Privacy Policy
Effective from October 13, 2026 · Last updated: October 13, 2026
The operator of the AI OFM platform (the Service) is committed to protecting its users' personal data. This notice explains what data we collect, how we use it, and what rights you have under the EU General Data Protection Regulation (GDPR).
1. The controller
Controller: Péli Ákos e.v.
Registered office: 6230 Soltvadkert, Kiss Ernő utca 85., Hungary
Sole proprietor registration number: 60959435
Tax number: 91356262-1-23
EU VAT number: HU91356262
Contact: info@magyaraiofm.com · Telegram
2. Data we collect
The Service processes the following personal data:
2.1. Data you give us when you register
- •Name (optional, display name)
- •Email address
- •Password (stored only in hashed form)
2.2. Data created when you pay
- •Subscription type and status
- •Stripe customer ID
- •Payment transaction IDs
Important: card details are handled only by Stripe. AI OFM never stores card numbers, expiry dates or CVC codes.
2.3. Data created while you use the Service
- •Your favorite prompts
- •Session data
- •Email verification status and timestamp
- •Your site language (Hungarian or English), so we can show the site and send emails in your language
- •Page visit statistics (which features you use and when — daily aggregated usage statistics linked to your account; never shared with third parties and never used for advertising; if you consented to marketing emails, we also use them to personalize those emails — see section 3)
- •Workflow API usage (number of runs per day)
- •Push notification subscription (browser endpoint, encryption keys — only if you enable it)
- •Telegram username (only if you give it voluntarily — for personal contact)
- •Your WaveSpeed API key, encrypted — only if you choose to save it in Settings
- •Your own AI models and own characters in AI Studio: the model or reference image, its name, the source faces and your settings
2.4. Legal compliance data
- •IP address and browser identifier (User-Agent) — to be able to prove your registration consents (accepting the Terms and the Privacy Policy, waiving the right of withdrawal, the 18+ declaration)
- •Timestamps of your consents and of the age (18+) declaration
- •Time, version, source, IP address and browser identifier of your marketing email consent — only if you opt in
- •Content, submission time and confirmation status of an electronic withdrawal/termination statement
2.5. Social media and Fanvue integration data (only if you connect them)
If you connect your social (X, Threads, TikTok) or Fanvue account, or use the built-in content tools, we also process:
- •Access tokens of the connected platforms (stored encrypted)
- •Uploaded media files (images/videos — stored on Cloudflare R2)
- •Scheduled posts, captions, persona settings
- •Fan data from Fanvue — e.g. username, total spend, notes. This is data about third parties: the creator is the controller, and the platform acts as a processor.
- •Affiliate payout details — bank account / PayPal / Revolut ID (only if you request a payout)
3. Purposes and legal bases
Processing based on legitimate interest (email verification, customer support, improving the Service, abuse prevention) serves to run the Service safely and reliably; we carried out a balancing test for these, available on request. Providing an email address and a password is required to create an account (and thus the contract) — without them, the Service cannot be used.
Telegram username: if you give it voluntarily (for example in a notice on the platform), we use it only to message you personally on Telegram — to help with a question or about the plans. We never share it with third parties. Giving it is not a condition of using the Service, and you can ask us to delete it at any time by email or on Telegram.
Marketing emails: we only send tips, news about new videos or offers after a separate, voluntary consent that is off by default. You can withdraw it at any time, free of charge, on the Profile page or with the unsubscribe link in any marketing email; withdrawal does not affect the lawfulness of earlier processing. We measure opens of marketing emails and clicks on their links (through our email provider Resend's tracking pixel and redirected links): this shows us which emails are useful, lets us pause sending to people who haven't opened any for a long time, and if you look at the plans from an email, we may send you a short, helpful follow-up. If you mark our email as spam, we treat it as unsubscribing.
Personalized marketing emails (profiling): based on your marketing consent, we use the usage data measured on the platform (your progress and streak on the 28-day Journey, your AI Studio use, such as whether your own model is ready and how many images were made, the pages you visit, such as the Plan page, the status of your plan and of your Generator trial, the goal you gave when you signed up, and opens of our emails and clicks on their links) to send you emails with personalized content: for example when you seem stuck on a day, when you finish a week, or when your trial ends tomorrow. This is profiling for direct marketing purposes (Article 4(4) GDPR); we make no automated decision about you from it that has legal or similarly significant effects. You can object to it at any time, without giving reasons (Article 21(2)–(3) GDPR), and unsubscribe with one click at the bottom of any email; after that we send no personalized emails either. These emails go out at most at the frequency of one marketing email per day: on a day when you have already had a marketing email from us, we don't send a personalized one.
4. Sharing data with third parties
We share personal data with the following third-party providers:
We do not share personal data with third parties for marketing or advertising purposes.
4/A. Transfers outside the European Union
Some of our providers operate in the United States (a third country) — in particular Vercel (hosting), Stripe, Google (sign-in), WaveSpeed (AI image and video generation — if you use it, and for free images), Cloudflare (media storage) and Resend (email). Siray.ai (AI Studio and Prompts page image generation, if you use them) operates in Singapore; the Studio's planning model (Grok, xAI) and Google's image model (Nano Banana 2) operate in the United States, and ByteDance's models (Seedream, Seedance) are provided from outside the EU. For these transfers we apply the safeguards of Articles 44–49 GDPR:
- •the EU–US Data Privacy Framework adequacy decision, where the provider is certified, or
- •the Standard Contractual Clauses (SCCs) approved by the European Commission in all other cases.
Data reaches Siray (Singapore) and — through it — xAI, Google and ByteDance at your request, to the extent needed to perform the generation you ask for (Article 49(1)(b) GDPR). You can request a copy of the safeguards from us using the contact details below.
5. Cookies and session handling
The platform uses the following cookies:
- •Session cookie — Keeps you signed in. Necessary, not optional.
- •CSRF token — For security — authenticates requests.
- •ff_lang — Remembers the language you chose (1 year). Only created if you switch language.
- •ff_meres — Remembers your choice about measurement (accepted: 1 year, declined: 6 months) so we don't ask again. Needed to store your choice.
- •ff_attr (only with consent) — Source attribution: where you first came from (e.g. TikTok, Google, a referring site), so that when you sign up we can see which of our channels works (30 days). First-party, never shared with anyone. Only created if you choose “OK” on the measurement card; you can withdraw at any time by clearing your browser cookies.
- •ff_greg — When you sign up with Google, carries your ticked declarations for a short time (15 minutes), until you return from Google.
The platform does not use third-party tracking or advertising cookies (e.g. Google Analytics, Meta Pixel), and we only set our own source-attribution cookie (ff_attr) with your consent (Hungarian Electronic Communications Act, Section 155(4), implementing the EU ePrivacy rules). If you don't consent, we record where you came from without a cookie, only at sign-up — from the campaign parameters of the sign-up link and from the page address your browser sends with the request on its own (the referrer). Some of your settings (e.g. favorites, progress) are kept in your browser's local storage (localStorage) and never reach us.
6. Data security
- •Passwords are stored hashed with the bcrypt algorithm
- •Communication is protected by HTTPS encryption
- •Payment data is handled by Stripe's PCI DSS-certified system
- •Saved API keys are stored encrypted
- •Database access is protected by passwords and environment variables
- •The Provider carries out regular security reviews
7. Your rights (GDPR)
Under the EU General Data Protection Regulation (GDPR), you have the following rights:
Exercising your rights: to exercise any of these rights, email us first at info@magyaraiofm.com (or, optionally, message us on Telegram: @AkosOFM). We reply within 30 days at the latest.
Self-service: when signed in, on the Profile page you can (a) download your data in a machine-readable (JSON) format and (b) permanently delete your account together with all your data.
8. How long we keep data
- •Account data: until the account is deleted
- •Billing and accounting data (invoice, customer name/address, transaction, Stripe ID): 8 years, under Section 169 of the Hungarian Accounting Act (Act C of 2000)
- •Log of system and lifecycle emails sent (onboarding, reminders, win-back — to avoid duplicates and for proof): at most until the account is deleted
- •Checkout intent timestamp (for the abandoned checkout reminder): no longer needed once the follow-up email has been sent
- •Proof of marketing consent and its withdrawal: up to 5 years after withdrawal, to be able to prove legal claims
- •Electronic withdrawal/termination statement: until the related contractual and legal claims are time-barred
- •Telegram username: until you ask us to delete it, at the latest until the account is deleted
- •AI Studio request log and generation attempts stopped by the content filter: 90 days (deleted automatically), unless an official procedure requires longer retention
- •Your own AI model (model image, name, source faces, settings) and the reference image of an own character you uploaded, with your declaration (time, IP address): until you delete the model, the character or your account
- •Saved WaveSpeed key: until you remove the key or delete your account
- •Verification copies of reference images uploaded for image and video generation: 30 days (deleted automatically), or until the account is deleted if that is sooner — unless an official procedure requires longer retention
- •Session data: until you sign out, at most 365 days (expires automatically)
- •Email verification and password reset tokens: deleted after use, or automatically within 24 hours
8/A. Minors and adult content
Some content of the Service is intended only for people aged 18 or over (adult / explicit content). Registration and sign-in are restricted to adults, which you confirm explicitly when you sign up. We do not knowingly process data of anyone under 18; if we become aware of such data, we delete it without delay.
9. Supervisory authority
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Phone: +36 (1) 391-1400
Email: ugyfelszolgalat@naih.hu
Web: www.naih.hu
If you live in another EU country, you can also contact your local data protection authority.
10. Changes
The Provider may change this privacy notice. We will inform users of material changes on the platform or by email. The updated notice applies from the day it is published.
11. Contact
For any data protection question, you can reach us at: