Privacy Policy

The business responsible for your personal data (the “controller” under the GDPR and the “business” under US state privacy laws) is:

Resizing, cropping, compression and format conversion happen in your web browser. Your photos are not uploaded to us or to anyone else, and we keep no copy. We do not record photo content or file names.

• Account data: your name and email address, and your password in hashed form. If you sign in with Google, we receive the basic profile Google shares: name, email address and profile image link.
• Session and security data: a sign-in session, with the IP address and browser details (user agent) it was created from, so we can keep accounts secure. A session lasts up to 7 days.
• Usage records: for each pack you export: the marketplace preset, the number of photos, total size before and after, the time and whether it completed. We also keep a monthly count of packs to apply the free plan limit.
• AI photo tool, only if you use it: the photo you pick (shrunk in your browser first to a JPEG of at most 2048 pixels on the long side), the look you choose and your optional note, or the text description you type if you generate a photo. We pass this to our AI provider to create the result, and the result passes through our server on its way to you. We do not store the photo or the result ourselves. We record how many AI photo credits you use.
• Page-view statistics: when you open a page, our own server records the page, the website you came from (or, if you arrive through a link we sent you, the short campaign name in that link, such as "mail-a"), your country (worked out on our own server from your IP address, which is not kept; IP geolocation by DB-IP), whether you use a phone, tablet or computer, and your browser name. We do not store your IP address, set a cookie or use any identifier. To estimate how many different people visit in a day, we briefly process your IP address and browser details in memory and turn them, with a random value that we delete every day, into a one-way code that cannot be traced back to you. We do not count visits from browsers that send a Do Not Track or Global Privacy Control signal, or from bots.
• Analytics, only if you accept it: if you click “Accept analytics” or “Allow analytics” in the cookie notice or on the Cookies and storage page, Google Analytics records your page views, approximate location (country/city level, from your IP address) and device type using its own cookies. It stays off until you say yes, and you can withdraw your choice at any time on that page. We do not use it for advertising.
• Billing data: if you subscribe, your Stripe customer reference, subscription status, plan, renewal date and whether it is set to cancel. Your card details go directly to Stripe. We never see or store them.
• Messages you send us: the name, email address and text you put in the contact form or an email, and your consent record if you subscribe (the time you accepted the terms at checkout).
• Email we send you: account and billing messages only: password reset, subscription confirmation and cancellation notices, and failed-payment notices. We do not send marketing email.
• Server logs: our hosting provider records technical request data, such as IP address and time, to run and protect the Service.

We do not collect biometric, health, precise-location or other sensitive personal information, and we make no decisions about you by automated means that have legal or similarly significant effects.

We store a sign-in cookie (after you sign in), a usage cookie (only if you export a pack in the studio without an account, so the free pack stays limited to once a month), if you click the theme button your light or dark choice, and if you close the cookie notice a note that you did. All of these are strictly necessary for features you asked for, and we use no advertising. The only tracking technology we use is the Google Analytics above, which is off by default and loads only after you accept it. We count page views ourselves, on our own server, without a cookie or anything stored in your browser (see “What we collect”). The full list of what we store, with names and lifetimes, is on the Cookies and storage page. We honor Global Privacy Control and Do Not Track signals: if your browser sends one, we do not count your visit on our own server, and we do not even offer the analytics choice, so it stays off.

• To provide the Service, your account and your subscription, and to apply plan limits. Basis: performing our contract with you.
• To keep the Service secure, prevent abuse and fix faults. Basis: our legitimate interests.
• To take payments, keep financial records and meet tax and legal obligations. Basis: legal obligation and contract.
• To answer your messages and requests. Basis: our legitimate interests, or taking steps you ask for.
• To understand how many people use the site and which pages help them, using the anonymous page-view statistics above. Basis: our legitimate interests.
• To understand traffic trends in more detail through Google Analytics, only for visitors who accept it. Basis: your consent, which you can withdraw at any time on the Cookies and storage page.

The bases above are the ones used under the EU and UK GDPR. In the United States we process this information for the business purposes just listed.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We use these service providers to run the Service. They act on our behalf and handle data only to provide their service:

• Our website hosting provider: delivery of the website and server logs, and the mailbox our account and billing emails are sent from.
• Neon: our database, hosted in the Frankfurt, Germany region.
• Stripe: payments, receipts and the billing portal.
• Higgsfield: our AI photo provider, only if you use the AI photo tool. It receives the photo you pick (or the text you type) and your optional note, creates the result, and keeps them temporarily. Its documentation says it keeps request data for seven days after a request finishes; it does not say how long it keeps an uploaded photo.
• Google: sign-in, only if you choose to sign in with Google, and Google Analytics, only if you accept it.

We may also disclose data where the law requires it, to enforce our terms, or to protect people and the Service.

We operate from the United States and our providers operate internationally, so your data may be processed in the United States and in other countries, whose data protection law may differ from yours. For people in the EEA, the UK and Switzerland, transfers to countries without an adequacy decision rely on safeguards such as the EU Standard Contractual Clauses and, where a provider is certified, the EU-US Data Privacy Framework.

• Account and usage data: while your account exists.
• Sign-in sessions: up to 7 days, or until you sign out.
• Page-view statistics: up to 13 months. They contain nothing that identifies you.
• Analytics data, only if you accept it: kept by Google under its own retention settings (currently up to 13 months); see Google's Privacy Policy.
• Messages to us: as long as needed to handle your request, then deleted.
• Billing records: Stripe and we keep what tax, accounting or other law requires, for as long as it requires.
• Server logs: for a short period set by our hosting provider.

You can delete your account yourself at the bottom of your dashboard, or ask us to. We then delete your account, export history and usage records, except what we must keep by law (for example payment records).

You may have the right to access your data, correct it, delete it, receive a copy in a portable format, object to or restrict some uses, and withdraw consent you gave. You can also complain to your local data protection authority.

Depending on where you live (for example California, Colorado, Connecticut, Virginia and other states with privacy laws), you may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• correct inaccurate information and ask us to delete your information;
• opt out of the sale or sharing of your information (we do neither) and of targeted advertising (we do none);
• not be treated worse for using these rights.

In the past 12 months we collected these categories: identifiers (name, email address, IP address), commercial information (subscription and usage records), internet and device information (browser details, sign-in sessions) and your messages to us. We collected them from you and from your sign-in provider, and used them for the purposes in section 5. We disclosed them only to the service providers in section 6.

Email info@sizespec.com or use the contact form, and say which right you want to use. We may ask you to confirm it is you by replying from the address on your account. We respond within 30 days (45 days where US law allows), and tell you if we need more time. An authorized agent may make a request for you with your written permission. Closing your account is one of these requests.

We protect data with encrypted connections, hashed passwords and limited access. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects your data, we will notify you as the law requires.

The Service is not meant for anyone under 16. We do not knowingly collect personal information from children under 13 (the age set by the US Children's Online Privacy Protection Act) or under 16. If you believe a child has given us information, contact us and we will delete it.

We will update this page if our practices change. The date at the top shows the latest version. For a material change we will give notice before it applies to you.

Privacy questions and requests: info@sizespec.com. See also our Terms of Use.