Privacy policy

Last updated: 28 October 2026

Who we are and where data is stored

Framezi is operated by Infonits, a company registered in Sri Lanka. Account, campaign and participation data is stored with our database provider, Supabase, in its Sydney, Australia region, and the application runs on servers in the same region.

If you use Framezi from outside Australia, including the United Kingdom, the European Economic Area, the United States or Canada, the information described below is transferred to and stored in Australia. Original photos are never part of this: they stay on your device.

What we store

Framezi, an Infonits product, helps campaign organisers offer personalised event photo frames. When you register, we may store:

• Creator profile name, email address, account identifier, and authentication session when you create campaigns.
• Your name and email address, as required by the campaign.
• The campaign you participate in and your registration time.
• Your participation consent and optional marketing choice. If you enter a name, it is shown on the campaign's public participant list.
• Generation, download, frame selection, and sharing activity.
• Safety reports, moderation decisions and account restriction status when content or a creator profile is reviewed.
• If you use a campaign community wall, the public name and message you submit, replies, reactions, reports, and the organiser’s moderation decisions.

What we do not store

We do not store your original photographs, cropped photographs, face detection data, or biometric information. Editing happens locally in your browser. These photos are held in browser memory, not in browser storage or a server database.

How your information is used

Campaign organisers use registration information to administer their event and understand participation. Campaign organisers can view and export the names, emails and join times collected for their campaign. We send service emails such as password resets. Marketing consent is optional, unchecked by default, and separate from participation consent.

When you provide a name to join a campaign, it appears in a moving public participant list on that campaign page. Your email address is never shown there. You can leave the name empty to join privately.

Creator account details are used to secure the dashboard and keep each creator’s campaigns, participant records, and analytics separate from other creators.

Zizi, the chat helper

If you write to Zizi, the helper in the corner of the page, your messages, the page you are on and the page language are sent to our AI provider, Anthropic, to write a reply. If you are signed in as a creator, Zizi can read your own campaign counts when you ask about them. Zizi cannot receive photos, and we do not store chat messages on our servers. The conversation is kept in your browser tab until you close it. Please don’t share personal details in the chat.

Sharing your frame

Downloading saves a file to your device. If you choose your device’s Share menu, the selected app receives the file you explicitly share. If you separately choose Post, you sign in to a Framezi account and Framezi stores the caption you write and the finished framed image (resized to at most 1080 pixels, with photo metadata removed), a small thumbnail and a social preview, and creates a public share page. Your original photo is never uploaded. The image appears in the campaign’s supporter gallery and community wall and on the organiser’s Framezi profile. It is deleted after 30 days, or earlier when a campaign’s gallery holds more than its newest 100 frames. You can remove it at any time with Unpublish from the same browser, or contact support for help. Facebook sharing opens the campaign link; Framezi does not automatically upload your image to Facebook.

Support requests

When you contact us, we store the name, email, campaign link, message, device/browser details, and any screenshot you choose to attach in a private support ticket. Screenshots are kept in private storage. We use this information only to respond, investigate, and resolve the request. Screenshots are normally deleted within 90 days and the ticket within 12 months after closure, unless law or an active dispute requires longer retention.

Campaign and public-image reports store the selected reason, optional details, the reported item, and a one-way keyed browser or network hash used to prevent duplicate abuse. Reports are private and reviewed by authorised Framezi staff.

Community messages and device identity

Community messages are optional and public. A random device key is stored in localStorage so the same browser can edit or delete its own recent messages, react once per message, and attach only a frame it published. The raw key is sent only to Framezi’s API. The database stores a one-way keyed hash, not the raw device key, and public APIs never return that hash.

Messages may be automatically checked for links, contact details, configured blocked words, spam, abuse, or impersonation, and may wait for organiser approval. Organisers can approve, hide, pin, export, or remove messages and can block a device from posting on their campaign. Reports are visible to the organiser and repeated reports may temporarily hide a message. Cloudflare Turnstile may process ordinary browser and network signals to prevent automated posting.

Service providers and security

Supabase provides authentication and database services, and the deployment provider serves the application. Hosting providers may process network information, such as IP addresses, for delivery and security. Framezi’s rate limiter stores short-lived keyed hashes rather than raw IP addresses. Creator-uploaded branding and frame artwork may be publicly hosted.

If a signed-in creator chooses an AI writing, frame-design, or frame-review action, their campaign details, design brief, frame artwork, or sample preview is sent to Anthropic to provide editable suggestions. Public description rewrites and on-demand translations also send the relevant campaign text and requested language when used. These actions do not send participant photos, names, or email addresses to Anthropic.

Retention and your choices

Campaign organisers determine how long registration records are needed, subject to applicable law. Contact your campaign organiser or email support@framezi.app to ask about access, correction, deletion, or withdrawal of consent. Deleting a campaign in Framezi removes its participant records and event history. Downloaded exports and provider backups may have separate retention periods.

You may ask to access, correct or delete your personal data, withdraw consent, or object to its use. We aim to respond within 30 days. You may also complain to the Data Protection Authority of Sri Lanka or, if you are in the United Kingdom or the European Economic Area, to your local data protection authority (for example, the Information Commissioner’s Office in the UK).

We may retain limited enforcement records for as long as reasonably needed to prevent repeat abuse, protect users, resolve appeals and meet legal obligations. A banned profile cannot publish new campaigns.

Cookies and device storage

Secure session cookies support creator sign-in and validate participation events. We do not store photographs in cookies, localStorage, sessionStorage, or service worker caches. A campaign translation may be cached in sessionStorage to avoid a repeat request during your visit. A random community device key may be kept in localStorage as described above. This application does not include advertising or third-party tracking scripts, so these strictly necessary items are the only kinds of cookies and storage we use. The cookie policy lists every one.

Children

Creators must be at least 18. Supporters under 16 should use Framezi with a parent or guardian’s permission. Organisers of school campaigns are responsible for obtaining any permission required to collect names.

Questions

Contact the organisation named on your campaign page for campaign-specific privacy requests, or email support@framezi.app for Framezi privacy questions. WhatsApp +94 70 589 7253 is also available for privacy and removal requests.