Privacy Policy

Last updated: October 8, 2026 · Operated by Shecommerce

This policy explains what personal data Xomily collects, why, and your choices. Shecommerce is the data controller.

What we collect

Account data: name, email, password (stored as a secure hash), referral information, marketing preference.
Content: prompts, voice-over scripts, photos you upload, and the videos, images and audio we generate for you.
Payment data: purchase history. Card details are handled by Stripe and never stored on our servers.
Safety & security data: IP address, device/browser information, timestamps, moderation decisions, and reports.

Why we use it

To provide the Service (contract): generating your creations, managing your tokens and account.
To keep the Service safe and lawful (legitimate interests / legal obligation): content moderation, fraud and abuse prevention, responding to legal requests.
To communicate with you: service emails, and marketing only if you opted in (you can opt out anytime).

Photos of people

Uploaded photos are re-encoded on upload, which removes embedded metadata such as GPS location. Photos are used only to create the content you request and for safety screening. If celebrity detection is enabled, uploaded images are checked against a public-figure recognition service solely to enforce our policy; we do not build facial recognition profiles of private individuals.

Who we share data with

We share data only with processors that help us run the Service, under contracts that protect it:

AI model providers (e.g. fal.ai and the model developers it hosts, OpenAI, ElevenLabs) to generate content and screen it for safety;
Stripe for payments; our hosting and email providers;
AWS Rekognition (if enabled) for public-figure detection on uploads;
Authorities, when required by law or to protect someone's safety.

We do not sell your personal data. Some providers may process data outside your country; where required we rely on appropriate safeguards such as Standard Contractual Clauses.

Retention

Your creations and uploads are kept until you delete them or your account.
Safety logs (prompts, decisions, IP addresses) are kept for up to 2 years, or longer when needed for legal claims or law-enforcement requests, even after content is deleted.
Payment records are kept as required by tax and accounting law.
Chats with Xomily (our AI host) and the facts she remembers about you are kept for up to 90 days, so she can continue conversations; you can clear them at any time from the chat menu, and they are deleted with your account. Chat text is processed by OpenAI to generate replies and safety checks.

Your rights

Depending on where you live (e.g. GDPR, UK GDPR, CCPA), you can access, correct, export or delete your data, object to or restrict processing, and withdraw consent. You can delete your account at any time from Account settings, or email hello@xomily.com. You may also complain to your local data protection authority.

Children

The Service is not intended for anyone under 18, and we do not knowingly collect their data. Adults may upload family photos that include children only with a parent/guardian's consent, and such content is subject to strict safety rules.

Security

We use encryption in transit (HTTPS), hashed passwords, access controls and monitoring. No system is perfectly secure; we will notify you of breaches as required by law.

Changes

We'll post updates here and notify you of material changes.

Questions? Contact hello@xomily.com.