Privacy Policy

Last updated: June 25, 2026

1. Data Controller

Looming is operated by Fashion Node Studio. We are the data controller responsible for your personal data. For privacy-related inquiries, contact us at privacy@looming.cn.

2. Data We Collect

• Account Information: Email address, display name, and authentication credentials.
• Payment Information: Processed by third-party payment providers such as Xunhupay for WeChat Pay and Paddle for international checkout where available. We do not store credit card numbers, bank details, or payment account passwords.
• Usage Data: Feature usage patterns, session duration, and interaction data to improve the platform.
• Uploaded Content: Design images, sketches, and reference materials you upload for AI processing.
• Workspace and Design Memory: Node graphs, prompts, generated-image feedback, personal design-brain memories, gallery actions, and owner-scoped preference signals used to restore your workspace and personalize future design suggestions.
• BYOK Provider Settings: API keys or provider settings that you choose to enter for Bring Your Own Key workflows. BYOK keys are intended to remain under your control and are used only to connect the provider you select.
• Technical Data: Browser type, device information, IP address, and access timestamps.

3. How We Use Your Data

• To provide and maintain the Looming platform and its features.
• To process your subscription and manage your account.
• To personalize your own design workflow, including owner-scoped design-brain memories, prompt rewrite suggestions, and workspace restoration.
• To improve platform performance and reliability using aggregated or anonymized diagnostics.
• To communicate service updates, security alerts, and support responses.
• To comply with legal obligations.

4. Data Storage and Processing

• Cloudflare: CDN delivery, Workers for serverless compute, and edge caching.
• Xunhupay: WeChat Pay order creation, payment notification, and transaction status processing for supported domestic payments.
• Paddle: International payment processing, receipts, and tax compliance where available.
• fal.ai: AI image generation processing. Uploaded images are processed transiently and not retained after generation.
• SiliconFlow: AI language model inference for design assistance features.
• Selected AI Providers: When you choose a route that uses OpenAI-compatible APIs, Replicate, APIMart, Nano Banana/Gemini, Midjourney-compatible, or other supported providers, the prompt, selected image, mask, or relevant workflow data may be sent to that provider solely to perform the requested generation, edit, analysis, or refinement.
• Browser Storage: localStorage and IndexedDB may store workspace state, cached images, BYOK provider settings, user preferences, gallery metadata, and personal design-brain snapshots so the app can work reliably between sessions.

5. Third-Party Services

We share data with the following third parties only as necessary to provide our service:

• Xunhupay — WeChat Pay order and notification processing.
• Paddle — International checkout and Merchant of Record services where available.
• Cloudflare — Content delivery, security, and serverless infrastructure.
• fal.ai — AI image generation and processing.
• SiliconFlow — AI language model services.
• Other AI providers you select — Image generation, image editing, vision analysis, or language model inference when you choose that route or provide your own API key.

6. Uploaded Content, AI Processing, and Design Memory

• You control the images, references, prompts, and design files you upload. Upload only content you have the right to use.
• Looming uses uploaded content and feedback to provide the requested feature, restore your workspace, and personalize your own owner-scoped design-brain memories.
• Looming does not sell your uploaded design files or private design-brain memories.
• Looming does not use your private uploaded content to train a general foundation model for other customers. Your explicit likes, dislikes, gallery actions, and imported memories are used as private product memory for your account unless you choose to export or share them.
• Third-party AI providers may process submitted prompts, images, masks, or references according to their own terms and privacy policies. BYOK users should review the provider they connect.

7. Your Rights

Under GDPR and applicable data protection laws, you have the right to:

• Access — Request a copy of all personal data we hold about you.
• Rectification — Correct any inaccurate personal data.
• Erasure — Request deletion of your personal data ("right to be forgotten").
• Data Portability — Export your data in a machine-readable format.
• Restriction — Restrict processing of your personal data in certain circumstances.
• Objection — Object to processing based on legitimate interests.

To exercise any of these rights, contact privacy@looming.cn. We will respond within 30 days.

8. Cookies, Local Storage, and IndexedDB

Looming uses essential cookies, localStorage, and IndexedDB for:

• Authentication session management.
• Saving your workspace preferences and settings.
• Maintaining application state between sessions.
• Storing node graphs, short URLs, provider settings, cached images, gallery metadata, design-brain memories, and local backup/restore data.

Clearing browser storage may remove local workspaces, cached images, BYOK keys, and unsynced personal memories. Cloud-synced account data and exported backups may remain available depending on your plan and sync status.

We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

9. Data Retention

• Account data is retained for the duration your account remains active.
• Upon account deletion, all personal data is permanently erased within 30 days.
• Anonymized, aggregated usage statistics may be retained indefinitely for service improvement.
• Payment records are retained by the relevant payment provider in accordance with their legal obligations.
• Local browser data remains on your device until you clear browser storage, reset the app, or overwrite it with a new workspace.
• Backups and exported design-brain snapshots remain under your control wherever you save or import them.

10. GDPR Compliance

We are committed to compliance with the General Data Protection Regulation (GDPR). Our lawful bases for processing include: contract performance (providing the service), legitimate interests (improving the platform), and consent (where specifically requested). For users in the European Economic Area, data transfers outside the EEA are protected by appropriate safeguards.

11. Data Security

We implement industry-standard security measures including encryption in transit (TLS), secure authentication, and access controls. However, no method of transmission over the Internet is 100% secure.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email at least 14 days before taking effect.

13. Contact

For privacy-related questions or to exercise your data rights, contact us at privacy@looming.cn.