Privacy Policy

Last updated: May 5th, 2025

Photato ("we", "us", or "our") values your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our services at www.photato.ai.

1. Information We Collect

a. Account Information

When you sign up, we collect your email address, encrypted password, and optionally your display name. This information is used to manage your account and secure access to the platform.

b. Payment and Token Usage

Photato uses a pay-per-use token model. Payments are processed through third-party providers (e.g., Stripe). We do not store your payment details, but we may keep records of your token purchases and transaction history.

c. Uploaded Content

Images you upload are temporarily stored to allow AI-based processing. These are automatically deleted after a short period unless you choose to keep them available in your account history. We do not use your images for training our models unless you've given explicit permission.

d. Usage and Technical Data

We collect non-identifying data like:

• IP address
• Browser and device type
• Pages visited and session duration
• Actions taken (e.g., filters used, transformations applied)

This data helps us optimize performance, detect issues, and improve the service.

2. How We Use Your Information

We use your information to provide, maintain, and improve our services. Your account and login information are used to authenticate access and personalize the interface. Uploaded images and selected filters or transformation settings are used strictly to deliver the service you requested. Payment and token data is used to process purchases and track usage across sessions.

In addition to core functionality, we use analytics and usage data to understand how users interact with Photato, diagnose technical issues, and make product improvements. If you've opted in, we may occasionally send service updates or promotional emails — and you can opt out at any time via your email settings.

We do not use your content or personal information for advertising purposes or sell your data to third parties.

3. Legal Basis for Processing

We process your personal data based on several legal grounds:

• Contractual necessity: Most of our processing is necessary to fulfill our contract with you — for example, to provide access to the platform, transform your uploaded images, and handle token payments.
• Legitimate interests: We rely on this basis for internal analytics, platform optimization, fraud prevention, and system security — provided these interests don't override your rights.
• Consent: We seek your consent for activities like sending newsletters or retaining your images for download history. You may withdraw consent at any time.
• Legal obligation: We may retain payment records or respond to lawful data requests as required by applicable tax, anti-fraud, or consumer protection laws.

4. Sharing of Data with Third Parties

Photato shares your personal information only with third parties that are essential for operating the platform — and always under strict data protection agreements. For example, payment data is shared with our payment gateway (e.g., Stripe) solely to process transactions securely. Your images are temporarily stored and processed on cloud infrastructure provided by reputable hosting providers.

We also use third-party analytics services (such as Google Analytics) to understand platform performance, as well as customer support tools to help respond to your inquiries. These providers only access your data to perform services on our behalf and are not permitted to use it for their own purposes.

We do not sell, rent, or share your data with advertisers or unrelated third parties.

5. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes outlined in this policy.

Your uploaded images are stored temporarily for processing and may be retained longer only if you choose to save them. Your account and purchase history are retained for as long as your account remains active and for any legally required period afterward (e.g., for financial record-keeping).

If you delete your account, your personal data and stored files are removed from our active systems within a reasonable time unless legal obligations require longer retention.

6. Cookies and Tracking Technologies

Photato uses cookies and similar technologies to keep you logged in, remember preferences, and improve the user experience. These cookies help us recognize your browser between sessions and understand how the platform is used.

You can control or disable cookies through your browser settings. However, doing so may impact core functionality, such as login persistence and token tracking. We do not use cookies for third-party advertising.

A full Cookie Policy is available here.

7. How We Protect Your Data

We use industry-standard security measures to protect your information from unauthorized access, disclosure, or loss. This includes HTTPS encryption across our platform, encrypted password storage, secure cloud storage for uploads, and firewalls to protect sensitive infrastructure.

Access to your data is restricted to employees or service providers who need it to deliver services and who are bound by confidentiality obligations. While no system is entirely immune to risks, we regularly audit our practices to maintain a high standard of protection.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Withdraw consent to processing where applicable
• Object to or restrict certain processing activities
• Receive a copy of your data in portable format

To make any of these requests, email us at photato@prototyp.digital. We will respond within a reasonable timeframe.

9. Children's Privacy

Photato is not intended for use by children under the age of 13. We do not knowingly collect or store information from children. If we become aware that a child has provided us with personal data, we will delete it immediately. If you believe we may have collected such data, please contact us.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. If changes are significant, we will notify users via email or in-app message. The latest version will always be available at https://photato.ai/privacy-policy.

Your continued use of the platform after changes take effect constitutes acceptance of the updated terms.

11. Contact Us

If you have questions, concerns, or requests related to this policy or your data, please contact us at:

📧 photato@prototyp.digital

📍 Bartola Kašića 7, 31000 Osijek, Croatia