Who we are
FreePFP.ai is run by The AI Barn, 124 City Road, London, EC1V 2NX, United Kingdom (“we”, “us”). We are the controller for the personal data described here. Contact: hello@theaibarn.com.
The short version
- To use the AI generator you sign in with your email address. We do not use passwords.
- Your photo is sent to Replicate and Black Forest Labs in order to make your picture. We do not store your photo or the result. We delete the uploaded photo from Replicate as soon as your picture is ready, and Replicate removes the job's inputs and outputs within an hour.
- Payments are taken by Stripe. We never see your card details.
- The frame tool runs in your browser and never uploads anything.
What we collect and why
| Data | Why | Lawful basis | How long |
|---|---|---|---|
| Your email address and account ID | To sign you in, keep your credit balance and send sign-in links | Contract | Until you delete your account |
| Sign-in cookie (a random session ID) | To keep you signed in | Contract (strictly necessary) | 30 days, or until you sign out |
| Your photo and the generated picture | To make your picture | Contract | Not stored by us. See “Your photo” below for our providers |
| Style chosen, time, whether it used a free picture or a credit, and the job ID | To run the job and return a credit if it fails | Contract | 2 hours |
| Credit balance and purchase history (pack, credits, Stripe session ID, date) | To give you the credits you paid for and handle refunds | Contract | Until you delete your account |
| IP address, and a one-way hash of your email address | Rate limits, the one-free-picture-a-day rule and preventing abuse | Legitimate interests (keeping the service fair and secure) | Counters expire after between 15 minutes and 2 days |
| Payment records | Tax and accounting | Legal obligation | 6 years, held in our Stripe account |
| Emails you send us | To reply | Legitimate interests | Up to 2 years |
We do not use your photo to identify you, and we do not create or keep face templates or other biometric identifiers. We do not use your data for automated decisions with legal or similarly significant effects.
Your photo
- Your browser crops the photo to a square, shrinks it to 1024 pixels and saves it as a new JPEG, which removes embedded details such as location (EXIF). Only this copy is sent.
- Our API (running on Cloudflare Workers) checks it and uploads it to Replicate's file storage. It is not written to our own storage.
- Replicate passes the photo and a description of the style to Black Forest Labs, which runs the FLUX.1 Kontext [pro] model and returns the picture.
- Our API collects the picture from Replicate and sends it straight to your browser. We do not keep a copy.
- When the job finishes, we delete the uploaded photo from Replicate's file storage. If that deletion fails, Replicate deletes the file automatically after 24 hours. Replicate removes the inputs and outputs of API jobs automatically one hour after the job ends.
Black Forest Labs processes your photo under its own privacy policy. We have not been told how long it keeps API inputs and outputs.
Model training. Black Forest Labs' privacy policy says it may use inputs and outputs sent through its API to improve its models unless the customer opts out. We have not yet received confirmation that FreePFP.ai is opted out. Until we have, please assume your photo and result could be used in this way; if you do not want that, do not use the AI generator. We will update this page when the opt-out is confirmed.
Who processes your data
| Provider | What for | Where |
|---|---|---|
| Replicate, Inc. | Runs the AI model and briefly stores the photo and result | United States |
| Black Forest Labs | Makes the AI model and runs it for Replicate | Germany (company); its API may run in other countries, including the United States |
| Stripe | Takes payments. Stripe is also an independent controller for fraud prevention and its legal duties | Ireland and United States |
| Resend | Sends sign-in emails | United States |
| Cloudflare Turnstile | Checks that sign-ins and generations come from a person, not a bot. It processes your IP address and technical browser signals | United States and Cloudflare's global network |
| Cloudflare (Workers and D1) | Runs our API and its database for accounts, credits and counters (no photos). Provides DNS for freepfp.ai. Keeps short technical request logs | Database stored in the EU; requests handled on Cloudflare's global network, including the United States |
| HostGator | Hosts this website. Keeps server logs | United States |
| Google (AdSense) | Shows ads; see below | United States and elsewhere |
International transfers
Several providers are in the United States or process data there. Where UK law requires it, these transfers rely on the UK Extension to the EU-US Data Privacy Framework (for providers certified under it) or on the UK International Data Transfer Agreement or Addendum to the EU standard contractual clauses in each provider's data processing terms. You can ask us for more information about the safeguards for a particular provider.
Advertising and consent
We use Google AdSense. Google is an independent controller for the data it processes for advertising. Visitors in the UK, the EEA and Switzerland see a consent message before any advertising cookies are used. Before you choose, Google Consent Mode is set to “denied”. If you agree, Google may use cookies to personalise and measure ads (lawful basis: consent). If you do not, Google may still show non-personalised or limited ads. Change your choice at any time with the “Privacy and cookie settings” link at the bottom of every page. Read how Google uses information from sites that use its services.
Your rights
Under UK GDPR you can ask to access, correct, erase, restrict or transfer your personal data, object to processing based on legitimate interests, and withdraw consent at any time. You can delete your account yourself: sign in on the home page and choose “Delete my account”. That removes your email address, sessions, credit balance and purchase history from our database straight away (unused credits are lost, so ask for a refund first if you are entitled to one). For anything else, email hello@theaibarn.com; we reply within one month.
You can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to sort it out first.
Age
The AI generator is for people aged 18 and over, and must only be used with photos of people aged 18 and over. The frame tool and guides are general-audience pages not directed at children under 13.
Changes
If we change how we handle data, for example by changing AI provider, we will update this policy before the change and show the date below.
Last updated 17 October 2026.