Privacy Policy

The controller is MakeMeFy OOD, UIC 208906259, VAT ID BG208906259, registered at 48 General Zhostov St., entrance Zh, apartment 114, Nadezhda District, 1220 Sofia, Bulgaria. Our office and correspondence address is 7 Strazhitsa St., Nadezhda 2, 1220 Sofia, Bulgaria. Contact office@makemefy.com.

• Account: email, identifier, sign-in and session data. We cannot read your password.
• Requests and orders: name, email, optional phone, delivery address, items, configurations, quantity, price, status and communications.
• Customer files: submitted model or image, file name and size, technical data, description, intended use and review result.
• AI and subscription: prompts, uploaded images, generated results, model settings, job status and technical data, credit movements, selected plan, billing period and subscription status.
• Payment and delivery: payment status and identifier, billing data and shipment information. We do not receive the full card number or security code.
• Measurement: with consent, page and section views, site interactions, random tab-session identifier, language, device category, referral domain and campaign tags. Subscription checkout and activation also create account-linked server events.
• Technical data: IP address, browser, device, date and time, security and diagnostic logs where generated.

• To create an account, record a request, review it and prepare a quote at your request.
• To accept payment, make, deliver and support an order under the contract.
• To generate AI results, account for credits and manage the plan under the contract.
• To keep accounting, tax, consumer and product records required by law.
• To secure the service, prevent abuse, protect rights and improve reliability under our legitimate interests.
• For optional browser measurement or marketing messages only with separate consent where enabled; browser measurement can be turned off on the cookie page.
• For server records of checkout starts and subscription activation to perform and prove the contract, secure payments and protect legal claims; these are not anonymous browser events.

Custom-request files and unpublished AI results are kept in private storage and are available only to the customer and authorised people reviewing or fulfilling the request. We check their format, safety and suitability. We do not publish them in a catalog, advert or gallery without separate permission.

We disclose only what is necessary to:

• Supabase for accounts, database and private file storage.
• Hosting, security and technical infrastructure providers.
• An email provider when sending request or order messages.
• A payment provider when you choose electronic payment or a subscription.
• An AI processing provider receives only the prompts, images and settings needed for the requested operation; the result may also be processed according to the chosen function.
• A courier when a shipment must be delivered or returned.
• Accountants, professional advisers and public authorities where legally required.

We do not sell personal data.

Some providers may process data outside the EEA. Where they do, we rely on an applicable GDPR safeguard such as an adequacy decision, standard contractual clauses or another recognised mechanism and limit data to what the service needs.

• Account data is kept while the account is active. On closure, data not needed for an order, legal duty or dispute is deleted or anonymised.
• AI jobs, outputs, credit movements and subscription history are kept while needed for the service, charge verification, complaints, legal duties or disputes. Closing an account does not erase mandatory payment and accounting records.
• Requests and files are kept while needed for quotation, fulfilment, support and legal claims, then reviewed and deleted when those purposes end.
• Payment, delivery and accounting documents are kept for periods required by Bulgarian tax and accounting law.
• Technical logs are kept as needed for security, diagnosis and abuse prevention, then deleted or anonymised.

Where applicable, you may request access, a copy, correction, deletion, restriction or portability and object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing.

Contact office@makemefy.com. We respond without undue delay and within one month unless the GDPR allows an extension and we notify you. You may also complain to the Bulgarian Commission for Personal Data Protection.

We may automatically flag a risky request or file for additional review. We do not take a legal or similarly significant customer decision solely by automated processing; a person reviews the quote or refusal.

We use access controls, private storage and technical safeguards. The service is intended for adults and we do not knowingly collect child data for an independent order. We update this notice before materially changing purposes or recipients. See the Cookie Policy for browser storage.