Unified Image API is now generally available. Read the docs →
Unified Image API

Personal data processing policy

Version of 2026-09-04

1. General provisions

The operator of personal data is Иванов Олег Игоревич, a private individual registered under the Russian professional-income tax regime (self-employed), INN 772022690404, email for requests support@genmux.tech. This policy is published in open access under part 2 of article 18.1 of Federal Law No. 152-FZ “On Personal Data” and describes how the operator processes personal data on the Unified Image API service, at https://genmux.tech and its Russian-language mirror under https://genmux.tech/ru, including all pages, the dashboard and the HTTP API. Using the service means you have read this policy.

Terms are used in the meanings given by article 3 of 152-FZ. The policy covers all personal data the operator receives from data subjects through the site, the dashboard and the API. The operator has appointed a person responsible for organising the processing of personal data (article 22.1 of 152-FZ); requests to that person are sent to support@genmux.tech.

2. Categories of data subjects and data processed

  • Registered users: email address, name, password hash, IP address and user agent of sessions, credit purchases and payment references (the operator never receives full card numbers), crypto deposit addresses and transaction hashes.
  • API usage: prompts, URLs of reference images, generated images and job metadata (model, timestamps, status, credits charged).
  • Site visitors: cookies, Yandex Metrica identifiers and IP address.

The operator does not process special categories of personal data (article 10 of 152-FZ) or biometric personal data (article 11) and does not request them. The service is not intended for persons under 18. Prompts are free-form text: if you enter someone else’s personal data into a prompt, you act as the operator for that data and are responsible for having a legal ground for it.

3. Purposes of processing

Registration and authentication; performance of the contract — generating images and delivering results; billing, accounting and issuing fiscal receipts; security and abuse prevention; user support; compliance with legal obligations; site analytics (only with consent); marketing messages (only with a separate consent).

Authentication uses the email address and the password hash; job execution uses the prompt, the reference images and the account identifier; billing uses the payment references and the purchase history; security uses the IP address, the user agent and request metadata; support uses the correspondence and the identifiers of the jobs you ask about.

4. Legal grounds

Consent of the data subject (clause 1); performance of a contract to which the data subject is a party (clause 5); compliance with an obligation imposed by law (clause 2); the legitimate interests of the operator, such as service security (clause 7) — all of part 1 of article 6 of 152-FZ.

Data needed to perform the contract and to comply with the law is processed without a separate consent. Analytics and marketing messages are processed on the basis of consent alone; withdrawing that consent stops the corresponding processing without affecting the account itself. Only the data needed for the stated purpose is processed for that purpose.

5. Localisation and conditions of processing

Databases containing personal data of citizens of the Russian Federation — accounts, sessions, payment and consent records — are located in the Russian Federation (Россия, Yandex Cloud (ru-central1) / Russia, Yandex Cloud (ru-central1)), as required by part 5 of article 18 of 152-FZ. Computing infrastructure that processes only pseudonymous account identifiers, prompts and generated images is located at Германия, Alibaba Cloud (Франкфурт) / Germany, Alibaba Cloud (Frankfurt). Protective measures: TLS for all transfers, irreversible password hashing, role-based access control, IP masking in application logs, retention limits. Access is granted to a limited list of people and is logged; backups are encrypted; the set of measures is fixed in the operator’s internal documents and reviewed periodically. The operator does not sell personal data and does not train models on your prompts.

6. Cross-border transfer

Prompts and reference images are transmitted to the image-model provider in the People’s Republic of China — a state on Roskomnadzor’s list of countries providing adequate protection of the rights of data subjects — solely in order to fulfil your request. Other recipients are payment providers (Russian Federation), the email delivery service, and the hosting providers named in section 5. The operator files with Roskomnadzor the notification of personal-data processing (article 22 of 152-FZ) and, before the transfer begins, the notification of intended cross-border transfer (article 12 of 152-FZ).

Where a third party processes personal data on the operator’s behalf (part 3 of article 6 of 152-FZ), it does so under an agreement that names the permitted actions and purposes and obliges it to keep the data confidential and to apply protective measures at least equal to those in section 5. The operator remains answerable to you for their processing.

7. Cookies and analytics

Strictly necessary cookies — the session cookie and the CSRF protection — are required for the service to work and are set without consent. Yandex Metrica is loaded only after you accept in the cookie banner; if you decline, no analytics script and no analytics cookies are loaded at all. You can change your mind by declining in the banner or clearing this site’s data in your browser. Strictly necessary cookies hold the session identifier and the CSRF protection token and are removed when you sign out.

8. Retention periods

  • Account data — until deletion of the account plus 30 days.
  • Jobs and prompts — 30 days; generated images — 35 days.
  • Server logs contain no personal data (client addresses are masked to their network) and are rotated by size.
  • Consent records and payment records — for the periods required by accounting and tax legislation of the Russian Federation.

Once the period expires the data is deleted or depersonalised. Withdrawing consent does not make unlawful the processing that was carried out before the withdrawal.

9. Rights of the data subject

You may obtain confirmation of processing and access to your data, have it corrected, blocked or deleted, and withdraw your consent at any time by writing to support@genmux.tech. The operator replies within 10 working days. In your request please state the number of your main identity document, or other information confirming that you are a party to the relationship with the operator — the email address of the account is enough — and sign it, by hand or electronically (part 3 of article 14 of 152-FZ). You may also lodge a complaint with Roskomnadzor or seek judicial protection.

10. Incidents

In the event of an incident causing unlawful transfer of personal data, the operator informs Roskomnadzor within 24 hours and provides the results of the internal investigation within 72 hours (part 3.1 of article 21 of 152-FZ).

11. Changes

A new version of this policy is published at this address with a new date. Material changes that require a new consent are collected again at sign-in or by email.