(Datenschutzerklärung)

Last updated: 05.08.2026

This Policy explains how F13 GmbH ("we") processes personal data when you use our website, developer dashboard, and API (the "Services"). We build foundation models for graphics generation.

Where you integrate our API into your own product and submit data about your end users, you are the controller and we are your processor under a separate agreement (Art. 28 GDPR); this Policy covers only the data we process as controller.

1. Controller

F13 GmbH, Brunnenstr. 43, 10115 Berlin, Germany — contact@f13.com

Data protection contact: Ingimar Tomasson, Managing Director — ingimar@f13.com

For privacy questions or requests concerning your personal data, you can also contact privacy@f13.com.

2. Data we collect

• Account

  — name, email, company, username, credentials.

• API credentials

  — keys and tokens.

• Inputs & Outputs

  — prompts, reference files, and generated graphics. Because we generate faces and likenesses, these may include images of people.

• Billing

  — billing address and payment details (paid tiers); card data is held by our payment processor.

• Communications

  — messages you send us.

• Usage & device data

  — API metadata, logs, IP address, browser/device info.

• Cookies

  — see Section 6.

• Applicant data

  — where you apply for a job with us: CV/résumé, references, and career history. If we receive your details from career platforms (e.g. LinkedIn), that data too.

Images and likenesses. Inputs and Outputs may contain personal data where they depict or otherwise relate to identifiable individuals. We do not use facial recognition or biometric matching to identify or authenticate individuals. We process personal data in Inputs and Outputs for the purposes described in this Policy.

If you submit images or other personal data relating to another person, you must have the necessary rights and a lawful basis for doing so.

3. Purposes and legal bases (Art. 6(1) GDPR)

• Provide and run the Services (accounts, dashboard, API, Outputs) —

  (b) contract

  .

• Billing and payments —

  (b) contract; (c) legal obligation

  .

• Security, fraud and abuse prevention —

  (f) legitimate interests; (c) legal obligation

  .

• Operate, debug, and improve the Services —

  (f) legitimate interests

  .

• Support and service messages —

  (b) contract; (c) legal obligation

  .

• Recruitment — reviewing and managing job applications —

  (b) pre-contractual steps; § 26(1) BDSG

  .

• Marketing —

  (a) consent

  .

• Legal compliance and enforcing our terms —

  (c) legal obligation; (f) legitimate interests

  .

We do not carry out automated decision-making with legal or similarly significant effects (Art. 22 GDPR).

4. AI models and your Inputs

We process Inputs and Outputs to provide the Services and support security, abuse prevention and debugging.

We currently do not use images of identifiable people to train or fine-tune our models. We may use Inputs and Outputs that do not contain personal data to develop, train, evaluate and improve our models and Services, where permitted by the applicable customer agreement.

When we process personal data on a Customer’s behalf under a Data Processing Agreement, we follow the Customer’s documented instructions. We do not use personal data entrusted to us solely in that capacity for our independent model development, training, evaluation or improvement.

Before introducing a new use of personal data for model development, training, evaluation or improvement, we will update this Policy and provide the required information about the purposes, personal data involved and applicable legal basis. We will establish an appropriate legal basis and implement the necessary safeguards before that processing begins. Where consent is required, we will obtain it beforehand.

You may object to processing based on legitimate interests by contacting us at privacy@f13.com.

5. Who we share data with

We do not sell your data. We share it, as needed, with: hosting/compute providers; payment processor; analytics providers; communication and support tools; professional advisors; and authorities where legally required. In a merger or sale of assets, data may transfer to the counterparty. Each processor acts under an Art. 28 GDPR agreement.

6. Cookies

We use strictly necessary cookies to run the site. Non-essential cookies (e.g. analytics) are set only with your prior consent (§ 25 TDDDG), which you can withdraw anytime via the cookie settings on our website. You can also block cookies in your browser.

7. International transfers

We use providers located in the US, including for hosting/compute and payment processing. Where we transfer data outside the EEA/UK/Switzerland, we rely on an adequacy decision, the EU Standard Contractual Clauses (plus the UK Addendum), or a recipient's EU–US Data Privacy Framework certification. You can request a copy of the safeguard.

8. Your rights

You may access, rectify, erase, restrict, port, or object to processing of your data, and withdraw consent at any time. Contact us at privacy@f13.com (see Section 10); we respond within one month. You may also complain to a supervisory authority — in Germany, the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Alt-Moabit 59–61, 10555 Berlin — or the one where you live or work.

9. Retention

We keep personal data for as long as necessary for the purposes set out in this Policy — including providing the Services, security and abuse prevention, improving our models, resolving disputes, and complying with legal obligations. To decide how long, we consider the amount and sensitivity of the data, the risk of harm from misuse, the purposes we process it for and whether we can achieve those by other means, and applicable legal requirements.

In practice: account data is kept for the life of your account and a reasonable period afterwards; billing and accounting records are kept for statutory periods (generally 6–10 years in Germany, depending on the type of record); applicant data is deleted within six months of a hiring decision unless you agree to us keeping it longer; and Inputs and Outputs and logs are kept only as long as needed for the purposes above. We may retain data longer where the law requires it, or in anonymised form that no longer identifies you.

10. Security, children, changes, contact

We use appropriate technical and organizational safeguards; no system is perfectly secure. The Services are for professional use and not directed to children under 16.

We may update this Policy and will revise the date above.

Questions or data-protection requests: privacy@f13.com (general enquiries: contact@f13.com) — F13 GmbH, Brunnenstr. 43, 10115 Berlin, Germany.