Privacy Policy

1. Introduction

Welcome to Raelume ("we," "our," or "us"). Raelume is operated by Moonblocks B.V., a Netherlands-based company registered under Dutch law (KvK (Dutch Chamber of Commerce) 89176960). We operate an AI-powered workflow canvas platform that enables users to create, edit, and manage content across text, images, video, and 3D media.

We are committed to protecting your privacy and personal data in accordance with the General Data Protection Regulation (GDPR), the Dutch Uitvoeringswet Algemene Verordening Gegevensbescherming (Dutch GDPR Implementation Act), and other applicable privacy laws worldwide, including the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

This privacy policy explains how we collect, use, store, share, and protect your personal data when you use our services. By using Raelume, you acknowledge that you have read and understood this policy.

2. Information We Collect

2.1 Personal Information You Provide

• Account Information: Email address, name, username, password (encrypted)
• Profile Information: Display name, profile picture, bio, preferences
• Payment Information: Billing address, payment method details (processed securely through Polar; we do not store full credit card numbers)
• Communication Data: Support tickets, feedback, survey responses, email correspondence

2.2 Content and Usage Data

• Workflow Content: All content you create, upload, or generate through our platform, including:
  • Text prompts and generated text content
  • Images (uploaded or AI-generated)
  • Videos (uploaded or AI-generated)
  • 3D models and assets
  • Workflow configurations and connections between nodes
• Metadata: Creation dates, modification dates, file sizes, file types, workflow structure
• Usage Data: Features used, frequency of use, time spent, actions performed, error logs
• AI Model Interactions: Which AI models you use, parameters you set, generation history

2.3 Automatically Collected Information

• Technical Data: IP address, browser type and version, device type and ID, operating system, screen resolution
• Cookies and Tracking: Session cookies, preference cookies, analytics cookies (see Section 10 for detailed cookie policy)
• Log Data: Access times, pages viewed, referring URLs, clickstream data
• Performance Data: Page load times, error messages, system performance metrics

2.4 Information from Third Parties

• Authentication Providers: If you use social login (e.g., Google, GitHub), we receive basic profile information they provide
• Payment Processors: Transaction confirmations and payment status from Polar (merchant of record)

3. Legal Basis for Processing (GDPR)

Under GDPR Article 6, we process your personal data based on the following legal grounds:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide our services, manage your account, process payments, and fulfill our Terms of Service
• Legitimate Interests (Art. 6(1)(f)): Improving our services, preventing fraud and abuse, ensuring platform security, conducting analytics, and carrying out the limited business outreach described below (where these interests are not overridden by your rights)
• Legal Obligation (Art. 6(1)(c)): Complying with tax laws, responding to legal requests, maintaining records as required by law
• Consent (Art. 6(1)(a)): Consent-based marketing communications, optional cookies, and sharing your public workflows (you may withdraw consent at any time)

4. How We Use Your Information

4.1 Service Delivery

• Creating and managing your account
• Providing access to AI workflow canvas tools
• Processing AI generation requests through third-party models
• Storing and retrieving your workflows and content
• Enabling collaboration and sharing features
• Processing payments and managing subscriptions

4.2 Service Improvement

• Analyzing usage patterns to improve user experience
• Developing new features and functionality
• Testing and debugging platform performance
• Conducting research and analytics (anonymized where possible)

4.3 Communication

• Sending service-related notifications (account changes, billing, security alerts)
• Providing customer support and responding to inquiries
• Sending product updates and new feature announcements (with opt-out option)
• Conducting user surveys and gathering feedback (optional)

4.4 Security and Legal Compliance

• Detecting and preventing fraud, abuse, and security threats
• Enforcing our Terms of Service and Acceptable Use Policy
• Complying with legal obligations and responding to lawful requests
• Protecting our rights, property, and safety, and those of our users

5. Third-Party AI Services and Data Processing

5.1 Text Generation Providers

• Purpose: Text generation, chat functionality, prompt enhancement, content analysis
• Data Shared: Text prompts, conversation history (within workflow context)
• Location: United States
• Data Protection: Standard Contractual Clauses (SCCs) for international transfers; Data Processing Agreements (DPAs) in place
• Training Policy: Commercial API providers do not use customer data for model training
• Retention: Prompts and responses are typically retained for 30 days or less for abuse monitoring and debugging, then deleted

5.2 Image, Video, and 3D Generation Providers

• Purpose: AI image generation, video generation, 3D model creation, image editing, upscaling, background removal, and other visual content manipulation
• Data Shared: Text prompts, input images, input videos, generation parameters, style preferences
• Location: United States
• Data Protection: Standard Contractual Clauses (SCCs) for international transfers; Data Processing Agreements (DPAs) in place or being confirmed
• Training Policy: Commercial API providers do not use customer data for model training
• Retention: Generated content and prompts are typically retained for 30 days or less for operational purposes, then deleted

5.3 General AI Provider Practices

All third-party AI providers we work with:

• Are subject to Data Processing Agreements (DPAs) that ensure GDPR compliance
• Use Standard Contractual Clauses (SCCs) for data transfers from the EU to the United States
• Implement industry-standard security measures (encryption, access controls, monitoring)
• May automatically flag content that violates their acceptable use policies (illegal content, NSFW, violence, hate speech)
• Retain data temporarily for operational purposes (abuse prevention, debugging) before automatic deletion
• Do not use commercial API data to train or improve their AI models

We regularly review our AI providers to ensure they maintain high standards of data protection and privacy. You can request more information about specific providers by contacting [email protected].

6. Data Sharing and Disclosure

6.1 Service Providers (Data Processors)

We share data with trusted service providers who help us operate our platform:

• Hosting and Infrastructure: Railway (hosting), Cloudflare (CDN, R2 storage, security), Supabase (database, authentication)
• Payment Processing: Polar (merchant of record, payment processing, subscription management, tax compliance)
• AI Services: Third-party AI model providers for text, image, video, and 3D generation (as detailed in Section 5)
• Email Services: Email service providers for transactional and notification emails
• Customer Support: Support ticketing systems for handling user inquiries

All service providers are contractually bound to protect your data and use it only for the purposes we specify. We maintain Data Processing Agreements (DPAs) with all processors handling personal data.

6.2 Public Sharing (User-Initiated)

• When you choose to make a workflow public, it becomes viewable by anyone with the link
• Public workflows may appear in our community gallery or search results
• You can change workflow visibility settings at any time from private to public or vice versa

6.3 Legal Requirements and Protection

We may disclose your information if required by law or to:

• Comply with legal obligations, court orders, or government requests
• Enforce our Terms of Service or investigate potential violations
• Detect, prevent, or address fraud, security, or technical issues
• Protect the rights, property, or safety of Raelume, our users, or the public
• Respond to valid GDPR data subject requests from supervisory authorities

6.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you via email and/or prominent notice on our platform before your data is transferred and becomes subject to a different privacy policy.

7. International Data Transfers

As a Netherlands-based company, we primarily store data within the European Economic Area (EEA). However, some of our service providers are located in the United States and other countries outside the EEA.

7.1 Safeguards for International Transfers

• Standard Contractual Clauses (SCCs): We use EU-approved Standard Contractual Clauses for transfers to the United States and other non-EEA countries
• Data Processing Agreements: All processors handling EU data have signed DPAs with appropriate security and privacy commitments
• Adequacy Decisions: Where available, we rely on EU Commission adequacy decisions for certain countries
• Additional Safeguards: Encryption in transit and at rest, access controls, regular security audits

7.2 Specific Transfer Locations

• United States: AI model providers for text, image, video, and 3D generation (protected by SCCs and DPAs)
• European Economic Area: Primary data storage (Supabase EU region), Polar (GDPR-compliant payment processing)
• Railway: Hosting infrastructure with GDPR-compliant DPA available; supports multiple regions
• Global CDN: Cloudflare (edge locations worldwide with EU data residency options)

8. Data Retention

8.1 Active Accounts

• Account Information: Retained for the duration of your account plus 90 days after account closure
• Workflow Content: Retained indefinitely while your account is active, or until you delete specific workflows
• Payment Records: Retained for 7 years to comply with tax and accounting regulations
• Usage Logs: Retained for 12 months for service improvement and security purposes

8.2 Inactive Accounts

• If your account is inactive for 24 months, we will send an email warning before deletion
• After 30 days without response, we may delete your account and associated data
• Free tier accounts may be subject to shorter retention periods

8.3 Account Deletion

• Upon account deletion request, we immediately remove access to your account
• Workflow content is deleted within 30 days
• Backups containing your data are deleted within 90 days
• Some data may be retained longer if required by law (e.g., payment records for tax purposes)
• Aggregated, anonymized analytics data may be retained indefinitely

8.4 Legal Hold

If we receive a valid legal request or are involved in legal proceedings, we may be required to retain your data beyond the standard retention periods until the legal matter is resolved.

9. Your Privacy Rights

9.1 GDPR Rights (EEA/UK Users)

Under the GDPR, you have the following rights:

• Right to Access (Art. 15): Request a copy of all personal data we hold about you
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal data
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing (Art. 18): Limit how we use your data in certain circumstances
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent for processing at any time (where consent is the legal basis)
• Right to Lodge a Complaint: File a complaint with the Autoriteit Persoonsgegevens or your local supervisory authority

9.2 CCPA/CPRA Rights (California Users)

If you are a California resident, you have the following rights under CCPA/CPRA:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and sell
• Right to Delete: Request deletion of your personal information (subject to certain exceptions)
• Right to Opt-Out of Sale: We do not sell personal information, so this right does not apply
• Right to Opt-Out of Sharing: We do not share personal information for cross-context behavioral advertising
• Right to Correct: Request correction of inaccurate personal information
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes requiring opt-out rights
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

9.3 Additional Rights (All Users)

• Account Settings: Update your profile, email preferences, and privacy settings at any time
• Export Workflows: Download your workflows in JSON or other formats from your dashboard
• Delete Workflows: Permanently delete individual workflows or all content
• Opt-Out of Marketing: Unsubscribe from promotional emails using the link in any marketing email
• Cookie Management: Control cookie preferences through our cookie consent banner

10. Cookies and Tracking Technologies

10.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help us provide a better user experience, remember your preferences, and analyze how our service is used.

10.2 Types of Cookies We Use

10.3 Managing Your Cookie Preferences

You can control cookies in several ways:

• Cookie Consent Banner: When you first visit, you can accept or decline non-essential cookies
• Browser Settings: Configure your browser to block or delete cookies (note: blocking essential cookies may prevent the platform from working correctly)
• Opt-Out Links: For specific tracking technologies, we provide opt-out mechanisms

10.4 Do Not Track (DNT)

Some browsers have a "Do Not Track" feature. Currently, there is no universal standard for how to respond to DNT signals. We honor DNT signals by not loading marketing cookies for users with DNT enabled.

11. Data Security

11.1 Security Measures

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Role-based access controls (RBAC) limit employee access to personal data
• Authentication: Secure password hashing (bcrypt), multi-factor authentication (MFA) available
• Infrastructure Security: Regular security audits, penetration testing, vulnerability scanning
• Network Security: Firewalls, DDoS protection, intrusion detection systems
• Monitoring: 24/7 security monitoring and logging of access to sensitive data
• Incident Response: Documented incident response plan for data breaches

11.2 Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of the breach (as required by GDPR Article 33)
• Notify affected users via email without undue delay if the breach poses a high risk to their rights
• Provide details about the nature of the breach, the data affected, and steps we're taking to mitigate harm
• Offer guidance on steps you can take to protect yourself

11.3 Your Security Responsibilities

You also play a role in keeping your account secure:

• Use a strong, unique password and change it regularly
• Enable multi-factor authentication (MFA) if available
• Keep your email account secure (it's used for account recovery)
• Do not share your account credentials with others
• Log out when using shared or public computers
• Report any suspicious activity to [email protected] immediately

12. Children's Privacy

Raelume is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you are under 16, please do not use our service or provide any personal information.

If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that information as quickly as possible.

If you believe we have collected information from a child under 16, please contact us immediately at [email protected].

13. AI-Specific Privacy Considerations

13.1 Content Ownership and Usage

13.2 AI Content Processing

• When you use AI generation features, your prompts are sent to third-party AI services
• These services process your input solely to generate the requested output
• AI providers may temporarily cache your requests for operational purposes (typically 30 days or less)
• Generated content (images, videos, 3D models) is stored on our servers or cloud storage (Cloudflare R2, Supabase)

13.3 AI Model Transparency

• We clearly label which AI model is used for each generation
• You can see model details, pricing, and capabilities before generating content
• We provide information about third-party AI providers in Section 5 of this policy

13.4 Content Moderation and Flagging

• AI providers may automatically flag content that violates their usage policies (e.g., NSFW, violence, illegal content)
• Flagged content may be reviewed by the provider's trust and safety team
• Repeated policy violations may result in account suspension

14. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or service features. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you via email if you have an active account
• Display a prominent notice on our platform for at least 30 days
• For significant changes affecting your rights, we may require you to re-accept the updated policy

We encourage you to review this privacy policy periodically. Your continued use of Raelume after changes are posted constitutes your acceptance of the updated policy.

Previous versions of this policy are available upon request at [email protected].

15. Contact Us

If you have any questions, concerns, or requests regarding this privacy policy or our data practices, please contact us:

16. Additional Information for Specific Jurisdictions

16.1 European Union / European Economic Area

• We comply with GDPR and applicable national data protection laws
• Legal basis for processing: Contract, legitimate interests, legal obligation, consent (as detailed in Section 3)
• Right to lodge a complaint with your local supervisory authority
• Data transfers outside EEA protected by Standard Contractual Clauses

16.2 United Kingdom

• We comply with UK GDPR and Data Protection Act 2018
• UK users can contact the Information Commissioner's Office (ICO) to file complaints
• ICO website: ico.org.uk

16.3 California, United States

• We comply with CCPA/CPRA as detailed in Section 9.2
• We do not sell or share personal information for cross-context behavioral advertising
• California residents can exercise rights by contacting [email protected]
• We do not discriminate against users who exercise their CCPA rights

16.4 Other Jurisdictions

If you are located in a jurisdiction with specific data protection laws not mentioned above, we will make reasonable efforts to comply with applicable requirements. Please contact us at [email protected] with jurisdiction-specific questions.