← Back to Maleki AI
Privacy Policy
Last updated: July 28, 2026
Maleki AI ("we") provides an artificial intelligence photo generation service based on a photo provided by the user ("you"). This page explains what data we process, why, for how long, and what your rights are.
1. Who is responsible for processing your data
Maleki AI, accessible via malekiai.com, is published by Abdelmalek BENALLAL, sole trader (SIRET 897 429 452 00013), data controller within the meaning of the General Data Protection Regulation (GDPR). See our legal notice for the full identity of the publisher. For any question, you can contact us at contact@malekiai.com.
2. Data we process
| Data | Purpose | Legal basis |
|---|
| Photo submitted | AI image generation (style transformation) | Performance of the requested service |
| Email address | Anti-abuse verification of the free trial, sending the result, D+1 follow-up, referral program | Legitimate interest / performance of the service |
| IP address | Limiting the number of free trials per connection (anti-abuse) | Legitimate interest (fraud prevention) |
| Payment data | Processing purchases | Performance of the contract |
Payment data (card number, etc.) never passes through our servers: it is entered and processed directly by our payment provider, Stripe, which is solely responsible for its processing.
3. What we do not do
- We do not resell or share your data with third parties for commercial purposes.
- We do not store your photos on a disk or database: they are processed in memory, for the time strictly necessary for image generation and the associated payment, then automatically deleted (at the latest a few hours after upload for a photo awaiting payment, and 7 days for the generated result, so you can re-download it).
4. Analytics and advertising cookies (Google Analytics, Meta)
The cookie banner shown on your first visit lets you choose, separately, whether to allow Analytics cookies and Marketing cookies. Neither category is active until you choose to allow it — nothing is loaded by default.
- Analytics — Google Analytics: helps us understand how the site is used (pages viewed, general navigation patterns), so we can improve it. It is not used for advertising or ad personalization. Recipient: Google Ireland Limited (see Google's privacy policy and how Google uses information from sites that use its services).
- Marketing — Meta pixel: used to measure the effectiveness of our advertising campaigns and avoid showing you irrelevant ads, when you arrive on the site from one of our Meta (Facebook/Instagram) ads. What is collected: technical browsing data (pages viewed, actions taken such as a trial or a purchase) and, if you make a purchase, an encrypted (hashed, non-readable) version of your email address to improve advertising conversion attribution ("advanced matching"). Recipient: Meta Platforms Ireland Limited, which acts as an independent data controller for its own advertising purposes (see Meta's privacy policy).
- Legal basis: your consent, collected via the cookie banner. Cookies in each category are only set if you allow that category.
- Changing or withdrawing your consent: you can review or change your choice at any time using the "Cookie settings" link in the footer of any page.
5. Retention period
- Submitted photos and generated images: kept in memory for a few hours (the time needed to finalize an ongoing payment), and the generated result remains accessible for a maximum of 7 days to allow it to be downloaded, then is automatically deleted.
- Email / IP (free trial anti-abuse, referral program): kept for a maximum of 24 months from your last use, then automatically deleted by a scheduled purge. Beyond that, this information no longer serves any purpose.
- Payment data: retained by Stripe according to their own legal obligations (accounting, fraud prevention).
6. Sub-processors and recipients
To operate, Maleki AI relies on the following providers, each acting as a sub-processor solely for the purposes necessary to their role:
- Railway — hosting of the application and the database.
- Replicate — AI image generation (your photo is transmitted to them for the duration of processing, not retained by us afterwards).
- Stripe — secure payment processing.
- Resend — sending transactional emails (verification code, result, follow-up).
7. Your rights
In accordance with the GDPR, you have the right to access, rectify, erase, restrict, object to, and port your data. You can exercise these rights at any time by writing to us at contact@malekiai.com. We will respond within a maximum of one month. You also have the right to lodge a complaint with the competent supervisory authority (in France, the CNIL — www.cnil.fr).
8. Security
We implement reasonable technical measures to protect your data: encrypted connections (HTTPS), restricted access to infrastructure, server-side verification of all payments before any generation, and automatic deletion of data beyond the retention periods indicated above.
9. Changes
This policy may be updated to reflect changes in the service or regulations. The date of the last update appears at the top of this page.
