PhotoCleanr

Privacy policy

What personal data PhotoCleanr processes, why, and for how long. The short version: images are cleaned automatically and deleted within the hour, and we use no analytics or advertising.

In effect from November 3, 2026.

Who is responsible

  • Insightful3, Mitja Kravos s.p., Kašeljska cesta 150A, 1260 Ljubljana - Polje, Slovenia, registration number 8335885000, VAT ID SI58712631 is the controller for your account, purchases, security and support, and for the images you clean for yourself.
  • When a business uses PhotoCleanr for images of its customers or employees, we process those images on the business’s behalf, as its processor under our data processing agreement. The business is the controller for them and answers questions about them; we help it do so.
  • Privacy questions: privacy@insightful3.com, phone +386 41 451 922. No data protection officer has been appointed.

What we process and why

  • Your account: your email address and password (stored only as a hash), which you need to give us to have an account; a name, if you choose to give one; passkeys and two-factor settings if you choose to set them up; which version of the terms you accepted, and when; and the language you use PhotoCleanr in, so our emails are in it too. A name you give is shown in your account and sent to Paddle when you buy; it doesn’t need to be your full name. We need this data to provide your account (contract). If you use PhotoCleanr for an organisation, also the organisation’s name and the contact email you enter under Settings, Business use, and the clients you list there if the organisation cleans images for them: we need them to record whom we process for under the data processing agreement (legal obligation, Article 30(2) GDPR).
  • Images: the images you upload, that an AI tool you connected sends us, or that our server fetches from an address such a tool gives, with their file names. They are processed automatically, only to find metadata, report it to you and remove it, as you ask. Images and their metadata can contain personal data about you and about other people, such as faces, where a photo was taken or a name, and sometimes more sensitive information. For your own data the basis is our contract; for sensitive information about you, such as about your health, it is your explicit consent, which you give only if you want to clean such images, with the switch on the cleaning page or a box when connecting an AI tool, and can withdraw on the cleaning page, which deletes cleaned images still waiting there (Article 9(2)(a) GDPR). Without it, clean only images with no sensitive information about anyone. As a private user you may not clean images that reveal such information about other people (terms of use). For other people in images you clean for yourself, it is the legitimate interest, yours and ours, in the cleaning you asked for, which is meant to take information about them out of an image before it is shared. The file is kept for less than an hour, read only by software, not looked at unless you ask us to in a support request, and used for nothing else. The author and rights information PhotoCleanr recognises stays in the image (see the terms of use). The report you see can contain values from the file, such as the camera model, the software used or a comment, and says whether the file holds a location; an AI tool you connect receives the same report without the text of comments. We don’t use images to identify anyone. The upload is deleted once it has been cleaned; the cleaned copy as soon as you download it in the browser, and in any case within an hour. A download link given to a connected AI tool works until then, unless you disconnect the tool. Deletion runs every minute, and we are alerted if it stops.
  • The report: what we found in an image is shown to you, or returned to your AI tool, and not stored by us.
  • Your credits: a record of the credits added to and used from your account: the number, the reason, the date, and for a used credit the random identifier of the cleaned image, nothing about the image itself. It shows how many images you cleaned and when. For a purchase it also holds the version of the terms, your request to start right away with your acknowledgment that withdrawal ends once the pack is used up, and any withdrawal, with the name you gave in its notice. We need it to provide the service and to handle withdrawals and refunds (contract).
  • Payments: Paddle sells the credits, as a separate controller under its own privacy policy; the Paddle company that sells to you is named at checkout. When you choose Buy, we send Paddle your email address, and your name if you gave one, so its checkout knows you. From Paddle we receive your Paddle customer number, name, email address, the transaction number, amount, tax, currency, date, invoice number and any refund. When you withdraw, we ask Paddle to refund you. We never see your card details (contract).
  • Visits and security: every visit, also without an account, creates a session record with your IP address, browser type and the time of your last activity, so the site works and stays secure (legitimate interest; for your account also contract). A session ends when you sign out or two hours after your last activity, and its record is deleted within the following ten minutes. To stop password guessing, failed sign-ins are counted by email and IP address for a few minutes, and a password reset request is kept for 60 minutes (legitimate interest in keeping accounts secure).
  • Connected AI tools: if you connect one, we store its registration (name and return address) and its access tokens, valid for 8 hours, and refresh tokens, valid for 90 days, with the time each was issued. Disconnecting stops the tool at once and cancels the upload and download links it was given. Expired and revoked tokens are deleted a week later (contract). For a tool whose provider may be outside the EEA, we keep your consent to the transfer (see below): the words you saw, the company, when you gave it and when you withdrew it by disconnecting.
  • Emails: we send the emails your account and purchases need: confirming your address with the terms attached, password resets, purchase and withdrawal confirmations, and notice of important changes (contract). They are sent through NEOSERV (see below). When you write to us, your message is kept in our mailbox for as long as we need to answer it, and support correspondence at most two years after the last message (legitimate interest in handling your request). If you ask us to look at an image with health or other sensitive information about you, that request is your explicit consent to our looking at it, only for that request; if it isn’t clear whether you want us to, we ask you first. Please don’t send images with such information about other people: if you do, they reach our mailbox, but we don’t open them, we delete them as soon as we notice, including from Trash, within 7 days at the latest, and ask you for the report or a description instead. If you send us an image or a report, we use it only for that request, remove it from the active mailbox within 30 days after the request is resolved, and permanently remove it from our mailbox, including Trash, within 60 days; the one-hour deletion applies to images submitted for cleaning, not to what you email us.
  • Logs: errors are logged with technical details, the address requested, and sometimes your IP address or account number, never your images, and kept for 14 days. The web server keeps no record of ordinary visits; its error log, with the same kind of details, is also kept 14 days (legitimate interest in security and fixing errors).
  • Files we can’t clean: when you try a file type PhotoCleanr doesn’t support yet, or a file over the size limit, we add one to a monthly count for that type, for example “MP4, too large, November: 12”. The count holds only the type, the reason and the month, nothing that links it to you, the file’s name or its content, and tells us which formats to add. The upload itself is handled like any other.

What we don’t do

  • We use no analytics, advertising or tracking tools, and we don’t sell data.
  • The site’s files and fonts come from our server. Paddle’s checkout is loaded from Paddle only when you choose Buy.
  • We make no automated decisions about you that have legal or similarly significant effects.

Cookies and storage in your browser

  • A session cookie and a security cookie against forged requests, which the site needs to work. Both expire two hours after your last visit.
  • If you tick “Remember me”, a cookie that keeps you signed in on that device for 30 days.
  • Your choice of light or dark appearance, and whether the side menu is collapsed, stored in your browser.
  • When you choose Buy, your browser loads Paddle’s checkout from Paddle’s servers, with a script from ProfitWell, a Paddle company. They add nothing to our site’s storage. Inside its checkout window, as Paddle’s cookie policy describes, Paddle stores what it needs for the payment and to prevent fraud, including Stripe’s cookies, and the settings of its translation service, Localize. The window contacts Paddle’s checkout and analytics servers, Stripe, Localize, Google Fonts and Sentry, which monitors the checkout for Paddle and receives performance and error reports each time it opens. Each of them sees your IP address; Sentry and Localize are in the US. This is Paddle’s processing as seller. We don’t load any of it before you choose Buy.

Who receives data

  • Hetzner Online GmbH (Germany): our servers, in Germany, where images are cleaned and data is stored. Our processor.
  • WebBuilds B.V. (Ploi, the Netherlands): manages our servers and deployments, with administrative access to them. Our processor.
  • Avant.Si d.o.o., trading as NEOSERV (Slovenia): sends our emails from its servers in Slovenia. Its delivery logs are kept about 14 to 30 days. Our processor.
  • Google Cloud EMEA Limited (Google Workspace): our mailbox, which receives the emails you send us. EU storage at rest is selected for Gmail data covered by our data-region setting. Google may process data outside that coverage elsewhere under the applicable agreement and safeguards (the European Commission’s standard contractual clauses and the EU–US Data Privacy Framework). Our processor.
  • Have I Been Pwned (Pwned Passwords): when you choose a password, our server checks it against passwords known from data leaks by sending the first five characters of a scrambled form of it. Neither the password nor your email address is sent.
  • Paddle: the Paddle company named at checkout sells the credits as a separate controller: Paddle.com Market Limited (United Kingdom) for most countries, Paddle.com Inc. in the United States and Paddle.com (Canada) Ltd. in Canada. The European Commission considers the UK to protect personal data adequately.
  • An AI tool you connect, such as Claude or ChatGPT: at your request we return the report and a link to the clean copy to that tool. Its provider decides what happens with them under its own privacy policy, which says which company processes your data and where, possibly outside the EU. Under their consumer privacy policies, Claude accounts in the EEA, Switzerland and the UK are served by Anthropic Ireland, Limited and others by Anthropic, PBC in the United States; ChatGPT accounts in the EEA and Switzerland by OpenAI Ireland Limited and others, including in the UK, by OpenAI OpCo, LLC in the United States. With a work account, the provider your organisation contracted with receives them under that agreement, for your organisation; on connecting you confirm that this is the provider’s Irish company, and otherwise you don’t connect the account. Neither US company is certified under the EU–US Data Privacy Framework, and there are no safeguards between us and them. For a personal account, we send them the reports and the cleaned images only because you explicitly agreed, in a box of its own on the connect screen that named the company and the risks: your data may be less protected there and your rights harder to enforce (Article 49(1)(a) GDPR). That consent covers only your own data, so through such an account clean only files whose image, kept author and rights information and report contain no personal data about anyone else. You can withdraw it at any time by disconnecting the tool. A tool that runs on your own computer, such as Claude Code or Cursor, receives them there, and the AI service it uses then receives them under that service’s terms.

Images submitted for cleaning are processed only in the EU, on our server in Germany. Emails you send us are stored at rest in the EU by Google Workspace, which may process data elsewhere, and an AI tool you connect receives its reports where its provider processes them, as described above. For a copy of the safeguards, write to us.

How long we keep data

  • Images submitted for cleaning: until downloaded, and in any case less than an hour. Reports are not kept. Images and reports you email us: see Emails above.
  • Your account, credit records and the payment details we receive from Paddle: until you delete your account under Settings, which deletes them, together with your AI tool connections and any images still waiting. The organisation under Business use, with its contact and clients, goes as soon as you remove it; changing or removing it also disconnects your AI tools and deletes cleaned images still waiting, so nothing runs on for the old setting. Paddle keeps its own records of your purchases as the seller.
  • Purchase records after you delete your account: to prove and settle purchases with Paddle, and to complete withdrawals and refunds, we keep a minimal record of each purchase: the Paddle transaction number, the credits and the amount, the dates of purchase, withdrawal and refund, the version of the terms, your request to start right away and your acknowledgment, linked only to a number, without your name or email address. It is still personal data, because the Paddle transaction can be traced back to you. We keep it 5 years after your account is deleted, or after the last withdrawal or refund of that purchase is completed if that is later, and longer only while a dispute about it is open (legitimate interest in proving and settling claims). A withdrawal or refund still in progress stays until it is completed.
  • Withdrawal notices we check by hand: a notice sent after the usual 14 days, or through the withdrawal page by someone who can’t sign in, is kept with the name, email address, transaction number and time you gave, also after you delete your account. The notice is your declaration itself: the proof of who withdrew and when, which the minimal purchase record above doesn’t hold. We need it to answer you and to prove and settle a claim about the withdrawal (legitimate interest). We send the confirmation to that address. The notice stays until we have dealt with it, then 5 years as evidence in withdrawal-related claims, based on the general limitation period, and longer only while a dispute about that purchase is open. A notice we can’t link to any purchase of ours is deleted six months after we dealt with it.
  • Backups: our database is backed up every night and each backup is kept 14 days; images submitted for cleaning are never backed up. If we ever have to restore a backup, we first delete again the accounts deleted after it was made. For that we keep a note of each deleted account, its account number and a scrambled form of its email address, for those 14 days only.
  • Session records: deleted within ten minutes after the session ends.
  • AI tool connections: until the tokens expire or you disconnect the tool, then a week; the consents you gave on the connect screen or the cleaning page, with when you withdrew them, as long as your account exists.
  • Logs: 14 days.

If you appear in an image someone else cleans

People who use PhotoCleanr upload their own images, which may show you or name you in their metadata, for example a location, a camera owner’s name or a comment. We receive such an image only from the person who uploads it, or from an AI tool they connect, and process it only to remove metadata and report what it contained to that person; we don’t identify you or contact you, and we keep no record of you. The image is deleted within an hour, and the report isn’t stored. Because we don’t know who appears in an image, we inform you through this policy rather than individually. The basis, your rights and how to contact us are described on this page; if a business cleaned the image, it is responsible for it and we assist it.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict its processing or to receive it in a portable form, and you can object to processing based on legitimate interest. Write to privacy@insightful3.com; you can also delete your account yourself under Settings. If you believe we handle your data wrongly, you can complain to the Information Commissioner of the Republic of Slovenia (www.ip-rs.si) or the data protection authority where you live.

Changes

When we change this policy, we update it here. We tell you about important changes by email before they apply.