Skip to content
Meaura
PricingSign in →

Privacy notice

Last updated: 2026-05-07

Full policy is being finalised. The sub-processor list below is authoritative for what data we share and with whom.

Sub-processors

We rely on the following sub-processors. Signed Data Processing Agreements are on file with each.

  • Vercel — application hosting (USA, SCC + EU-US DPF)
  • Clerk — authentication (USA, SCC)
  • Cloudflare — D1 database, R2 storage, Workers, Queues, Turnstile (EU + USA, SCC)
  • OpenAI — image generation (USA, SCC) — added in Phase 2
  • Stripe — payments + EU VAT (Ireland for EU customers) — added in Phase 4
  • PostHog — product analytics (Frankfurt EU host) — added in Phase 5
  • Resend — transactional email (USA + EU send region) — added in Phase 5
  • CookieYes — cookie consent + policy generation (India SCC)

How we use AI

Meaura uses OpenAI's gpt-image-2 model to generate your personalized infographic in a single image-edit call: your selfie plus a category-specific prompt produces the finished 9:16 portrait with the trait labels, palette swatches, and quote text rendered inline by the model.

A second model — gpt-5-mini — analyzes your selfie to derive the short personality blurb you see on the result page and to pre-select the most fitting chip on the picker. The model never retains your photo (zero-data-retention is enabled at the organization level).

Selfie storage:uploaded photos sit in Cloudflare R2 (private bucket, signed-URL access only) for a maximum of 1 day under R2's native lifecycle policy, then are auto-deleted. The composited result image (with our watermark for free generations) is retained until you delete your account.

OpenAI retention & training: OpenAI retains API inputs for up to 30 days per their API Data Processing Addendum. Our OpenAI account has zero-data-retention enabled, which means your photo and prompt are not used to train any OpenAI model.

Account deletion:when you delete your account, we remove all generated images, uploaded photos, billing records, and account metadata from D1, R2, Stripe, and Clerk in a single cascade. OpenAI's 30-day retention window applies to inputs that were already in flight at the time of deletion.

Note: public share images (under /r/[id]) are world-readable until you delete your account, but third-party caches (Facebook, Slack, iMessage previews, etc.) may persist beyond deletion for an unknown period.

Have a question? hello@meaura.io