Privacy policy

The controller of your personal data is the operator of PhotoRescue (photo-rescue.com) named in section 1 ("Provider") of our terms of service, an individual based in Brazil ("we", "us").

For every privacy question or request, email support@photo-rescue.com and put "Privacy" in the subject line. We have not appointed a data protection officer, as none is required at our size; please contact the operator directly at that address.

When you upload a photo, we store it so our servers can process it, and we store the result so you can view and download it. Free results are also stored as a watermarked copy.

Uploads and results are deleted automatically within 24 hours. Download anything you want to keep before then.

Processing runs on rented GPU servers (Beam.cloud), which receive the photo, process it and return the result. Files are stored in Cloudflare R2.

We never use your uploaded photos or your results to train or improve AI models, and we never sell them or share them for anyone else's purposes. We do not look at your photos, except when you ask us to in a support request or when we must investigate a specific report of abuse or a legal request.

We keep a short record of each processing job: the file name you uploaded, the tool used, the time, the status and the credits charged. These records contain no image data.

Please do not upload photos of identity documents, medical records or other sensitive material unless you have a good reason and the right to do so.

Account data: if you create an account, our sign-in provider Clerk processes your email address, your login details and your session. We store your email address, your plan and your credit usage with the account.

Billing data: payments are handled by Stripe. Stripe collects your card or other payment details; we never see or store your full card number. We receive and store your Stripe customer and subscription IDs, your plan, your billing period and the payment status. Stripe also keeps your invoices and your billing country for tax purposes.

Credit usage: we count how many credits each account or anonymous visitor has used in the current day or billing period, so the plan limits work.

Anonymous visitor ID: to give visitors without an account their free credits and to keep each visitor's uploads private to them, we set a cookie (pr_anon_id) with a random ID. It does not contain your name, email or IP address.

Free-tier abuse prevention: when you use the uploader, a script (the open-source FingerprintJS library) runs in your browser and calculates an identifier from browser and device characteristics, such as browser version, screen and system settings. This identifier is sent with processing requests. We store it only as a keyed one-way hash (HMAC), together with a keyed hash of your IP address, to count free credits per device and per network and to stop people from getting unlimited free processing. We do not use it for advertising, profiling or tracking you across other websites.

IP address and security: our servers use your IP address to deliver the site, to rate-limit requests and to enforce the free daily limit. For the free limit we store a keyed hash of the IP address, not the address itself. These hashes are pseudonymous, not anonymous: they still count as personal data. Our hosting provider keeps technical logs.

Analytics: only if you accept analytics cookies, Google Analytics measures which pages are visited and how the site is used. See section 7. Separately, Vercel Web Analytics counts page views without cookies: it stores nothing on your device, does not identify you, and only gives us aggregated statistics.

Support: if you email us, we use your message and email address to answer you.

Providing the service you asked for, including processing your photos, your account, your plan and payments: performance of a contract (Art. 6(1)(b) GDPR; Art. 7, V LGPD).

Keeping invoices and payment records: legal obligation (Art. 6(1)(c) GDPR; Art. 7, II LGPD).

Security, fraud prevention, rate limits, the anonymous visitor ID and free-tier abuse prevention (device identifier and IP hashes): our legitimate interest in offering a free tier without it being abused and in keeping the service and its users secure (Art. 6(1)(f) GDPR; Art. 7, IX LGPD). You can object at any time (section 9).

Google Analytics: your consent (Art. 6(1)(a) GDPR; Art. 7, I LGPD), which you can withdraw at any time through Cookie settings in the footer. Cookieless page-view statistics (Vercel Web Analytics): our legitimate interest in knowing how the site is used.

We do not make decisions with legal or similarly significant effects about you based solely on automated processing. The free-limit check is automated, but it only decides whether a free credit is available.

We do not sell your personal information and do not share it for targeted (cross-context behavioural) advertising.

We use these providers to run the service. Each processes data only to provide its service to us or, for payments, as an independent provider under its own terms.

Vercel Inc.: website hosting, server functions, technical logs and cookieless page-view statistics.

Cloudflare, Inc. (R2): storage of uploads and results for up to 24 hours.

Beam (beam.cloud): GPU servers that process your photos.

Supabase, Inc.: database for accounts, plans, credit usage, job records and abuse-prevention hashes.

Clerk, Inc.: sign-up, sign-in, sessions and account emails.

Stripe (Stripe, Inc. and its affiliates): payments, subscriptions, invoices, tax calculation and the billing portal.

Google LLC / Google Ireland Ltd. (Google Analytics 4): usage statistics, only with your consent.

These providers may process data outside your country, including in the United States, under standard contractual safeguards (see section 6). The current list is on our sub-processors page.

The operator is based in Brazil, and our providers process data in the United States and other countries. Your data may therefore be processed outside your country, including in countries whose data protection laws differ from yours.

Where your law requires a transfer mechanism (for example the GDPR, the UK GDPR or the LGPD), transfers rely on an adequacy decision where one exists, on the EU-U.S. Data Privacy Framework (and its UK extension) where the provider is certified, or on the standard contractual clauses that the providers include in their data processing terms.

pr_anon_id (our cookie, necessary): a signed random ID for visitors, used for free credits and to keep uploads private to the visitor who made them. Lasts 180 days.

Sign-in cookies (Clerk, necessary): keep you signed in. Set when you use sign-in or your account.

pr_analytics_consent (browser storage, necessary): remembers whether you accepted or declined analytics.

Uploader progress (browser storage, necessary): if you start a batch or a single photo and reload the page, the uploader remembers the job so you can get your results. Cleared when the job finishes.

Device identifier (FingerprintJS, necessary for abuse prevention): calculated in your browser when you use the uploader; it does not store a cookie. See section 3.

Google Analytics cookies (_ga, _ga_*; optional): set only after you click Accept, and kept for up to 2 years. Before you choose, and if you decline, no Google Analytics script is loaded and no request is sent to Google.

Stripe sets its own cookies on its checkout and billing pages, for payment security and fraud prevention.

Changing your choice: the banner appears on your first visit. You can change your choice at any time with the Cookie settings link in the footer of every page.

Uploads, results and watermarked copies: deleted automatically within 24 hours.

Job and upload records (original file name, tool, time, status, credits): deleted after 30 days. A job with a refund still pending is kept until the refund is resolved.

Free-tier counters: free-usage counters (keyed IP and device hashes) are deleted after 2 days; rate-limit counters 1 day after their time window ends.

Credit ledger and credit counters: kept for 400 days, for billing disputes and accounting.

Account data: as long as your account exists. When you delete your account, any subscription is cancelled and we delete your account, plan, credit history, job records, stored files and API keys straight away. Copies in our providers' backups and logs are overwritten in their normal cycles. So that a late payment event cannot recreate a deleted account, we keep only a one-way SHA-256 hash of its account ID, which contains no name, email or other account data.

Invoices and payment records: as long as tax law requires (usually up to 10 years).

Analytics data (Google Analytics): 2 months.

Server logs: kept by our hosting provider for a short period, usually no more than 30 days.

Support emails: as long as needed to handle your request, and up to 2 years after our last exchange.

Depending on where you live, you have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to withdraw consent at any time without affecting earlier processing.

You have the right to object at any time to processing based on our legitimate interest (section 4), on grounds relating to your particular situation.

If you are in Brazil, the LGPD also gives you the right to confirmation that we process your data, to anonymisation, blocking or deletion of unnecessary or unlawfully processed data, to information about the entities we share data with, and to information about the possibility of refusing consent and its consequences.

To use these rights, email support@photo-rescue.com with "Privacy" in the subject line. We answer within 30 days. We may need to confirm that the request comes from you, and we may extend the period where the law allows it, telling you why.

You also have the right to complain to the data protection authority of the country where you live or work, for example your national authority in the EU, the ICO in the United Kingdom, the ANPD in Brazil, the OAIC in Australia or the Office of the Privacy Commissioner in Canada. We would appreciate the chance to resolve your concern first.

All traffic is encrypted with TLS. Uploads and results are stored privately and are only reachable through short-lived signed links for the visitor or account that created them. Access to our production systems is limited to the operator. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

The service is not directed to children. You must be at least 18 years old to use it, and minors may not use it. We do not knowingly collect personal data from children (including children under 13 in the United States). If we learn that we have, we delete it. If you believe a child has given us personal data, email us.

We will update this policy when the service or the law changes. The date at the top shows the latest version. If a change matters to you, we will tell you on the site or by email before it applies.

This policy is written in English. Translations are provided for convenience; if they differ, the English version prevails.