PhotoCleanr

Data processing agreement

For businesses that clean images of their customers, employees or other people with PhotoCleanr. It forms part of the terms of use and applies automatically.

In effect from November 3, 2026.

1. Parties and when this agreement applies

  • The business customer (“controller”) and Insightful3, Mitja Kravos s.p., Kašeljska cesta 150A, 1260 Ljubljana - Polje, Slovenia, registration number 8335885000, VAT ID SI58712631 (“processor”, “we”). This agreement forms part of the terms of use and applies automatically whenever the controller uses PhotoCleanr for personal data it controls. The binding version is the one on this page; the date it applies from is shown at the top once it is in effect. It is part of the terms version the controller accepted, which we record with its account, and we keep every earlier version. You can download or print it here.
  • The controller is the organisation entered under Settings, Business use, of the account it uses PhotoCleanr with, together with the contact email given there. It enters them before using PhotoCleanr for personal data it controls and keeps them up to date; we keep them as our record of processing (Article 30(2) GDPR). When the organisation is changed or removed there, the account’s AI tool connections end and cleaned images still waiting are deleted, so no processing for it continues under another setting.
  • If the controller itself processes the images as a processor for its own client, it may use PhotoCleanr only with that client’s authorisation to engage a further processor (Article 28(2) GDPR), and it confirms that it has it. This agreement then applies to that further processing, and the controller passes on to its client what Article 28 requires. Before doing so, it lists each such client, with the client’s name and contact email, under Settings, Business use: that client is then the controller we process for, and we keep it in our record.
  • PhotoCleanr is available under this agreement only to controllers established in the European Economic Area, or covered by a European Commission adequacy decision for this processing. Where a decision covers only certain organisations or processing, the controller must fall within it: in the United States, for example, only organisations certified under the EU–US Data Privacy Framework, and in Canada only commercial organisations subject to its federal private-sector privacy law. This applies equally to a controller acting as a processor for its own client. By using PhotoCleanr under this agreement, the controller declares that it meets this; if in doubt, it asks us first. A controller that doesn’t may not use it for personal data it controls until we offer standard contractual clauses for that case.

2. Subject, nature and purpose

We find and remove metadata in image files the controller submits through the website or an AI tool it connects, and return a cleaned copy and a report of what was found. Processing is automated. Author, copyright and licence information is kept in the files, as the terms describe.

3. Data and data subjects

Image files and their metadata (for example location, device, names, dates) and file names. Data subjects are the people shown in the images or named in their metadata. Images may contain special categories of personal data or data about children; the controller decides whether to submit them.

4. Duration, deletion and return

  • This agreement lasts as long as the controller uses PhotoCleanr.
  • Each image is deleted when its cleaned copy is downloaded in the browser, and in any case within an hour. This automatic deletion is part of the controller’s instructions; downloading the cleaned copy before then is how the data is returned. Reports are not stored, and images submitted for cleaning are never included in our backups.
  • If the controller sends us an image or report with a support request, we use it only for that request and remove it from the active mailbox within 30 days after the request is resolved, and permanently remove it from our mailbox, including Trash, within 60 days.
  • When the agreement ends, we delete the controller’s personal data we still hold, such as an image still waiting or support material, unless the controller asks first to have it returned while it is still available, or the law requires us to keep it; support material is then removed from our mailbox, including Trash, within 30 days. We keep no other copies.

5. The controller’s obligations

The controller is responsible for having a lawful basis for the processing, including a condition under Article 9 GDPR where images contain special categories of data, for informing the people concerned, for giving only lawful instructions, and for deciding which images to submit and which AI tools to connect.

6. Our obligations

  1. We process the data only on the controller’s documented instructions: this agreement, the terms and the controller’s use of PhotoCleanr’s features and settings, unless EU or Member State law requires otherwise, in which case we inform the controller first where the law allows.
  2. We tell the controller immediately if we consider that an instruction infringes data protection law.
  3. Everyone authorised to process the data is bound by confidentiality. Nobody looks at images unless the controller asks us to in a support request or the law requires it.
  4. We take the security measures in Annex 1.
  5. We engage sub-processors only as section 7 sets out.
  6. We assist the controller, taking into account the nature of the processing, in answering data subjects’ requests and in meeting its obligations under Articles 32 to 36 GDPR.
  7. We notify the controller of a personal data breach affecting its data without undue delay after becoming aware of it, with the information then available; we aim to do so within 48 hours, which is no reason to wait when we can notify sooner.
  8. We delete the data as section 4 describes and keep no other copies.
  9. We make available the information needed to demonstrate compliance with this agreement and allow audits, including inspections, by the controller or an auditor it mandates. We agree a date within 30 days of a request, or sooner after a breach. Each party bears its own costs of an audit. If the controller asks for more than one on-site audit in a year, it also pays our reasonable costs of each further one, unless that audit finds a material breach. Audits don’t give access to other customers’ data.

7. Sub-processors

  • The controller authorises: Hetzner Online GmbH (Germany), servers in Germany, where images are cleaned; WebBuilds B.V. (Ploi, the Netherlands), server management with administrative access; Google Cloud EMEA Limited (Google Workspace), our mailbox, only for images and reports the controller sends to support.
  • We inform the controller of an intended change at least 30 days in advance by email. The controller may object on reasonable grounds; if we find no solution, it can end the contract and get its unused credits refunded.
  • We impose the same data protection obligations on each sub-processor by contract and remain responsible to the controller for their performance.

8. Connected AI tools and transfers

  • Images submitted for cleaning are processed in the EU (Germany). For support mail, EU storage at rest is selected for the Gmail data covered by our Google Workspace data-region setting; Google may process data outside that coverage elsewhere under the applicable agreement and safeguards (the European Commission’s standard contractual clauses and the EU–US Data Privacy Framework). An AI tool the controller connects receives the report and a link to the cleaned copy, because the controller instructs us to send them there by connecting and using it. Whether that tool’s provider acts for the controller under its own agreement with the controller, or otherwise, depends on that agreement; the controller is responsible for it.
  • We disclose personal data to a connected tool only on documented instructions. Where that disclosure is a transfer under Chapter V GDPR, its requirements must also be met before it takes place. Connecting a tool does not waive those requirements. The consent a user gives on the connect screen covers only their own data, not data the controller is responsible for. We tell the controller if an instruction would infringe data protection law.

9. Liability and law

Liability between the parties follows the terms of use. Nothing in this agreement or the terms limits the claims of data subjects or the powers of supervisory authorities. Slovenian law applies. We change this agreement as the terms describe for changes to the terms.

Annex 1: security measures

  • A server of our own in Germany, with a firewall open only for SSH, HTTP and HTTPS; HTTPS throughout.
  • Images in private storage under random identifiers, downloadable only by the account that uploaded them or through signed links that expire within 55 minutes and are cancelled when the controller disconnects its AI tools; downloads are not cached.
  • Hashed passwords, passkeys and two-factor sign-in; OAuth 2.1 for AI tools.
  • Protection against requests to internal addresses when fetching images from a link.
  • Logs without image content, kept 14 days.
  • Deletion every minute, with an alert if it stops; database backups kept 14 days, images submitted for cleaning never.