Privacy Policy

1. Introduction

At Replicape ("we", "us", or "our"), we respect your privacy and are committed to protecting your personal data in accordance with applicable data protection laws.

This policy describes what data we collect, for what purpose, how we protect it, and what your rights are. By using Replicape, you accept the practices described in this policy.

2. Data We Collect

2.1 Data you provide directly

• Registration data: Name, email address, profile photo (processed by Clerk)
• Content: Images you upload for processing
• Payment data: Transaction information (processed by Mercado Pago, we do not store card data)
• Communications: Messages you send us by email or contact forms

2.2 Data collected automatically

• Usage data: Pages visited, features used, time of use
• Technical data: IP address, browser type, operating system, device
• Cookies: Session identifiers and preferences (see Cookie Policy)

3. Legal Basis and Purpose of Processing

We process your personal data based on the following legal bases:

4. Image Processing

Images you upload are processed by third-party artificial intelligence services. Important:

• Images are processed in real-time and deleted from processing servers after generating the result
• Processed images are stored in your personal gallery for a limited time
• We do not use your images to train our own AI models
• Images are shared only with providers necessary for processing

User responsibility: You are solely responsible for ensuring you have the necessary rights over the images you upload. Replicape does not verify ownership or rights over images and assumes no responsibility for intellectual property infringements. For more information, see our Terms of Service.

5. Data Processors

We share data with the following providers who act as data processors under our instructions:

• Clerk (USA): Authentication and account management
• Google - Gemini AI (USA): AI image processing
• UploadThing (USA): Image storage
• Mercado Pago (Argentina): Payment processing
• Vercel (USA): Hosting and analytics
• Turso (USA): Database

We do not sell or rent your personal information to third parties for marketing purposes.

6. International Data Transfers

Important notice: Your data may be transferred and processed on servers located in the United States, where some of our service providers are located.

By using our service, you expressly consent to the international transfer of your data to these providers.

We guarantee that:

• All our providers have signed data processing agreements
• They implement adequate technical and organizational security measures
• They comply with recognized security certifications (SOC 2, ISO 27001, etc.)
• Some providers adhere to the EU-US Data Privacy Framework

If you do not agree with the international transfer of your data, unfortunately you will not be able to use the service, as it is technically necessary for its operation.

7. Data Retention

We retain your personal data for the time necessary to fulfill the described purposes:

• Account data: While your account is active, plus 30 days after deletion
• Gallery images: According to your plan limits (maximum 100 images), automatically deleted when exceeding the limit or when deleting your account
• Processing logs: 90 days for debugging and support purposes
• Billing data: According to tax requirements
• Communication data: 2 years from the last communication

8. Your Rights

According to applicable data protection laws, you have the following rights over your personal data:

• Access: Request information about what data we have and how we use it.
• Rectification: Correct inaccurate or incomplete data
• Update: Keep your data up to date
• Deletion: Request deletion of your data when no longer necessary or when you withdraw consent
• Confidentiality: That your data be treated with due confidentiality

9. Data Security

We implement technical and organizational security measures to protect your personal data:

• Encryption in transit (HTTPS/TLS 1.3)
• Encryption at rest for sensitive data
• Secure authentication via Clerk (MFA available)
• Restricted access to personal data (principle of least privilege)
• Security monitoring and access logs
• Encrypted backups with limited retention
• Providers with security certifications (SOC 2, ISO 27001)

No system is 100% secure. We recommend using strong passwords, enabling two-step verification when available, and not sharing your credentials.

10. Minors

The service is intended for persons 18 years or older. We do not intentionally collect data from minors under 18. If you are a parent or guardian and believe your minor child has provided us with personal information, contact us immediately through the contact form to proceed with its deletion.

11. Changes to this Policy

We may update this policy occasionally. We will notify you of significant changes by email at least 15 days in advance. We recommend reviewing this page periodically.

The "last updated" date at the beginning indicates when the last changes were made.

12. Supervisory Authority

If you believe that the processing of your personal data violates applicable regulations, you have the right to file a complaint with the relevant data protection authority in your jurisdiction.

13. Contact

For questions about privacy and data protection, contact us through the contact form.