Privacy Policy

This Privacy Policy explains how restorephotosapp.com (“we”, “us”, “our”) collects, uses, and protects your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Polish data protection laws.

1. Data Controller

The data controller responsible for your personal data is the operator of restorephotosapp.com. For data protection inquiries, please contact us through our contact page.

2. Data We Collect

We collect the following categories of personal data:

Account data: email address, name, and password (hashed) when you create an account, or profile information from Google when you sign in with Google OAuth
Uploaded photos: photographs you upload for restoration processing
Usage data: information about how you use the Service, including restoration history, credit usage, and feature interactions
Technical data: IP address, browser type, device information, and access timestamps collected automatically
Payment data: transaction records processed through our payment provider (we do not store your payment card details directly)
Cookies: session cookies for authentication and essential functionality
Email preferences: whether you have opted out of service emails, and a log of which service emails we sent you and when

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data based on the following legal grounds:

Consent (Art. 6(1)(a)): when you create an account and agree to our Terms of Service and this Privacy Policy
Contract performance (Art. 6(1)(b)): to provide the photo restoration service you requested, manage your account, and process credits/payments
Legitimate interest (Art. 6(1)(f)): to improve our Service, prevent fraud, ensure security, and send you service emails about your account, your credits and our credit packs. You can object to these emails at any time (see section 4a).
Legal obligation (Art. 6(1)(c)): to comply with applicable tax, accounting, and regulatory requirements

4. Processing Purposes

We use your personal data to:

Provide and maintain the photo restoration service
Process your uploaded photos through our AI restoration models
Manage your account and authenticate your sessions
Process payments and manage credits
Send you service emails about your account, your credit balance and credit-pack offers (see section 4a)
Improve and optimize the Service
Prevent fraud and ensure security
Comply with legal obligations

4a. Service Emails and How to Opt Out

After you create an account we may send a small number of emails: a reminder if you have not restored a photo yet, a time-limited offer on credit packs, and a note when your credit balance reaches zero. We send each of these at most once per trigger and never more than a few per month.

You can stop these emails at any time by clicking Unsubscribe in the footer of any email, or by turning off Email tips and offers in your account Settings. Opting out takes effect immediately and we keep a record of it so you are not emailed again. Purchase receipts are sent by our payment provider as part of the transaction and are not affected by this setting.

5. Data Retention

Account data: retained for the duration of your account. Deleted within 30 days of account deletion.
Uploaded photos and AI-generated restorations: original uploads and restored images are stored on Cloudflare R2 for 30 days from creation, after which they are automatically and permanently deleted. You may also delete any individual restoration from your history at any time.
Usage data: retained for up to 24 months for service improvement purposes.
Payment records: retained as required by applicable tax and accounting laws (typically 5 years).
Technical logs: retained for up to 90 days for security and debugging purposes.
Email log and opt-out record: retained for the duration of your account so that we do not repeat an email or contact you after you opt out. Deleted with your account.

6. Third-Party Processors

We share your data with the following third-party processors, each bound by data processing agreements:

Google (USA) — OAuth authentication when you choose to sign in with Google.
Cloudflare R2 (global) — cloud storage for temporary photo storage during processing.
DataFast — AI model hosting for photo restoration processing. Uploaded photos are sent to DataFast for processing.
Polar — payment processing for credit purchases.
Resend (USA) — delivery of the service emails described in section 4a. Resend receives your email address, your name and the content of the message.

7. International Data Transfers

Some of our processors are located outside the European Economic Area (EEA), primarily in the United States. These transfers are protected by:

EU-US Data Privacy Framework (where applicable)
Standard Contractual Clauses (SCCs) approved by the European Commission
Appropriate supplementary measures as required

8. Your Rights (GDPR Art. 15–22)

Under GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15): request a copy of the personal data we hold about you
Right to rectification (Art. 16): request correction of inaccurate personal data
Right to erasure (Art. 17): request deletion of your personal data (“right to be forgotten”)
Right to restriction (Art. 18): request that we limit how we use your data
Right to data portability (Art. 20): receive your data in a structured, machine-readable format
Right to object (Art. 21): object to processing based on legitimate interests
Right to withdraw consent: withdraw consent at any time, without affecting the lawfulness of prior processing

To exercise these rights, please contact us through our contact page. We will respond within 30 days.

9. Right to Complain

You have the right to lodge a complaint with a supervisory authority. The competent authority in Poland is:

UODO (Urząd Ochrony Danych Osobowych)
ul. Stawki 2, 00-193 Warszawa, Poland
Website: uodo.gov.pl

10. Cookies

We use essential cookies required for the Service to function, including authentication session cookies. These cookies are strictly necessary and do not require separate consent under the ePrivacy Directive.

We do not use third-party tracking cookies or advertising cookies.

11. Children's Privacy

The Service is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us so we can delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the “Last updated” date at the top of this page. We encourage you to review this page periodically.