Data processing agreement

Last updated: 15 October 2026

This agreement forms part of the terms of service and applies when what you upload contains other people's personal data, such as a photo of a person, a portrait you restore or the face you give an avatar.

Roles

When you upload a photo in which other people can be identified, you are the controller and Siteboard SL is the processor. You decide what is uploaded and for what purpose; we process it in accordance with your instructions, meaning the instructions you give by using the service.

What we process for you

Subject matter: editing the images you upload and generating images and videos from them and from your instructions.

Duration: for as long as the account remains active, and thereafter in accordance with the deletion periods.

Types of data: the image of the people who appear in your photos — their face, their appearance and anything visible in the picture — and whatever you write in your instructions. We do not use faces to identify anyone, we do not create biometric templates, and we do not request special categories of data; we recommend that you do not upload them. If you do, it is at your own responsibility.

Data subjects: anyone who appears in your photos.

What we commit to

1. Process the data solely in accordance with your instructions, meaning the instructions you give by using the service. If we consider any of them to be unlawful, we will inform you.
2. Not use your content for any purpose of our own, and in particular not to train models.
3. Keep it confidential, and require the same of anyone with access to it.
4. Apply security measures: encryption in transit, server access by cryptographic key only, short-lived signed links for every file, and access limited to as few people as possible.
5. Assist you when someone exercises their rights, or when you need to carry out a data protection impact assessment.
6. Notify you without undue delay of any breach affecting your data, with everything we know, so that you can meet your own deadlines.
7. Return or delete the data at the end of the service, as you prefer. In the absence of instructions, we will delete it.
8. Provide you with the information you need to demonstrate compliance with these obligations.

Your responsibilities

Verifying that you are permitted to upload and transform what you upload: that you have a legal basis and that you have informed the people who appear in it. Rules on a person's image vary from country to country, and we cannot check them on your behalf.

Sub-processors

We use the following sub-processors. By accepting this agreement you authorise them; if one is added or replaced, we will give you reasonable notice and you may object.

We have a contract with each of them containing obligations equivalent to those in this document. Only OVHcloud and, when you use a tool that runs on our servers, fal.ai have access to your photos and what you generate. Stripe, Resend and Cloudflare never see your content.

Outside the European Union

Your files are stored in France. The tools that run in your browser never send your photos anywhere.

The AI models that run on our servers do so through fal.ai, in the USA. Those transfers, like email, payments and the captcha, are covered by the Standard Contractual Clauses approved by the European Commission, together with any supplementary measures appropriate in each case.

Retention

Uploaded photos are deleted automatically after 7 days without an account and after 30 days with one. What you generate is kept for as long as the account exists. You can delete anything earlier from your dashboard, and closing the account deletes everything.

Audits

We will provide the reasonable information you request to demonstrate our compliance. If an on-site audit is required, give us reasonable notice and we will agree on it, without disrupting the service for other customers.

Conflicts

In matters of personal data, this agreement takes precedence over the terms.