Privacy

Last updated 10 October 2026

Short version: your photos are yours. We use them only to grow them for you, nobody else can see them, photos you don't keep are deleted after 30 days, pictures you keep after 90 days, and you can delete everything at any time.

Who is responsible

AAOOH OÜ, [LEGAL_ADDRESS]. Email: [SUPPORT_EMAIL]. Full details are in the imprint.

What we collect and why

• Your email address, to sign you in with a code and to keep your pictures in your account. The code is valid for 10 minutes and stored only as a scrambled value. Legal basis: our contract with you (Art. 6(1)(b) GDPR).
• The photos you upload and the pictures grown from them. Before anything is stored we re-encode each photo, which removes location data and other hidden details. We use your photos only to grow them for you and show them to you. We do not sell them, show them to anyone else, or use them to train anything. Legal basis: contract.
• Purchases: which pack you bought, when, and for how much. Payment itself is handled by Stripe; we never see your card details. Legal basis: contract, and the tax law that makes us keep invoices.
• Network address: to stop abuse (for example someone creating many accounts to collect free previews) we keep a scrambled, one-way version of your IP address for a few days. Legal basis: our legitimate interest in keeping the service working and fair (Art. 6(1)(f) GDPR).
• Support messages you send us, so we can answer them. Legal basis: contract, or our legitimate interest in answering you.

Cookies

• Sign-in cookie (necessary): keeps you signed in for up to 90 days.
• hd_consent (necessary): remembers your cookie choice for a year.

You can change your choice any time with “Cookie settings” at the bottom of every page. Legal basis for statistics and marketing: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Who helps us

These services process data for us under data processing agreements:

• Hosting, database and file storage: Vercel (Frankfurt) for the site; Neon (Frankfurt) for the database; Cloudflare R2 (EU) for pictures
• Growing the pictures: RunPod (GPU servers). Your photo is sent there for the minute or two it takes, and is not kept there.
• Sending sign-in codes and support emails: Resend, with Postmark as a backup if Resend is unavailable.
• Payments: Stripe, which is also responsible on its own for the payment data it needs by law.

Where a service is based outside the EU, transfers rely on the EU-US Data Privacy Framework or the EU standard contractual clauses.

How long we keep things

• Photos and previews you don't keep: deleted after 30 days.
• Pictures you keep: 90 days after you keep them, or sooner if you delete them or your account.
• Sign-in codes: 10 minutes. Scrambled network addresses: a few days.
• Purchase records: as long as tax law requires (in many EU countries up to 10 years), without your photos.
• Support messages: up to two years after the conversation ends.

Your rights

You can ask us what we store about you, get a copy, have it corrected or deleted, limit or object to its use, and withdraw any consent. You can delete any picture, or your whole account, yourself in the studio (“Delete account” under your pictures). For anything else, write to us on the support page. You can also complain to a data protection authority, for us that is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Security

Everything travels encrypted (HTTPS). Your pictures can only be opened from your own signed-in account, the full-size picture is only released once you keep it, and the servers that grow pictures only accept work from our own website, with a secret key that never leaves our servers.