Privacy Policy

Pure Organism is the controller of account, identification, support, and product-usage information processed for this service. Contact support@pureorganism.com for privacy questions or requests.

Creem acts as merchant of record for live purchases and independently processes checkout, payment, tax, invoice, refund, and fraud-prevention information under its own terms and privacy notice.

We process account information such as your email address, authentication records, membership status, support messages, and security logs.

When you use identification, we process the image you submit, technical metadata, the resulting analysis, model usage, and the credit transaction associated with the request.

We use information to operate authentication, perform organism identification, deliver results, manage credits and subscriptions, prevent abuse, investigate failures, and respond to support requests.

Submitted images are not used to train our own models unless we ask for separate, explicit permission in the future.

Where data-protection law requires a legal basis, we process account, identification, credit, and support data to perform our contract with you; security and service-integrity data for our legitimate interests in preventing fraud and operating a reliable service; records needed to comply with legal obligations; and optional analytics only with your consent.

You may withdraw analytics consent at any time without affecting account or identification features. Withdrawal does not affect processing that was lawful before withdrawal.

The service uses Cloudflare for application delivery and private file storage, Supabase for authentication and database services, Creem for test or live billing, Resend for transactional email, and selected AI model providers through the Pure Organism API relay.

These providers may process data in countries other than your own under their applicable data protection terms.

With your consent, we use PostHog to measure page views and a small set of product events, such as registration submission, sign-in, completed identification, and checkout initiation. Analytics are disabled by default until you choose Allow analytics.

We disable automatic click capture and session recordings, and we do not send specimen images, prompts, email addresses, or payment details to PostHog. You can decline analytics without affecting the service.

We use Sentry to detect application failures and protect service reliability. This monitoring is limited to technical error details and is active independently of optional product analytics.

We disable session replay, performance tracing, and default collection of personal information. Error reports are filtered to remove request bodies, cookies, headers, email addresses, specimen images, prompts, and payment details.

We retain account and identification data while your account is active and for a limited period needed for operations, security, dispute handling, and legal obligations. Failed uploads are scheduled for cleanup.

You can request account deletion from Settings. Private images and identification history are removed when the request is completed, while restricted payment or fraud-prevention records may be retained when required.

Depending on your location, you may request access, correction, deletion, restriction, objection, or portability of eligible personal information. You may also withdraw consent and complain to your local data-protection authority. Submit requests through Settings or support@pureorganism.com; we may verify that the request belongs to the account owner.

Pure Organism does not sell personal information or share it for cross-context behavioral advertising. Where California privacy law applies, users may exercise rights to know, correct, delete, and receive equal service without discrimination for making a request.

We use access controls, private object storage, encryption in transit, administrator MFA, audit records, and limited service credentials. No online service can guarantee absolute security, so contact support promptly if you believe an account or image has been exposed.

The service is not directed to children under 18, and we do not knowingly collect their account or identification data. We may update this policy when providers, features, or legal requirements change and will publish a new effective date for material revisions.