CoupleLens

GDPR overview

The privacy policy carries a dedicated General Data Protection Regulation Privacy section and states that personal data is handled in strict accordance with applicable privacy law, in particular the GDPR. Six legal bases are listed - consent, performance of the contract, legal obligation, vital interests, public interest and legitimate interests - and payment processing is anchored on Article 6(1)(b). Users located in the EU are told they may request access, rectification, objection, erasure and portability, and withdraw consent. Cross-border transfer to the United States is presented as consented to by accepting the policy. The tooling behind those claims is thin: no Article 27 EU representative is designated, no data protection officer is named, no data processing agreement is offered and no sub-processor list is published. The terms are governed by the law of the People's Republic of China, with HKIAC arbitration in Hong Kong.

Who owns the data?

The terms assign the copyright in generated images to the user who produced them. The same document, however, states that uploading, posting or transmitting content grants FUTURE GENERATOR PTE. LTD. and its affiliates a worldwide, perpetual, irrevocable and royalty-free licence, with the right to sub-license it to third parties. Original images the user chooses to publish publicly may also be used by the platform for model operations and learning; images kept unpublished may not be published or used by the platform or by other users. Outputs are not guaranteed unique either: the underlying models are described as open source under an MIT licence and customised by the publisher, so other users may obtain similar results.

Reuse rights

Because the copyright in generated images is assigned to the user who created them, outputs can be downloaded, reused and shared without asking further permission; the publisher's own promotional display right applies only to content published publicly on the platform. On the collection side, CoupleLens gathers an email address, a phone number and a password, plus usage logs covering IP address, browser, carrier, language, dates and pages visited. Payment runs through Stripe, so the publisher receives neither card numbers nor card storage, only the fact of payment, the last four digits and the country. Facial photos follow a stricter regime: only the picture you deliberately upload is processed, with no biometric identifier or facial template extracted or stored. Data may be shared with service providers, affiliated companies including the parent company, and commercial partners, and usage data may be shared with Apple in certain circumstances to verify account activity. Cookies, web beacons and flash cookies support the experience and usage analytics.

Data retention & training

Hosting summary

The privacy policy is explicit on one point: all personal data processed is transferred to, processed and stored in the United States, where the company says its headquarters and main servers are located. That cross-border transfer is presented as consented to by accepting the policy, and no transfer mechanism or standard contractual clause is named. Nothing more precise is given: no region, no named data centre, no cloud provider. Network checks are consistent with a US footprint, the site resolving to an address in Santa Clara, California, on AS132203 (Tencent). The publisher itself, FUTURE GENERATOR PTE. LTD., is a Singaporean entity, so the corporate jurisdiction and the hosting jurisdiction differ, and the terms of service introduce a third by choosing the law of the People's Republic of China. No trust or security page exists and no certification such as SOC 2 or ISO 27001 is claimed. Payment data does not sit with the publisher at all: Stripe handles the transaction, and only the fact of payment, the last four card digits and the country come back.