What Photos.sh keeps about you and your photos, why, for how long, and who else handles it.
Who is responsible
Vallic d.o.o. runs Photos.sh and is the controller of the personal data of the people who hold accounts with it and of the people who write to us. Write to contact@vallic.com about anything in this notice.
For personal data inside the photos customers send us, the customer is the controller and we are its processor, under the data processing agreement.
Your photos
A photo sent to a tool, in the browser or through the API, is processed in memory to produce the result and is not stored once the result is sent back. The results of the browser tools stay in your browser tab.
A batch job keeps its photos, including those it fetched from addresses you gave, and its results until you delete the job, and at most 24 hours after it finishes.
The Shopify app fetches a product image from your store, processes it, and adds the result to your store. We keep a copy of the result only until it has been added: usually a few seconds, and longer only while the work is held up, for example when your store is not answering or your plan has no credits left. The copy is deleted as soon as the result is added. If the work is cancelled or fails, the app is uninstalled, or you do not apply a preview, it is deleted within 24 hours. The image fetched from your store is not stored.
Photos are processed on our own servers by our own models; they are not sent to other companies' AI services. We do not use them to train or improve models unless you opt in, and we offer no such opt-in today.
What else we keep
Account data: your name, email address, password (only as a secure hash), time zone, two-step sign-in settings, and your roles in organisations; and the email addresses of the people invited to an organisation.
Billing data: the billing name, address and VAT number with the result of its check in the EU's VIES service, and the orders, receipts, refunds and payment references. Card and other payment details are entered on Stripe's page and never reach us.
Usage data: for every request a tool processes, the time, the tool, the number of photos, the credits it cost, and whether it came from the browser or from which API key. API keys themselves are kept only as hashes.
Security data: the audit log of changes in an account, with the IP address each came from; sign-in sessions; and the records used to slow down repeated sign-in attempts.
Visit statistics
If you accept in the cookie banner, the public pages (the home page, pricing, tools, marketplaces, the API reference and these legal pages) load Google Analytics, to count visits and see which pages people read. Google then receives the address of each page you open, the page you came from, your browser and device details and your IP address, and sets the cookies listed under Cookies. Google signals and advertising features are off, and the statistics are kept for two months.
Until you accept, or if you decline, the pages do not load Google Analytics and nothing is sent to Google. The banner keeps your choice in your browser's local storage for six months, without sending it to us; Cookie settings at the bottom of every public page changes it, and declining deletes the Google Analytics cookies. The console, sign-in, sign-up, checkout and billing pages never load it, so no account data reaches Google.
Why, and on what basis
To provide the service you signed up for and bill it (the contract with you); to keep invoices, receipts and VAT records (a legal obligation); and to keep the service and accounts secure and prevent fraud and abuse (our legitimate interest).
Visit statistics with Google Analytics: your consent, given in the cookie banner and withdrawn at any time under Cookie settings.
If we ever offer an opt-in for training models, we will use photos for it only with your consent, which you can withdraw at any time.
We send the email the service needs: sign-up and sign-in links, invitations, security notices and messages about your account and purchases. We send no marketing email without your consent.
How long
Account data is kept while the account exists. When an organisation is closed, its members and API keys are deleted 30 days later. The audit log is kept for 60 days.
Orders, receipts, payment and VAT records, and the credit and usage records behind them, are kept for as long as Croatian accounting and tax law requires (up to 11 years).
Your own sign-in profile is kept until you delete it or ask us to.
Who else handles it
The companies that process data for us are listed, with what they do and where, on the sub-processor list of the data processing agreement. Stripe processes payments, and also processes payment data for its own fraud prevention, under its own privacy policy. Google (Google Ireland Limited) processes the visit statistics for us, only if you accept them.
Our servers are in the European Union. Where a provider handles data outside the EU, as Stripe and Google may in the United States, the transfer is protected by the EU–US Data Privacy Framework or by the EU's standard contractual clauses.
Cookies
Photos.sh itself sets two cookies: the session cookie that keeps you signed in, and one that remembers whether you chose the light or the dark theme. Both are needed for what you ask the site to do, and need no consent.
Only if you accept visit statistics, Google Analytics sets _ga and _ga_KGW40BXE3G on the public pages, to tell visits apart. They last up to two years, unless you decline under Cookie settings, which deletes them, or delete them yourself. There are no advertising cookies.
Stripe's payment page sets its own cookies, for payment security.
Your rights
You may ask for a copy of your data, its correction, its deletion and its transfer, and you may object to or restrict its processing. Write to contact@vallic.com; we answer within a month.
You may also complain to a data protection authority: in Croatia, AZOP (Agencija za zaštitu osobnih podataka), or the authority where you live or work.
We make no automated decisions about people that have legal or similarly significant effects.