Privacy Policy

1. Introduction

This Privacy Policy explains how Coomerang LTD collects, uses, shares, and protects personal information when you use Coomerang.

Coomerang LTD is a private limited company registered in England and Wales under company number 16557189, with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Coomerang LTD is the controller for the personal data described in this policy under the UK GDPR and, where applicable, the EU GDPR, unless stated otherwise.

We collect personal data to run the comic creation platform, manage accounts and subscriptions, provide AI image features, operate age assurance and moderation, keep the service secure, respond to contact requests, and comply with legal obligations.

2. Information We Collect

2.1 Account and Profile Data

• Username, email address, password hash, account role, account status, and timestamps.
• Email verification, password reset, recovery email, pending email change, and related security records.
• Google account identifier, Google email, and Google profile information if you use Google Sign-In.
• Profile picture, biography, profile moderation status, and profile-related admin messages where applicable.

2.2 Content and Community Data

• Comics, comic data, pages, panels, images, videos, quizzes, cover images, titles, descriptions, categories, languages, publishing status, version data, and related metadata.
• Published comic and profile information that is visible to other users or visitors, subject to mature-content filters and moderation state.
• Likes, aggregate like counts, comic view records, reports, profile reports, moderation decisions, review notes, and enforcement records.
• Images and video frames analysed for moderation, including SafeSearch categories, likelihoods, risk flags, timestamps, review status, and reviewer notes.

2.3 Mature Content and Age Verification Data

To enable mature-content access, we use a third-party age assurance provider such as Didit. When a verification session is created, Coomerang may send Didit an internal user identifier and session metadata that includes your username and email address. Didit may collect and process identity or age-assurance information under its own privacy notice. Coomerang does not intentionally receive or store copies of your identity documents, but currently stores the verification result and status, verified or estimated age, session identifier and URL, creation, expiry, verification and last-check timestamps, and related session metadata used to operate the age gate and maintain safety records.

2.4 Subscription, Billing, and AI Credit Data

• Subscription plan, status, billing interval, currency, subscription start/end dates, cancellation status, Stripe customer ID, Stripe subscription ID, and related Stripe event identifiers.
• AI credit balance, credit grants, credit cost settings, and credit usage connected to AI image generation.
• Payment card data is handled by Stripe. Coomerang does not store full card numbers or card security codes.

2.5 AI Image Data

• Text prompts, source images, generated images, generated image URLs, model name, operation type, size, quality, output format, usage metadata, and creation/deletion timestamps.
• AI requests and outputs are processed by OpenAI to provide image generation and editing features. OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer explicitly opts in.
• Under OpenAI's standard API data controls, prompts, images, outputs, and related technical data may be retained in abuse-monitoring logs for up to 30 days. Information may be retained longer where required for legal or safety reasons, and content flagged for serious safety concerns may be reviewed or preserved in accordance with OpenAI's policies.

2.6 Technical, Security, and Contact Data

• IP address, request metadata, user agent, browser and device information, security logs, rate-limit data, CSRF/session data, error logs, and operational diagnostics.
• Approximate location or currency signals derived from IP address or Accept-Language headers for pricing currency selection.
• Name, email address, subject, message, IP address, and message metadata when you contact us through the contact form.

2.7 Cookies and Browser Storage

We use cookies, localStorage, and similar browser storage for authentication, security, preferences, and editor functionality. See our Cookies Policy.

3. How We Use Personal Data

• To create, authenticate, secure, and manage user accounts.
• To provide the comic editor, uploads, storage, publishing, discovery, profiles, likes, reports, and related platform features.
• To operate subscriptions, Stripe checkout, billing portal access, plan entitlements, and AI credit grants.
• To provide AI image generation and editing features.
• To operate mature-content access controls, age assurance, content labelling, moderation, reporting, appeals, and enforcement.
• To prevent fraud, abuse, unauthorised access, scraping, spam, security incidents, and misuse of the service.
• To send transactional emails, such as verification, password reset, subscription, age verification, moderation, and support messages.
• To respond to contact requests, legal requests, regulatory duties, and user rights requests.
• To maintain, debug, monitor, and improve the service.

4. Lawful Bases

• Contract: account registration, authentication, editor features, storage, publishing, subscriptions, billing portal access, AI credit features, and support needed to provide the service.
• Legitimate interests: security, abuse prevention, moderation, reporting, platform integrity, product maintenance, troubleshooting, and responding to non-marketing contact requests.
• Legal obligation: tax and accounting records, responding to lawful requests, safety compliance, copyright processes, and records we must keep by law.
• Consent: optional processing that legally requires consent, such as non-essential cookies or marketing if introduced in the future. We do not currently use advertising or behavioural tracking cookies.
• Vital interests: rare cases where processing is necessary to protect someone from imminent serious harm.

5. Sharing Personal Data

We share personal data only where needed to run the service, comply with law, protect users, or complete transactions.

• Cloudflare R2 and CDN: media storage, content delivery, security, and performance.
• Hosting and database providers: application hosting, PostgreSQL database hosting, backups, logs, and infrastructure operations.
• Stripe: checkout, customer portal, subscriptions, invoices, payments, billing events, and related fraud prevention.
• Didit: age verification and identity/age assurance sessions for mature-content access.
• OpenAI: AI image generation and editing using prompts, source images, generated images, and technical metadata.
• Google services: Google Sign-In if selected, Google Cloud Vision SafeSearch for image/video moderation, and Google Fonts loaded by the frontend.
• SMTP/email providers: transactional email delivery and contact-form responses.
• ipapi.co: IP-based currency estimation when needed for pricing localisation.
• Admins and moderators: internal review of reports, profile issues, moderation queues, billing support, and safety matters.
• Authorities, courts, advisors, or counterparties: where required by law, to enforce our rights, protect users, respond to legal process, or handle a business transfer.

6. Public Visibility

Published comics, titles, descriptions, cover images, categories, language, author username, public profile information, and aggregate engagement counts may be visible to other users and visitors. Mature-labelled content is hidden from users who have not enabled mature-content access.

Reports, moderation notes, private account details, payment identifiers, age verification records, and security logs are not intended to be public.

7. International Transfers

Coomerang LTD is incorporated in the United Kingdom, and our providers may process personal data in the UK, the EEA, the United States, and other countries where they or their infrastructure operate. Where required, we rely on adequacy regulations, standard contractual clauses, international data transfer agreements, or other lawful transfer mechanisms.

8. Retention

We keep personal data only for as long as needed for the purposes described in this policy, unless a longer period is required for legal, safety, security, accounting, or dispute-resolution reasons.

• Account data: kept while your account exists. When you complete self-service account deletion, the primary account record and associated content are deleted, except for information that must be retained for legal, security, payment, fraud-prevention, or dispute-resolution reasons or that remains temporarily in backups.
• Published content: kept while published or stored in your account, unless removed by you, by moderation, or by legal process.
• Temporary uploaded media: unreferenced temporary files are normally cleaned up after about 24 hours.
• Comic view cooldown records: records used to avoid repeated view counts are normally deleted after about 7 days.
• Refresh tokens and sessions: kept until expiry, logout, revocation, or replacement, subject to configured token lifetimes.
• Subscription, payment, and tax records: retained for as long as needed to administer payments and subscriptions and to meet applicable accounting, tax, audit, fraud-prevention, and dispute-resolution requirements.
• Contact and support messages: retained for as long as reasonably needed to respond to and document the request, and longer only where relevant to a dispute, security issue, or legal obligation.
• Moderation, report, copyright, and safety records: retained for as long as reasonably needed to investigate the issue, document decisions, handle appeals, enforce repeat-offender rules, protect users, establish or defend legal claims, or meet regulatory obligations.
• Age verification records: retained while needed to operate mature-content access and related safety controls, or until account deletion, subject to any longer retention needed for security, fraud prevention, disputes, or legal obligations.
• Backups and logs: may persist for limited rolling periods before deletion or overwriting.

9. Security

We use technical and organisational safeguards such as HTTPS, password hashing, signed authentication tokens, CSRF protection, rate limiting, security headers, access controls, moderation controls, and provider security features. No online service can guarantee absolute security.

10. Your Rights

Depending on your location and the processing involved, you may have rights to access, correct, delete, restrict, object to processing, obtain a portable copy of your data, and withdraw consent where processing is based on consent.

To exercise your rights, contact us through the Contact page or [email protected]. We may ask for information needed to verify your identity and protect your account. We normally respond within one month, subject to legally permitted extensions for complex requests.

You may lodge a complaint with the UK Information Commissioner's Office at ico.org.uk. If you are in the EEA, you may also have the right to complain to your local data protection authority.

11. Children

Coomerang is not intended for children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided personal data, please contact us so we can take appropriate action.

Users under 18 must have parent or guardian permission to create an account and cannot enable mature-content access.

12. Automated Tools and Decision Support

We use automated tools to support moderation, security, age-gating workflows, and AI image features. These tools can help identify risky content, apply warnings, queue content for review, prevent abuse, and enforce credit or entitlement rules.

Automated tools do not remove your responsibility to follow the Terms, and they may produce false positives or false negatives. Where a decision materially affects your content or account, you can contact us to request review.

13. Third-Party Links

Coomerang may link to third-party websites or services. Their privacy practices are governed by their own policies, not this Privacy Policy.

14. Changes

We may update this Privacy Policy to reflect changes in our service, providers, legal obligations, or data practices. We will update the "Last updated" date and provide additional notice for material changes where appropriate.

15. Contact

Privacy questions or requests can be sent through our Contact page or to [email protected] with the subject line "Privacy Request".