Privacy Policy
This policy explains what personal data Thriftshot processes when you use it, why, who helps us, and what rights you have. In short: we use your photos only to make your images, we don't sell data or show ads, our visit statistics work without cookies, and we don't use your photos to train AI models.
1. Who is responsible
The controller is Artsiom Halachkin. For anything about your data, write to art.nmk129@gmail.com.
2. What we process and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Your account: email address; with Google sign-in, also the name and email Google shares | To sign you in and keep your credits and images | Contract, Art. 6(1)(b) |
| Photos you upload | To make your images: they are sent to our AI processing partners (section 3) | Contract, Art. 6(1)(b) |
| Finished images and a small preview of the original photo (signed-in users) | So you can see and download them again in History | Contract, Art. 6(1)(b) |
| Credit history and a record of each image (time, finish chosen, result status) | To count credits, refund failed images and handle support questions | Contract, Art. 6(1)(b) |
| Without an account: a random visitor ID in a cookie and a scrambled (salted, hashed) form of your IP address; we never store the IP itself | To limit the free photo to one per visitor and stop abuse | Legitimate interest in preventing abuse, Art. 6(1)(f) |
| Messages you send through the Contact page, and the email you give for a reply | To read and answer your message | Legitimate interest in answering you, Art. 6(1)(f) |
| Visit statistics: pages viewed, the site you came from, country, device type and browser, counted without cookies and without identifying you | To see which pages are used and where visitors come from | Legitimate interest in improving the service, Art. 6(1)(f) |
| Technical logs (for example errors, request times) | To keep the service secure and working | Legitimate interest, Art. 6(1)(f) |
When payments are added, we will also process billing details and keep invoices as tax law requires. This policy will be updated before that.
3. Who helps us (processors)
We work with these categories of service providers, who process data only on our behalf and under contract:
- Google (authentication): only if you choose to sign in with Google.
- AI infrastructure providers used to generate images: they run the AI models that remove the background, recognise the garment, redraw it and check each edit against your photo.
- Cloud storage providers: your account, credits and stored images. This data is kept in the EU (Frankfurt, Germany).
- Hosting providers: run the website and our server.
- Email delivery providers: deliver messages from the Contact page to our inbox.
Some of these providers, including the AI infrastructure providers, are based in the United States. Those transfers are covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's Standard Contractual Clauses. Each provider keeps the data it processes according to its own terms; we choose settings that keep this to what is needed to make your image. If you would like the names of the specific providers, write to art.nmk129@gmail.com.
4. How long we keep it
- Finished images and their previews: 30 days, then deleted automatically. You can delete any image sooner in History.
- Account and credit history: while you have an account. You can delete your account at any time on the Account page; your account, credit history and stored images are then deleted straight away. Records of the images you made are kept only without any link to you.
- Contact messages: 12 months, then deleted automatically.
- Visitor cookie: up to 1 year. The visitor ID and scrambled IP on records of free photos are erased after 13 months.
- Apart from the small preview above, the photos you upload are not stored by us after your image is made.
5. Cookies and browser storage
We use only the cookies and browser storage the service needs to work, such as keeping you signed in and limiting the free photo, so we don't ask for cookie consent.
We use no advertising or tracking cookies. Our visit statistics (from our hosting provider) work without cookies and don't follow you across sites. The full list is in our Cookie Policy.
6. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict its use, to receive it in a portable format, and you can object to processing based on legitimate interest. Write to art.nmk129@gmail.com; we answer within one month. You can also complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz) or the authority in your country.
7. Children
Thriftshot is meant for adults. Don't use it if you are under 18.
8. Changes
If we change this policy, we update the date at the top, and tell signed-in users about important changes. See also our Terms of Service and Cookie Policy.