PFPMaker

GDPR overview

GDPR is concretely addressed. The controller is named: Logopony OÜ, registry code 14402347, Tornimäe tn 5, Tallinn, Estonia, so the publisher sits inside the EU and no Article 27 representative is required. Section 7 details EEA rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent and complaint to a local supervisory authority. Legal bases are stated (contract, legitimate interests, legal obligations, consent). Requests go to hi@pfpmaker.com under the subject 'GDPR Data Request', with a 30-day target. Transfers outside the EEA rely on standard contractual clauses, adequacy decisions and the EU-US Data Privacy Framework 'where applicable', deliberately cautious wording. Section 14 adds CCPA rights for Californians, answered within 45 days. Two caveats: no Data Protection Officer is actually named, and section 17 says the policy creates no contractual obligation beyond applicable law. Effective 14 November 2025.

Who owns the data?

Clause 7.1 of the terms is explicit: you retain all ownership rights to the photos you upload, and PFPMaker does not claim ownership of them. It takes only a limited, non-exclusive, worldwide, royalty-free licence, strictly to process your photo through its own systems and its third-party providers. Clause 7.2 then gives you ownership of every image generated or edited with the AI tools, including commercial use, modification, distribution and derivative products, subject to PFPMaker's intellectual property rights in the underlying service. Clause 7.3 bars any marketing or promotional use of your photos without explicit written permission, and you remain responsible for holding the rights to any face you upload.

Reuse rights

You can reuse what you generate without asking anyone: the terms hand you ownership of the output, commercial use included, and the privacy policy says no watermark is intentionally added. On PFPMaker's side, uploaded photos serve to run the tool you asked for, which covers AI processing, storage and delivery of the images, credit accounting, payments and support, plus aggregated and anonymised usage analysis, debugging, model improvement, feature testing and monitoring. Section 3.2 states that uploaded photos and generated images are not currently used to train PFPMaker's own AI models. Images do pass through third-party AI providers, whose published terms say that traffic sent over a paid API is generally excluded from training, an assurance PFPMaker relies on without being able to guarantee it. Personal data is never sold, rented or traded to third parties for marketing. Sharing is described by category of provider only (AI, payment, authentication, email, hosting, analytics), with not one vendor named. Usage metadata is collected (tools used, credits spent, success or failure, processing time) rather than image content, and promotional email is opt-in, while transactional email cannot be unsubscribed from.

Data retention & training

Hosting summary

PFPMaker is operated from Estonia, but section 10.1 of the privacy policy states that it uses service providers located worldwide. Processing may therefore take place in the European Union, where the publisher is established, in the United States, and in the other countries where those providers operate. Section 4.1 confirms that hosting and storage are entrusted to infrastructure providers and that data may be stored in various geographic regions, without naming a single vendor. For transfers outside the EEA, PFPMaker cites standard contractual clauses, adequacy decisions and the EU-US Data Privacy Framework 'where applicable', and states explicitly that it relies on its providers' own declarations and cannot independently verify their compliance. On security, section 8.1 mentions TLS/SSL encryption in transit, hashed passwords, access controls and 'enterprise-grade cloud platforms'. One technical observation, not claimed by the site itself: the web front end is served through Cloudflare, on the anycast IP 104.26.1.243 resolved via a US node.