Privacy Policy

Last updated: October 11, 2026

1. Controller

The controller responsible for data processing on this website and in the Seam Photoshop plugin is:

Emil Rüegg
Bruchstrasse 38
40235 Düsseldorf, Germany
E-Mail: support@seam-plugin.com

We treat your personal data confidentially and in accordance with the statutory data protection regulations, in particular the EU General Data Protection Regulation (GDPR), and this privacy policy.

2. Hosting and Infrastructure

This website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When you visit our website, Vercel automatically processes technical connection data (IP address, date and time of the request, browser type, operating system, referrer URL) in server log files. This processing is necessary to deliver the website securely and reliably and is based on our legitimate interest (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with Vercel; transfers to the USA are safeguarded by the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

We also use Vercel Web Analytics and Vercel Speed Insights, two measurement services of the same provider. They record aggregated page views and page loading times so that we can see which pages are used and where the site is slow. Neither service sets a cookie or stores any identifier on your device; Vercel derives a short-lived, one-way hash from the request data to tell visits apart within a single day and discards it afterwards. Because nothing is stored on or read from your device, these two services run without a consent banner. The legal basis is our legitimate interest in a functioning, fast website (Art. 6(1)(f) GDPR).

Individual plugin features, in particular prompt assistance (see section 8) and plugin diagnostics, are operated on Cloudflare Workers, a service of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare processes the technical connection data required to handle these requests. To keep image transfers fast and reliable, images you submit for a generation and large generated results may be stored briefly as private objects in Cloudflare R2 object storage, to hand inputs to the selected AI provider and results back to your plugin; these objects are access-controlled, retrievable only via short-lived signed URLs, and are automatically deleted within 24 hours. Transfers to the USA are safeguarded by the EU Standard Contractual Clauses. The legal basis is Art. 6(1)(b) GDPR (performance of the contract).

3. Cookies and Local Storage

Our website uses cookies and similar technologies (such as localStorage). Strictly necessary cookies (for example for login sessions, security, and checkout) are set on the basis of Art. 6(1)(f) GDPR and § 25(2) TDDDG. All non-essential cookies (currently analytics only) are set only after you have given your consent via our cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Your consent choice itself is stored locally in your browser. You can change or withdraw your consent at any time via the "Cookie Settings" link in the footer. Details on the individual cookies can be found in our Cookie Policy.

4. Google Analytics 4

If, and only if, you consent to analytics cookies, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies (e.g. _ga) to analyze how visitors use our website. IP addresses are not stored by Google Analytics 4 and are truncated before logging. Data may be transferred to Google LLC in the USA; these transfers are safeguarded by the EU-US Data Privacy Framework and Standard Contractual Clauses.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the Cookie Settings in the footer; Google Analytics will then be deactivated and its cookies deleted.

5. User Account and Authentication

If you create a Seam account, we process your e-mail address, a hashed password (or your third-party login credentials), your name, and session data. Authentication, our database, and our file storage are operated via Supabase (Supabase Inc., 970 Toa Payoh North #07-04, Singapore) on the basis of a data processing agreement. Where data is processed outside the European Union, the transfer is safeguarded by the EU Standard Contractual Clauses. The legal basis is Art. 6(1)(b) GDPR (performance of the contract).

When you connect the Photoshop plugin to your account, we additionally process device authorization codes and a locally generated machine identifier to bind your login to your installation and to enforce the number of device seats included in your plan. For each activated device we store a seat record containing the machine identifier, an optional device name, and the IP address and browser/user-agent of the activation request, so that you can see and free up your devices in the dashboard and so we can prevent license abuse (Art. 6(1)(b) and (f) GDPR). The seat record also holds a device fingerprint: a one-way hash the plugin computes from stable characteristics of your computer (operating system, processor architecture, processor model, core count, and memory size) and a salt built into the plugin. We store only the hash, never those characteristics and never the salt, and we use it for a single purpose: to recognize a computer whose locally stored machine identifier was lost, for instance after reinstalling the plugin or upgrading Photoshop, so that it keeps its existing seat instead of consuming a second one.

6. Payments via Lemon Squeezy

Purchases and subscriptions are processed by Lemon Squeezy LLC (a Stripe company, USA) as merchant of record. This means the purchase contract for your license is concluded with Lemon Squeezy, not with us: Lemon Squeezy sells the license, issues the invoice, collects any applicable tax, and handles refunds and any statutory right of withdrawal.

When you make a purchase, Lemon Squeezy collects your name, e-mail address, billing address, and payment details directly; we never receive or store your full payment information. Lemon Squeezy notifies us of the purchase and subscription status (e.g. order ID, plan, license status) so that we can issue and manage your license. Lemon Squeezy acts as an independent controller for the payment processing; please refer to the Lemon Squeezy privacy policy. The legal basis is Art. 6(1)(b) GDPR.

7. Data Processing in the Photoshop Plugin

To provide our service (image generation, editing, upscaling), the following data is processed:

• License Keys & API Request Data: Necessary to authenticate your subscription and authorize generation requests.
• Image Data & Prompts: Image selections and prompts you submit are processed transiently on secure cloud environments to compute generation, inpainting, or upscaling results. Reference images you save are stored in private, access-controlled Supabase storage buckets and are only accessible via short-lived, signed tokens.
• Generation Logs: For billing, abuse prevention, and reliability, we log technical metadata per generation (model used, provider, credits spent, duration, success or failure). We do not store your prompts or your images in these records.
• Provider API Keys (Lifetime License): Lifetime licenses run on your own AI-provider API keys, which you enter in the Seam dashboard, not in the plugin. Each key is encrypted on our server (AES-256-GCM) before it is stored in our Supabase database, and is decrypted server-side only for the moment a request is sent to the provider you selected. The dashboard and plugin only ever display a masked value; the plaintext key is never returned to your browser. You can deactivate or delete a stored key at any time.

8. Prompt Assistance and Automatic Masks

Three plugin features send data to Google's Gemini API (Google Ireland Limited, with processing by Google LLC in the USA) in addition to the image generation itself. They differ in what they transmit and in whether they are active by default:

• Prompt enhancement (switched on by default): rewrites your prompt into a more detailed instruction for the model you selected. So that the rewrite matches what is actually on your canvas, this feature transmits not only the prompt text but also image data: your current selection or the image you are editing, and the reference images of the reference library you have selected, up to twelve images per request. The request runs through our Cloudflare Worker. You can switch prompt enhancement off in the plugin settings at any time; the generation then runs on your prompt exactly as you typed it.
• Auto mask (Beta, switched off by default): works out which object your prompt refers to and masks it automatically. It transmits the prompt text and the source image to Gemini for that decision, and it additionally transmits the image to Fal.ai, which runs the segmentation model that computes the actual mask.
• Smart layer names (switched off by default): turns your prompt into a short name for the result layer. Only the prompt text is transmitted, no image data.

In all three cases the content is processed transiently for that single request and is not stored by us. We keep only technical metadata (which feature ran, which model, how many images were attached, how long it took), never the prompt text and never the images. The legal basis is Art. 6(1)(b) GDPR (performance of the contract).

9. Transmission to AI Providers

To generate, edit, and upscale images, your prompts and image selections are forwarded securely to the AI provider serving the model you selected. We work with three providers:

• Google (Gemini and Imagen API), for the Nano Banana and Imagen models.
• OpenAI, for GPT Image.
• Fal.ai, which hosts every other model we offer, including FLUX.2, Seedream, Reve 2.1, Grok Imagine, background removal, the upscalers, the segmentation model behind Auto mask, and the training of custom style models (section 10).

Only the content required for the generation is transmitted. Personal user profiles, your e-mail address, or your license details are never shared with these providers.

Automatic switch to a backup provider: if Google or OpenAI is unavailable or returns an error, the same request can be sent to Fal.ai instead so that your generation still completes. In the plugin settings you can choose whether this happens automatically, only after you have confirmed it in a dialog, or never.

Depending on the provider, processing may take place in the USA; transfers are safeguarded by Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) GDPR.

10. Custom Style Models

You can train your own style model (a LoRA) from your own images. This feature is optional and only runs when you start a training run yourself.

The images you upload for training are stored in a private, access-controlled Supabase storage bucket, packed into a training archive, and transmitted to Fal.ai, which performs the training and hosts the resulting model file so that it can be used in later generations. When you delete a custom model in your dashboard, we delete our record of it together with the uploaded training images and the training archive. The trained model file itself is held by Fal.ai; after deletion we no longer reference or use it, and its further retention is governed by Fal.ai's own terms.

Please upload only images you hold the rights to. If your training images show identifiable people, you are responsible for having a legal basis for that, in particular their consent. The legal basis for our processing is Art. 6(1)(b) GDPR.

11. Support Requests and Bug Reports

If you send us a bug report, either through the form on this website or via "Report a bug" in the plugin, we process the e-mail address you enter, your description, the steps to reproduce, and the plugin version. Before sending, the plugin asks whether to attach a diagnostic log; nothing is attached unless you agree. That log lists what the plugin did in the last few minutes, such as clicks, settings, and errors. It is assembled in the plugin and deliberately excludes prompts, image data, file paths, layer names, API keys, and access tokens.

We use this data solely to reproduce and fix the problem and to reply to you. The legal basis is Art. 6(1)(b) GDPR where you are a customer, otherwise our legitimate interest in a working product and in answering enquiries (Art. 6(1)(f) GDPR). We keep reports until the issue is resolved and for a reasonable period afterwards in case the problem reappears.

12. Diagnostics and Error Reporting

To keep the plugin reliable and to fix problems, we process anonymous and pseudonymous diagnostic data:

• Product Telemetry: Which features and settings you use (e.g. selected output mode, enabled toggles, and counts of your saved presets and reference libraries). This never includes your prompts, your images, or any secrets.
• Crash & Error Reports: When something fails, the plugin sends a technical error report containing the error message and stack trace, the plugin version, your operating system, a randomly generated installation identifier and device identifier, and, if you are signed in, your account and license reference. Before transmission, reports are automatically scrubbed of sensitive data: access tokens, API keys, e-mail addresses, and local file paths are removed.

Both are switched on by default. You can turn them off at any time in the plugin under Settings, "Send diagnostics"; from then on the plugin sends neither product telemetry nor error reports from that installation.

This data is processed on the basis of our legitimate interest in the security, stability, and improvement of the service (Art. 6(1)(f) GDPR). You can object to this processing at any time under Art. 21 GDPR, either with the switch described above or by writing to support@seam-plugin.com.

13. Storage Period and Deletion

We store personal data only as long as it is needed for the purposes described above or as long as statutory retention obligations (for example under commercial and tax law) require.

You can delete your account at any time in your dashboard. This removes your account and login data, your licenses and seat records, your usage and credit records, your reference libraries including the stored image files, your prompt libraries, and your custom style models including the training images you uploaded.

Two things are not covered by that deletion. Error reports, product telemetry, and bug reports are kept separately for security and stability purposes; they contain no prompts and no images, and the account reference they carry no longer resolves to an existing account once you have deleted it. Payment and invoice records are held by Lemon Squeezy as merchant of record and are subject to their retention obligations, not ours. If you want your diagnostic records erased as well, write to us at support@seam-plugin.com and we will remove them unless we are required to keep them.

14. Your Rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21 GDPR). Where processing is based on consent, you may withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority; for us, this is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

Providing your e-mail address and account data is not required by law, but it is necessary to conclude and perform the contract with us. Without it we cannot create an account, issue a license, or provide the plugin. You can obtain a copy of the Standard Contractual Clauses and the other safeguards for transfers outside the European Union by writing to us.

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

To exercise your rights, contact us at support@seam-plugin.com.

15. Changes to this Privacy Policy

We may update this privacy policy to reflect changes to our services or legal requirements. The current version is always available on this page.