OpenLoRA Privacy Policy
DRAFT FOR REVIEW — NOT YET EFFECTIVE. Draft version: 2026-10-29-v1.1. Effective date: [TO CONFIRM: publication and effective date]. This draft contains unresolved operational disclosures and must not be published with placeholders.
1. Who is responsible
The controller or organization responsible for personal information is [TO CONFIRM: operator's legal name, place of establishment, public address and required registration information], operating OpenLoRA at https://openlora.org. Privacy contact: mail@openlora.org. Data protection officer and EEA/UK or other local representative details: [TO CONFIRM: determine whether required and identify appointees if applicable].
This policy covers visitors, account holders, service users and people who contact us or whose information is submitted to us. It explains information processing separately from acceptance of our service contract.
2. Information and sources
| Category | What it includes | Source |
|---|---|---|
| Account identity | Google account identifier and issuer, verified email address, internal account ID and account status | Google when you choose sign-in; our account system |
| Sessions and security | Session token digests, anti-forgery tokens, sign-in state and timing, sign-in attempt information and a hashed connection identifier | Your device, authentication exchanges and our security systems |
| Activity | Viewed gallery/prompt IDs and timestamps, feature requests, task identifiers, status and delivery records | Your use of the service |
| Creative materials | Prompts, uploaded photos, training datasets, trigger words, custom LoRA weights/configurations and generated images | You, users instructing the service, and the model processing your request |
| Transaction information | Credit balances, reservations and settlements, orders, deposit addresses, transaction hashes, token/network, amounts and confirmation state | You, our billing system and public blockchain data |
| Communications | Email address, messages, complaints, permission evidence and information necessary to handle a request | You or an authorized representative/reporting person |
| Invitations | Invited email address, invitation status and dates, delivery status, and the associated account after acceptance | The person inviting you, email delivery provider and your actions |
| Connection and device information | IP address, approximate country derived from IP, request paths/times, browser/device information and security diagnostics | Network requests and hosting/delivery providers |
| Age and acceptance information | Confirmation that you meet the minimum age, terms version, acknowledgment time and account/session association | Your explicit actions in the entry and registration controls |
The entry and registration controls record the policy version and server timestamps in the application session. Registration acceptance is associated with your account when you sign in. Country restrictions use IP-derived country information supplied by the hosting and delivery services. [TO CONFIRM: infrastructure logging fields and retention.]
Our current Google integration requests identity and email scopes, not access to your Gmail messages, contacts or Google Drive. We do not ask for wallet seed phrases or private keys. A publicly visible transaction may still be personal information when associated with an identifiable account.
Do not upload identification documents, health records, intimate images, other sensitive information or images of minors. Portraits and models reproducing a person's likeness can be personal information. We do not offer facial-recognition identification through this service, but this does not mean that all portrait processing is legally non-sensitive. Where a proposed feature requires sensitive or biometric processing, a lawful basis, assessment and any required separate consent must be established before collection.
3. Purposes and legal grounds
We use information only for specified purposes. Where EEA/UK data protection law applies, our proposed grounds are:
| Purpose | Information needed | Applicable ground, subject to local assessment |
|---|---|---|
| Create and maintain your account and requested session | Identity, session and security data | Steps you request before a contract and performance of the service contract |
| Show requested history and provide training/generation/storage | Activity and creative materials needed for that feature | Performance of your contract; an additional basis is required for another person's data or specially protected data |
| Process purchases, credit accounting and delivery | Transaction data and relevant service records | Contract; legal obligation for records that law requires us to keep |
| Prevent abuse, protect accounts and apply age/regional restrictions | Proportionate security, country and age-confirmation information | Legitimate interests in a secure, restricted service; legal obligation only where a specific law requires the processing |
| Respond to support and rights requests and address harmful material | Contact information and relevant evidence | Contract where appropriate; legitimate interests in handling reports; applicable legal obligations |
| Send a requested invitation and control access | Invited email, invitation and delivery status, and verified account identity | Legitimate interests in providing requested invitations and protecting access, subject to local assessment |
| Optional tracking or another purpose requiring consent | Only the data separately described at that time | Consent obtained before that use, withdrawable without affecting earlier lawful processing |
Legitimate interests are subject to necessity, proportionality and balancing against your rights. We do not use contract acceptance as a substitute for required consent. If you do not provide necessary sign-in or payment information, the relevant feature cannot be supplied. Optional choices do not control access to unrelated essential functions.
4. Training, generation and disclosure
When you request training, the selected photos are assembled into a dataset and transmitted to our model provider to create the requested LoRA. When you request generation, the provider receives the prompt and information needed to use your selected LoRA. Results and private model artifacts are stored to provide your account's features. Information can be reviewed by authorized personnel or providers where necessary for security, support, a rights request or legal compliance, with appropriate restrictions.
We do not publish your private uploads or outputs in the public gallery merely because you used the service. Our proposed policy is not to use private uploads, outputs or custom LoRAs for advertising or unrelated general-model training. [TO CONFIRM: verify and document provider contract terms, actual settings, any provider independent purposes and retention; disclose any additional use and establish its legal basis before transfer. Do not publish an unverified promise about provider training.]
Our processing chain identified in the source code includes:
| Provider/service | Function and information involved | Details to complete before publication |
|---|---|---|
| Authentication; Google processes the sign-in and supplies verified identity/email | Relevant Google entity, role, notices and processing locations | |
| Vercel | Website/application hosting, network delivery, request/security information | Contracting entity, function/log locations, retention and DPA |
| Neon/PostgreSQL | Accounts, history and structured application records | Contracting entity, configured database/backup locations and retention |
| Resend | Delivery of requested invitations, including recipient email address, message content and delivery information when the invitation feature is used | Contracting entity, processing locations, retention, transfer safeguards and DPA |
| Cloudflare R2/delivery services | Gallery delivery, private uploads, outputs, model artifacts and application storage | Contracting entity, actual location settings, public/private access and retention |
| fal | Training datasets, requested model/generation inputs, job results and related identifiers | Contracting entity, model-specific processors, locations, content handling and deletion terms |
| Blockchain/RPC infrastructure | Relevant addresses, transaction hashes and confirmation queries | Actual RPC providers, query/logging information and locations |
We may also disclose the minimum necessary information to professional advisers, regulators or courts when legally justified, or as part of a lawful organizational transaction subject to appropriate protection and notice. Providers acting on our behalf must be subject to appropriate purpose and security restrictions. Google and public blockchain participants may have independent responsibilities; not every recipient is our processor.
Proposed policy: we do not sell personal information or share it for cross-context behavioral advertising, and do not use sensitive personal information for unrelated profiling. [TO CONFIRM: audit provider contracts, production tags and actual practices before publishing this statement; assess applicable US definitions.] We do not place advertisements or optional tracking through acceptance of these terms.
5. International processing
Your information may be processed outside your country by the services listed above. [TO CONFIRM: name actual recipient countries, entities, transfer routes and the safeguard used for each route; confirm DPA/transfer agreements and access to copies.]
Where required, transfers must rely on an applicable adequacy arrangement, contractual safeguards or another valid legal mechanism, with required assessments and supplementary measures. We will not claim that EU standard contractual clauses, a UK transfer instrument or an Asian local-law transfer condition has been satisfied until the relevant arrangements are actually in place. A generic statement that you accept this policy does not itself authorize all overseas transfers.
You may ask mail@openlora.org for information about applicable safeguards or a copy subject to lawful redaction. Where local law requires specific transfer information and consent, it must be provided and obtained before the affected transfer.
6. Retention and deletion
We retain information only as needed for its stated purpose, required legal records and proportionate security or dispute handling. Retention considers the active service relationship, outstanding requests, the sensitivity of the information and applicable limitation/recordkeeping requirements.
| Record | Draft retention disclosure |
|---|---|
| Application session | Anonymous sessions expire after 30 minutes of inactivity or eight hours from creation. Signed-in sessions expire after 30 days of inactivity or 90 days from sign-in, whichever comes first. Logging out ends the session. These periods do not determine infrastructure log retention. |
| Sign-in attempt/flow | Limited-lived security records; [TO CONFIRM: disclose exact cleanup window and actual deletion behavior] |
| Identity and viewing history | While needed to provide your account/history, then deletion or de-identification under the documented closure schedule; [TO CONFIRM: maximum periods and legal exceptions] |
| Photos, datasets, outputs and LoRAs | Needed to process and provide requested features; [TO CONFIRM: separate maximum periods, provider copies, failed/incomplete jobs and deletion process] |
| Accounting, tax and dispute records | Only for the period required by relevant law or a documented necessary purpose; [TO CONFIRM: operator-specific periods] |
| Age/terms evidence, support and abuse reports | Minimum evidence for compliance and dispute handling; [TO CONFIRM: periods and lawful basis] |
| Infrastructure logs and backups | [TO CONFIRM: actual provider periods, expiry from backups and safeguards while retained] |
Removing an item from the screen or an upload URL expiring does not mean every stored copy is deleted. We do not presently promise immediate, universal or automatic deletion of training sources. On a valid deletion request, we will explain what can be deleted, instruct relevant processors where required, and identify any lawful retention exception. Public blockchain transactions cannot be edited or erased by OpenLoRA; we will still consider deletion of associated information under our control.
7. Your rights and requests
Email mail@openlora.org with your request and the account email or other information needed to locate the record. You do not need to create an account to report information about yourself. We will verify identity proportionately, use an authorized-agent process where required and avoid requesting excessive identification. Do not email a password, seed phrase or an unnecessary copy of an identity document.
Depending on your location and the law that applies, you may have rights to access or obtain a copy, correct, delete, restrict processing, object, receive portable data, withdraw consent and complain to a regulator. Withdrawal does not affect processing lawfully completed before withdrawal. You may object particularly to processing based on legitimate interests. Some requests are subject to lawful exceptions and the rights of others; we will explain a refusal and available review routes.
EEA/UK: where GDPR or UK GDPR applies, we normally respond within one month and give notice of any lawful extension. You may complain to your local supervisory authority and seek judicial remedies. Mandatory protections concerning decisions based solely on automated processing remain available.
United States: where applicable state law grants them, you may exercise rights to know/access, correct, delete, portability, opt out of sale, targeted advertising or covered profiling, and limit specified sensitive-information use. We honor legally required universal opt-out signals for processing to which they apply. Where applicable, you may appeal a refusal by replying to mail@openlora.org with “Privacy appeal”; we will provide the required decision and escalation information. California requests receive the acknowledgments and response times required by law, generally 45 days for a substantive verified request, with permitted extensions and notice. We do not discriminate for exercising a protected right.
Asia-Pacific: applicable local access, correction, deletion, withdrawal, objection, transfer and complaint rights are preserved. Their scope and deadlines differ. Local notices, overseas-transfer details, local representatives and language versions will be supplied where required. [TO CONFIRM: publish completed market-specific supplements, contacts and any required local-language notices before operating on that basis.]
8. Children, regional restrictions and automated controls
OpenLoRA is offered only to people aged 18 or older with appropriate legal capacity. Report suspected use by a minor to mail@openlora.org. If we learn that a child has used the service or supplied information contrary to this restriction, we will restrict access and address the information as required by law, retaining only what is legally justified.
The entry flow records an age declaration rather than a date of birth or identity document. If stronger assurance becomes necessary, we will explain the method, provider, data and retention before introducing it. The mainland-China block uses IP-derived location and does not determine nationality. A proxy, inaccurate database or network configuration can affect the result; contact us for review of an apparent error.
Automated model safety checks may refuse generation and security rules may restrict access. We do not intend these features to make decisions about employment, credit, healthcare or similarly significant matters. You may request review of an account or content restriction. [TO CONFIRM: assess actual automated decisions and document required human review before publication.]
9. Security and updates
We use access controls and other technical and organizational measures appropriate to the risks, including protected application sessions and ownership checks for private resources. No system can guarantee absolute security. We assess incidents and notify affected people and authorities when required by applicable law.
We will date and version this policy, give appropriate notice of material changes and obtain a new consent when required for a new purpose. Questions, complaints, accessibility requests and privacy requests can be sent to mail@openlora.org.