MaybeReal - Privacy Policy
1. Who is responsible for your data
MaybeReal (the "App") is operated by Cerebri Virtual Corporation, a French société par actions simplifiée registered under number 100 370 469, RCS Paris, with its registered office at 60 rue François 1er, 75008 Paris, France ("we", "us", "our"). We are the controller of the personal data described in this policy.
For any question about this policy or to exercise your rights, contact support@maybereal.app.
We have not appointed a Data Protection Officer. The address above reaches the people responsible for data protection at Cerebri Virtual Corporation.
This policy forms part of your agreement with us, alongside our Terms of Use.
2. What the App does with your content
MaybeReal lets you upload photos and videos, and generate new ones, using AI models: prank and humorous scenes, character and style transformations, animals and objects added to your photos, cinematic scenes, talking avatars, photo enhancement, restoration and colourisation, and video generated from a text prompt or from a reference image.
To produce a result, your uploaded content is sent to external AI providers, processed, and returned to you. That is the core of the service, and it is why the sections below on sharing and on international transfers matter more here than in most apps.
3. What we collect
3.1 Account data
- Email address and authentication identifiers, to create and secure your account.
- Basic profile information if you sign in through Apple or Google, limited to what that provider releases.
3.2 Content you upload and content the App generates
- Photos, videos and other media you upload.
- Text prompts you write.
- Outputs generated for you, including previews and thumbnails.
- Technical processing metadata: request identifiers, processing status, timestamps, model used.
3.3 Images and videos containing faces
Most of what the App does involves faces, so this deserves its own section.
What we handle. The images and videos you upload, which may contain your face or someone else's. The face data is the media itself. We do not extract, create or store separate biometric identifiers such as face templates, embeddings or faceprints, and we do not use face data to identify or authenticate anyone.
How it is used. Only to produce the transformation you asked for. Where face detection runs for alignment or framing, the derived data (bounding boxes, landmarks) exists only during processing and is not stored. Face data is never used for advertising, marketing or profiling.
Faces of other people. If you upload media showing someone else, you are responsible for having their consent, as set out in section 5.3 of the Terms of Use. In several countries, including under the GDPR, processing another person's facial image can require their explicit consent. We process that media on your instruction.
Retention on our systems. Uploaded media and generated results are stored in Supabase Storage behind time-limited signed URLs and deleted automatically after up to 48 hours.
Retention by our AI providers. A file deleted from our systems is not automatically deleted by the provider that processed it. We set the media held by fal.ai to expire after 48 hours, in line with our own retention. Technical records of requests, and the retention applied by our other AI providers, follow their own rules. Section 6.2 gives the detail.
3.4 Purchases and subscriptions
- We use RevenueCat to manage subscriptions and in-app purchases. It receives an anonymous user identifier and your subscription status, never your content.
- Payments are processed by Apple or Google. We never receive or store your card details.
- We keep records of transactions where accounting and tax law requires it.
3.5 Usage and device data
- Device model, operating system version, app version, language, approximate timestamps.
- Which features you use, how often, and whether generations succeed or fail.
- Crash and performance diagnostics.
3.6 Advertising and measurement
We advertise MaybeReal on third-party platforms and measure which campaigns bring new users. The App integrates the Meta (Facebook) software development kit, which can collect advertising identifiers and app events such as installs and sessions, and share them with Meta Platforms.
On iOS, this tracking only happens if you allow it when the App shows the App Tracking Transparency prompt. In the EEA and the UK, we rely on your consent for advertising and measurement, and you can withdraw it at any time in your device settings or in the App.
4. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account, running the App, producing the results you request | Performance of the contract |
| Processing images and videos containing faces to apply the effect you chose | Performance of the contract, and your explicit consent where local law treats facial images as biometric data |
| Managing subscriptions, purchases and credits | Performance of the contract |
| Keeping the service secure, preventing fraud, abuse and credit-system manipulation | Our legitimate interest in protecting the service |
| Moderating content to block illegal material | Legal obligation, and our legitimate interest |
| Diagnostics, stability and improving the App | Our legitimate interest |
| Advertising, attribution and measurement | Your consent |
| Accounting, tax and responding to legal claims | Legal obligation, and our legitimate interest |
5. Content moderation
Uploads and generated outputs are screened by automated systems, including the moderation provider named in section 6.3, to detect illegal content, particularly material sexualising minors, and other content prohibited by our Terms of Use. A detection may block a generation, and repeated or serious detections may lead to suspension or closure of your account.
Where such a decision is made automatically and significantly affects you, you may ask for human review, express your point of view and contest the decision, by writing to the address in section 1.
6. Who we share it with
We do not sell your personal data. We share it only with the providers below, who act on our instructions.
6.1 Infrastructure
- Supabase (database, authentication, storage) - privacy policy
- Google Cloud Run (backend hosting and processing) - privacy policy
6.2 AI processing providers
Your uploaded media and prompts are sent to these providers so they can generate the output you requested, and only for that purpose:
- fal.ai - privacy policy
- OpenAI - privacy policy
These providers process your content on our instructions, to produce the result you asked for. Content submitted to OpenAI through its API is not used to train its models. For fal.ai, our agreement governs what may be done with the content we send, and fal reserves rights over anonymised and aggregated data derived from the use of its service.
How long they keep it. Each provider applies its own retention. We set the media held by fal.ai to expire after 48 hours, matching our own retention. Until it expires, a generated or uploaded file on their content delivery network is reachable by anyone holding its URL. Technical records of requests, and the retention applied by OpenAI, follow their own rules. Ask us using the address in section 1 if you want the current position for a specific provider.
6.3 Content moderation provider
- Sightengine (Kozelo SAS, Paris, France) - privacy policy. Uploaded and generated media is sent to Sightengine to detect illegal and prohibited content, as described in section 5.
6.4 Subscriptions and platforms
- RevenueCat (subscription management) - privacy policy
- Apple, for sign-in, payments and subscriptions on the App Store - App Store and privacy
- Google, for sign-in, payments and subscriptions on Google Play - privacy policy
6.5 Others
We may disclose data where the law requires it, to respond to a valid request from an authority, or to establish, exercise or defend legal claims.
7. International transfers
Several of the providers above operate outside the European Economic Area, including in the United States. Where we transfer personal data outside the EEA, we rely on the European Commission's standard contractual clauses, or on an adequacy decision where one covers the provider. You can ask us for details of the safeguards in place using the contact address in section 1.
8. How long we keep it
| Data | Retention |
|---|---|
| Account data | While your account is active, then deleted on request or after a prolonged period of inactivity |
| Uploaded media and generated results, on our systems | Up to 48 hours, then deleted automatically |
| Media held by fal.ai | 48 hours, set by us on each request |
| Request records and media held by our other AI providers | Under each provider's own rules. See section 6.2 |
| Subscription and purchase records | As long as needed to manage the subscription, and as required by accounting and tax law |
| Logs and technical data | Normally no more than 90 days |
| Moderation records of blocked content | As long as needed to enforce our Terms and meet legal obligations |
9. Security
We use access controls on backend systems and storage, signed and time-limited URLs for temporary access to media, encryption in transit, and regular review of our practices. No system is completely secure, and we cannot guarantee absolute security, but we work to protect your data and will notify you and the competent authority where the law requires it after a breach.
10. Your rights
Depending on where you live, you can ask us to give you access to your data, correct it, delete it, export it in a portable format, restrict how we use it, or object to processing based on our legitimate interests. Where processing is based on your consent, you can withdraw that consent at any time, without affecting what we did before.
Write to support@maybereal.app. We answer within one month, and will tell you if we need longer.
You can delete your account from within the App. Deleting your account does not cancel a subscription: cancel that through Apple or Google, as explained in section 9.4 of the Terms of Use.
Complaints. If you think we have handled your data wrongly, you can lodge a complaint with a supervisory authority. In France that is the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris CEDEX 07, cnil.fr. If you live elsewhere in the EEA or the UK, you can complain to the authority in your own country.
11. Children
The App is not intended for children under 13, or under the higher age required in your country. Section 3 of the Terms of Use explains the age requirement in full. We do not knowingly collect personal data from a child below that age. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy. We will change the date at the top, and where a change is material we will tell you in the App or by email before it takes effect.
13. Contact
Cerebri Virtual Corporation, 60 rue François 1er, 75008 Paris, France
support@maybereal.app