete the “ph_*” entries in your browser.

Your data is received only by the following service providers, as far as necessary for the respective purpose, and by authorities, courts or advisers where we are obliged to share it or it is necessary to pursue legal claims (Art. 6(1)(c) or (f) GDPR).

Some service providers are based outside the EU/EEA. We transfer data there only if a condition of Art. 44 et seq. GDPR is met: an adequacy decision of the European Commission (Art. 45 GDPR) — for the USA the decision on the EU-US Data Privacy Framework of 10 July 2023 for companies certified under it, as well as the decisions for the United Kingdom and Israel — or the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can obtain a copy of the standard contractual clauses by writing to info@pipegen.app.

Status of the details: the providers' public pages and the list of Data Privacy Framework participants (dataprivacyframework.gov), checked on 3 November 2026. [[PLACEHOLDER: offer model operators in countries without an adequacy decision (e.g. China) only with standard contractual clauses, or not at all — request the list from Runware]]

Pipegen must not create or deliver prohibited content — in particular no sexual depictions of minors, no sexual content involving real people and no pornographic content (see the Terms). To ensure this we check requests and results automatically. The legal basis is our legitimate interest in not creating or spreading illegal content and in protecting the rights of others (Art. 6(1)(f) GDPR) and — where we are legally obliged to act against illegal content — Art. 6(1)(c) GDPR.

a) Checking your request (prompt check). Before a generation starts, a word filter on our server checks your texts (prompt, instructions of the marker edit, change requests for panoramas, dialogue lines, texts of the time windows in productions, text descriptions for 3D sets, texts for speech). If the text is clearly harmless, the check ends here; no data is passed on. Only if the text contains signals that call for a closer look do we send to the language model Claude (Anthropic) through our service provider Runware: your texts, the @ names of the Characters used with the flags “minor” or “real person” and the type of result. Pictures, your e-mail address or your user ID are not sent. The model only describes what the text asks for; whether the generation is refused is decided by our server by fixed rules.

b) Checking the results (output check). We first place a finished image or video in an intermediate store that only we can access, check it and only then release it into your account. Images are checked by an image classifier on our own server; for videos we extract single frames on our server (at most 20). For image generations through Runware we also use its yes/no signal on whether the image is not safe for work. Only in borderline cases do we send up to four reduced single frames (at most 768 pixels on the longer side) together with the flags “minor”/“real person” to Claude through Runware. We delete the file in the intermediate store after the check, at the latest after about one hour. We do not keep a blocked result; we store only a hash (digital fingerprint) of the file.

c) Face detection on uploaded pictures. When you upload your own pictures, a detection model checks exclusively on our server whether the picture shows a human face. We store only the result “face yes/no” and the time of the check. We create no facial features or templates, do not match faces against each other or against databases and identify no one; no data is passed to third parties. If a picture shows a face, you state whom it shows — a real or an invented person (d); only then can the picture be used for a generation. Legal basis: Art. 6(1)(f) GDPR (protecting the people depicted and enforcing the content rules). Since we only detect whether a face can be seen and no technical processing for unique identification takes place, in our assessment this is not biometric data within the meaning of Art. 4(14), Art. 9(1) GDPR (cf. recital 51 sentence 3 GDPR).

d) Confirming your rights to pictures of people. Before pictures with a face are used for a generation — and always when uploading into a Character — you confirm that you hold the rights to the pictures and the consent of the people depicted, or that they show an invented person. We store this confirmation as proof: your user ID and project, the time, the version of the confirmed text, the occasion, the files and Characters concerned and your statement “real person” or “invented person”. We do not store details about the person depicted (name, contact). You cannot change a statement “real person” to “invented” yourself. We also store whether you have marked a Character as “under 18”; this mark can only be removed through support. Legal basis: Art. 6(1)(f) GDPR (proof towards the people concerned and authorities, defence of legal claims). Retention: as long as your account exists and then until the end of the third year after its deletion (regular limitation period, §§ 195, 199 BGB); then we delete the proofs automatically.

e) Log of the content check. If a request or result is refused, the check cannot be completed or the language model decided, we store an entry: time, user and project ID, the generation where applicable, type and stage of the check, result and category, classifier values, Characters involved, an excerpt of your text (at most 2,000 characters) or, for results, only the hash of the file, and the cost of the check. If you publish an App, we check its cover and example pictures in the same way before publication. Harmless requests passed by the word filter or the local classifier are not logged. Only administrators have access. Purpose: proof, correcting wrong decisions, recognising repeated violations (Art. 6(1)(f) GDPR). If you delete your account, the link to your profile is removed. Retention: 12 months, then we delete the entries automatically — unless an open report about content of the same account or a pending review still needs them.

f) Individual decisions. If the check refuses a request, the generation is not carried out and you are not charged. If the check is unavailable at the moment, the request is not carried out either, for safety. We do not block your account automatically. If you think a refusal is wrong, write to info@pipegen.app; a human will then review it (section 23).

g) Reports of content (Art. 16 Digital Services Act). Anyone — even without an account — can report content to us at pipegen.app/report. We process: the details of the content, the reason and your explanation, your name and e-mail address (optional for reports of child sexual abuse material), your confirmation that the report is made in good faith and — if you are signed in — your user ID; also the ID of the account concerned, our decision with its reasons, the person who decided, any note about informing law enforcement authorities and the times of the e-mails sent. We do not store an IP address; to prevent abuse we count reports per IP address briefly in memory. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 16, 17 and 18 of Regulation (EU) 2022/2065 (DSA). Reports are reviewed by a human. We do not tell the person concerned who reported. We send the related e-mails through Resend (section 10). Retention: 2 years after our decision, then we delete the report automatically; open reports stay until the decision. E-mails to you are sent in the language of the form (German or English), which we store with the report for this.

h) Recipients. Only in a) and b) in borderline cases does data go to Runware and Anthropic (section 18). Face detection, image classifier and frame extraction run on our server; the log, proofs and reports are stored with Supabase (section 5).

We delete data as soon as it is no longer needed for its purpose, taking statutory retention periods into account.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3) GDPR). Write to us at info@pipegen.app.

Right to object (Art. 21 GDPR). Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Complaint. You can lodge a complaint with a supervisory authority (Art. 77 GDPR), e.g. with the authority responsible for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany.

For the account and the contract we need your e-mail address and — for a subscription — payment processing through Stripe. Without this data we cannot provide Pipegen to you. All other details are voluntary.

The content check (section 19 a, b) refuses individual generations automatically. In our assessment this is not a decision that produces legal effects concerning you or similarly significantly affects you (Art. 22(1) GDPR): only the single request is not carried out, nothing is charged and your account is not restricted. Regardless of this, you can ask for a human to review the refusal, express your point of view and contest the decision (cf. Art. 22(3) GDPR) — by e-mail to info@pipegen.app. The logic: fixed rules for sexual content involving minors, real people and explicit depictions (see the Terms). Blocking an account is always decided by a human.

We adapt this policy when Pipegen or the law changes. The version published here applies.