Privacy Policy

1. Controller and scope

The operator identified on the Contact page is the controller of the personal information processed through Fotoly. This policy covers website visitors, account holders, and subscription customers.

2. Information we collect

• Account details such as name, email address, authentication identifiers, and subscription status.
• Uploaded files and generated outputs, including processing history, selected settings, and delivery metadata.
• Billing and transaction records provided by our payment processor for subscription management, fraud prevention, and support.
• Technical and operational data such as log data, job status, request timing, IP address, cookies or similar storage, advertising identifiers, and device/browser information needed to secure, measure, and improve the service.

3. How we use personal information

• To authenticate users, provide the dashboard, and deliver requested processing workflows.
• To manage subscriptions, payments, invoices, credit usage, refunds, and related customer support.
• To detect abuse, enforce our Terms, maintain platform security, and prevent fraud.
• To monitor service performance, troubleshoot errors, and improve workflow quality.

4. Third-party processors

• Clerk for authentication and account management.
• Stripe for card subscription payments, billing events, and payment-related fraud controls.
• Cloudflare R2 for storage of uploaded and generated image files.
• Google Gemini, Photoroom, and Fal.ai for image analysis, generation, enhancement, or related AI processing.
• Google Analytics and, when enabled on eligible public content pages, Google AdSense for audience measurement, advertising delivery, fraud prevention, and reporting.
• Google Tag Manager, Meta Pixel, PostHog, Rewardful, and Vercel Analytics for tag delivery, attribution, product analytics, referral tracking, performance measurement, and related reporting where enabled and permitted by applicable consent choices.
• Resend for transactional email delivery and Upstash QStash for asynchronous job delivery when needed.

5. Retention

We retain account and billing records for as long as reasonably necessary to operate the service, meet legal obligations, resolve disputes, and enforce our agreements.

Uploaded images, generated outputs, and workflow history may remain available while your account is active unless they are removed through support handling or internal retention rules. If you want data deleted, please contact support. We do not currently promise a self-service deletion workflow for images or accounts.

6. Your requests and rights

• You may request access to, correction of, or deletion of personal information by contacting support from your account email address.
• You may opt out of non-essential product emails. Service and billing communications may still be sent when required to administer your account.

7. Security and cross-border processing

We use reasonable technical and organizational safeguards, including HTTPS/TLS, access controls, and processor-based cloud security tools. No system can be guaranteed to be perfectly secure.

Because our providers may operate in multiple jurisdictions, your information may be processed or stored outside your home jurisdiction when necessary to deliver the service.

8. Advertising, cookies, and privacy choices

Eligible public content pages may display ads served by Google AdSense. Google and its advertising partners may use cookies, local storage, device information, IP-derived location, and advertising identifiers to deliver, limit, measure, and prevent fraud in personalized, non-personalized, or limited ads. We do not intentionally send names, email addresses, phone numbers, uploaded images, or other directly identifying account data to AdSense.

Where required, we use a consent management platform to request and record advertising choices before eligible advertising storage is used. You may withdraw or change consent through the privacy controls shown on the site, use Google Ads Settings at https://adssettings.google.com, or use applicable browser and regional opt-out tools. California and other covered U.S. residents may also use those controls to opt out of the sale or sharing of personal information for cross-context behavioral advertising where applicable.

More information about how Google uses data from sites that use its services is available at https://policies.google.com/technologies/partner-sites. Ad availability, partners, and retention periods can vary by region, consent choice, and Google configuration.

9. Policy updates

We may update this Privacy Policy from time to time. The latest version will remain available on this page.