Last updated: 13 November 2026
Who processes your data
The controller of your data is the owner of this site, whose company details are listed under Legal information at the end of the terms of service. The site is https://imagefy.ai and the contact address is support@imagefy.ai.
For anything related to this policy, write to that address. You will get a reply from a person on our team, not an automated form.
What we process, and why
Your account
The email address, your name if you choose to give one, the password — stored as a hash, never in plain text — and the date you last signed in. If you sign in with Google — with its button, or with the small Google window offered to you if you accepted all cookies — Google tells us your email address and name.
Why: to give you access to what's yours. Legal basis: performance of the contract.
We also email you a few times after you sign up if you haven't tried the service yet. Each of those emails links to your settings, where you can turn them off. Legal basis: our legitimate interest in helping you get started.
What you upload
The photos you upload, the instructions you write, the avatars you save, and whatever comes out of them: the images and videos we generate for you.
Why: to provide the service. Legal basis: performance of the contract.
Some tools never send us anything. Background removal, upscaling, object removal, image extension, compression, conversion and resizing run inside your browser: the image is processed on your device and does not reach our servers unless you choose to save the result in your account.
There may be other people's data inside that content — the face of anyone in a photo you upload. In that case you are the controller and we are the processor: you decide what is uploaded and for what purpose. Our role is set out in the DPA.
Payments
On taking a plan, Stripe processes your card details, your name and the billing address. We never see or store your card number: Stripe only sends us the last four digits, the card brand and the expiry date, so that we can show them to you.
Why: to charge you and issue invoices. Legal basis: performance of the contract and a legal obligation (accounting and tax).
How you got here
We record where you arrive from, which pages you visit and any campaign identifiers included in the URL (utm_*, gclid). These analytics are our own and are stored on our servers; for this we use neither Google Analytics nor any other third-party tool.
If you arrive from a Google ad, we also keep a hash of your IP address — never the address itself — for 90 days, so that on a later visit our checkout recognises that you came from an ad and adapts what it shows. It is not used to identify you or to measure campaigns.
If you arrived from a Google ad and then subscribe, we tell Google Ads that the ad led to a sale, so the campaign can be measured and paid for correctly. To do this we send Google the ad's click identifier (gclid, gbraid or wbraid), the amount and the date. Where the click identifier was lost on the way — some browsers remove it — we may instead send a SHA-256 hash of your email address, which Google can only compare with its own records and cannot turn back into your address. We send that hash only if you are outside the European Economic Area, the United Kingdom and Switzerland, or if you accepted all cookies. You can object at any time from the cookie policy or by writing to us. Under the same conditions, the Google Ads tag on our website sends Google a SHA-256 hash of your email address when you sign up, sign in or start a trial, computed in your browser; your address itself is never sent (see the cookie policy).
Why: to know what works and what doesn't. Legal basis: our legitimate interest in measuring the service, collecting as little data as possible and without profiling you.
Support
Whatever you write to us.
Why: to help you. Legal basis: performance of the contract and our legitimate interest in providing support.
We don't train on your content
Neither we nor the providers involved use your photos or what you generate to train models. Those providers act as our processors and may only process the content to deliver what we have asked of them.
How long we keep it
This is the part we are asked about most, and it is worth reading in full, because what you upload and what you generate are not kept for the same length of time.
| How long | |
|---|---|
| The photos you upload | 7 days without an account · 30 days with one |
| What you generate (images, videos, logos) | For as long as your account exists |
| Saved avatars | Until you delete them; an uploaded photo is then deleted 30 days later |
| Account data | For as long as your account exists |
| What you write to support | For as long as your account exists |
| Invoices and tax records | 6 years, by legal obligation |
| Visit analytics | 24 months |
| Hash of the IP of a visit from an ad | 90 days |
| Sessions | Expire after 30 days without use |
Uploaded photos are deleted automatically and cannot be recovered afterwards. They are the most sensitive data we handle — they often show people — and they are no longer needed once the result exists, so we keep them no longer than necessary. We let you know in your dashboard two days beforehand. Without an account there is no one to tell, which is one reason that window is shorter.
What you generate is kept because it is precisely what you came for, and you paid for it. It is deleted when you delete it, when you close your account, or when you ask us to. If you delete something yourself, the file is removed from storage immediately.
Who else is involved
To provide the service we rely on the following providers, all of which act as our processors under signed contracts:
| Provider | What for | Where |
|---|---|---|
| OVHcloud | Server and file hosting | France (EU) |
| fal.ai | Running the AI models that generate and edit images and videos | USA |
| Stripe | Payments and billing | USA / Ireland |
| Resend | Email delivery | USA / Ireland |
| Cloudflare | Anti-bot check (Turnstile) | USA |
| Sign in with Google, if you use it, and measuring which ads lead to sales (click identifier and, where permitted, a hashed email) | USA |
Where data is transferred outside the European Union, the transfer is covered by the Standard Contractual Clauses approved by the European Commission, together with any supplementary measures appropriate in each case.
Your rights
You have the right to ask us for access, rectification, erasure, objection, restriction and portability of your data, and to withdraw consent wherever consent is the basis of the processing.
Write to support@imagefy.ai. The maximum time to reply is a month, though we normally answer well before that. We may ask you to verify your identity, so that we do not hand your data to the wrong person.
Much of this does not require waiting for us: from your own dashboard you can download what's yours, delete it and close the account.
If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es). We would appreciate it if you wrote to us first: almost everything can be resolved with an email.
How we protect it
Encryption in transit, with HTTPS across the whole site. Passwords are stored hashed, and so are session tokens: a copy of our database is not enough to impersonate you. Server access is by cryptographic key only, with no passwords. Your files are never public: they are served through signed links that expire within minutes.
No system is infallible. If a breach occurred that put your rights at risk, we would notify you and the supervisory authority within the deadlines set by the GDPR.
Minors
This service isn't directed at anyone under 14. If we become aware of an account belonging to a minor, we will delete it.
Changes
If we make a significant change, we will let you know by email or when you sign in. The date at the top shows when this policy was last updated.