The terms on which Vallic processes personal data in the photos you send to Photos.sh, and the companies that help.
Scope and roles
This agreement applies where a customer's photos, or the text in them, contain personal data, such as people who can be recognised, or names and addresses on a label. For that data the customer is the controller and Vallic, which runs Photos.sh, is its processor. This agreement is part of the terms of service.
Subject and purpose: processing the photos, and any images fetched from addresses the customer gives, to produce the results the customer asks for. Duration: as long as the customer uses Photos.sh. Data subjects: the people shown or named in the photos. Types of data: images and the text in them.
Our obligations
We process the data only on the customer's documented instructions: the requests the customer and its members make in the browser and through the API, and these terms. We tell the customer if we think an instruction breaks data protection law.
Everyone at Vallic who can reach the data is bound to confidentiality.
We help the customer answer requests from data subjects, and meet its duties on security, breach notification and impact assessments, as far as our part of the processing allows.
We notify the customer without undue delay after becoming aware of a personal data breach that affects its data, with what we know and what we are doing about it.
We make available the information needed to show that we meet this agreement, and allow audits by the customer or an auditor it chooses, on reasonable notice and at the customer's cost.
Security
A photo sent to a tool is processed in memory and not stored after the result is returned. A batch job and its results are deleted when the customer deletes the job, and at most 24 hours after it finishes.
In the Shopify app, a copy of a processed result is kept only until it has been added to the customer's store and is deleted then; where the work is cancelled or fails, the app is uninstalled, or a preview is not applied, it is deleted within 24 hours.
Traffic is encrypted in transit. Access to an account's data is limited to its members, by role. The console supports two-step sign-in, API keys are stored only as hashes, other secrets are encrypted at rest, and every change in an account is written to its audit log.
Photos are processed on our own servers by our own models, and are not sent to other companies' AI services.
Sub-processors
We use the companies below. We tell account owners by email at least 30 days before we add or replace one, and an owner may object; if we cannot meet the objection, the owner may close the account.
| Sub-processor | What for | Data it handles | Where |
|---|---|---|---|
| Gcore | The servers that run the console, its database and the image engine | Account and billing data and usage records; photos while they are processed, batch jobs until they are deleted, and the Shopify app's results until they are added to the store | European Union |
| Stripe | Payments and the payment page | The billing name, email address, address and VAT number; payment details are entered on Stripe and never reach us | Ireland and the United States (to confirm) |
| MailerSend | Sending the console's email: sign-up and sign-in links, invitations and security notices | Recipient addresses and the text of each message | United States |
End of processing and transfers
Photos and results are not kept beyond the periods above, so when the service ends nothing remains to return or delete, other than what the law requires us to keep.
Where data leaves the European Union, the transfer is protected by the EU–US Data Privacy Framework or by the EU's standard contractual clauses.