DEEP-IMAGE.AI — PRIVACY POLICY

Last updated: 23 October 2026

This Privacy Policy describes how personal information is handled when you use the Deep-Image.ai website, online image tools, API or Deep-Image mobile applications (together, the Service).

1. Who is responsible for your personal data?

The data controller for the operation of the Service, accounts, purchases, customer support, security and other processing described in this Policy is DEEP-IMAGE.AI sp. z o.o., ul. Cyfrowa 6/B317, 71-441 Szczecin, Poland; KRS 0000862988; NIP 8513252805 (Deep-Image, we). Contact us at support@deep-image.ai or by post at the address above. No data protection officer has been appointed.

2. What data do we process?

Depending on the functions used, we process:

• Images and processing details: uploaded photos and other files, prompts and instructions, generated or edited outputs, parameters and technical metadata.
• Account and connected-device data: email address, password credentials stored in protected form, sign-in identifiers from Google, Apple or Facebook when used, preferences, subscription and credit information, and information needed to associate a signed-in website account with mobile-app usage and credit balances. We record relevant credit allocations, including weekly and monthly subscription allowances, consumption and replenishments to administer plan entitlements.
• Purchases and billing: payment status, transaction identifiers, purchased packages or plans, billing details and invoices. Payment providers handle full payment-card numbers; we do not receive them.
• Support, reports and permissions: information provided in messages, requests and complaints, including explanations or evidence of rights or permissions where reasonably needed to assess a reported infringement.
• Technical data: IP address, device and browser characteristics, service and security logs, API and feature usage activity, operational limits, cookies and other identifiers where applicable.

Not every category applies to every user. Mobile apps may be used without creating a Deep-Image website account, but you may also sign in to an existing website account, in which case the relevant account, credit and subscription information is used to make its eligible entitlements available in the app. Signing in does not create a separate credit balance. For weekly mobile subscriptions, each paid weekly period adds 25 credits to the subscription balance; this is different from plans that replenish balances up to a stated allowance.

3. Purposes and legal bases

• Providing the Service: registration, operating accounts, processing images and prompts, making results available, monitoring credit use to allocate and replenish allowances, managing subscriptions, and recognising the same signed-in account across the website and mobile apps. Legal basis: performance of the contract or measures requested before entering it (Article 6(1)(b) GDPR).
• Payments and legal compliance: purchase administration, invoices, accounting, taxes and legally required records. Legal bases: Article 6(1)(b) and (c) GDPR.
• Support and essential messages: responding to requests and complaints, sending account, transaction and security communications. Legal bases, depending on the communication: Article 6(1)(b), (c) or (f) GDPR, including our legitimate interest in supporting users and operating the Service.
• Security, abuse prevention and legal claims: technical and API logs, detection of excessive or abusive usage, fraud prevention, investigating reports, verifying permissions where necessary, enforcement of usage rules, incident response and protection of legal rights. Legal bases: our legitimate interests (Article 6(1)(f) GDPR) or legal obligations (Article 6(1)(c) GDPR).
• Product news and offers: using account contact details to communicate Deep-Image features, services and promotions. GDPR legal basis: our legitimate interests in promoting our own services (Article 6(1)(f) GDPR). You can stop marketing emails at any time using the unsubscribe link or the marketing preference in your profile. Essential transactional and security messages may still be sent. Where authorised, we may identify an incorporated business customer by its company name as described in our Terms.
• Analytics and advertising measurement: understanding use of the website or app, measuring campaigns and displaying ads. The legal basis for non-essential website analytics and advertising technologies is consent (Article 6(1)(a) GDPR). Other necessary app and security processing may rely on the bases specified above.

Where image processing takes place. Deep-Image uses AI models hosted on its own infrastructure, external AI processing services, or a combination of both, depending on the selected tool, model and technical requirements. Many operations run on our locally hosted models without sending image content to external AI model or inference providers. For other operations, only the images, prompts and associated processing data needed for the requested operation are transmitted to the relevant external AI provider. Use of our own model infrastructure is distinct from the use of infrastructure services such as cloud storage.

We do not sell customer images, use uploaded images or outputs to train AI models, or include customer images in our promotional materials without separate permission.

4. Images showing other people

Images submitted to the Service may include personal data about other people. You must ensure you have the necessary rights and permissions to upload the material and request its processing. We process images primarily to carry out the user's selected operation. Where Deep-Image is the controller of personal data relating to people depicted, we rely on our legitimate interests in providing the requested image-processing functionality, protecting the Service and preventing misuse (Article 6(1)(f) GDPR), or on a legal obligation where applicable (Article 6(1)(c) GDPR). We take into account the rights and interests of affected individuals.

We do not use uploaded images to identify individuals or build a face-recognition identity database. Access to particular images by authorised staff is limited to justified support, troubleshooting, investigation of misuse or legal needs. Anyone concerned about an image depicting them may contact support@deep-image.ai.

5. How long do we keep data?

• Images and results: files are automatically deleted after 24 hours for guest use and within 40 days for registered website accounts, API processing and mobile applications. You may delete individual images earlier where the relevant function provides this option.
• Account details: generally for the duration of the account; following closure, only information needed for legal duties, security or the establishment, exercise or defence of claims is retained for an applicable period.
• Payments and invoices: for periods required by applicable accounting and tax law.
• Support records, rights-verification information and technical logs: for as long as reasonably necessary to address the relevant matter, administer purchased allowances, protect the Service, pursue or defend claims, or comply with legal obligations.
• Cookies and identifiers: for periods depending on their specific purpose, browser settings and the service provider's configuration.

Where an operation uses an external AI provider, that provider may temporarily retain material transferred to it for security or abuse prevention under its own processing terms; its retention period may differ from ours. This does not apply to image content processed solely by our locally hosted AI models.

6. Recipients and international transfers

We use our own servers and infrastructure providers, including Amazon Web Services (AWS), to operate and store data for the Service. Our own servers and AWS resources used to store customer files are located within the EU/EEA.

Where necessary for the particular service, personal data may also be disclosed to the following categories of recipients:

• External AI model and inference-processing providers: only where the selected operation or processing stage requires external AI services. Operations carried out solely on our locally hosted AI models do not involve sending image content to this category of providers;
• Payment and subscription services: Stripe (including Stripe Managed Payments), Apple, Google and RevenueCat, where relevant;
• Sign-in, analytics and advertising services: Google, Meta and Microsoft, according to the features used;
• Professional advisers, competent authorities where required by law, and a lawful successor in a business reorganisation or sale.

External AI providers and other service providers may process personal data outside the EEA, including in the United Kingdom and the United States. Where an international transfer takes place, it is subject to the applicable GDPR transfer rules and safeguards, such as a European Commission adequacy decision (including the EU-US Data Privacy Framework for covered certified recipients) or standard contractual clauses where appropriate. You may request further information about specific recipients of your personal data and applicable transfer safeguards at support@deep-image.ai.

7. Cookies and website analytics

We use cookies and similar technologies, including the following categories:

• Necessary cookies: essential for authentication, secure sessions, fraud prevention and the technical operation of features you request. These cannot be disabled within the Service where needed for its operation.
• Functional cookies: used to remember settings and preferences, improve convenience and maintain selected website functionality. Where a functional cookie is not strictly necessary for a feature you request, it is treated as optional and subject to the applicable consent requirements.
• Analytics and advertising cookies: used to measure site usage, understand interactions and assess the performance of advertising. After acceptance through the website's cookie notice, these tools may include Google Analytics, Google Tag Manager, Google Ads, Meta Pixel and Microsoft Clarity.

These tools may process IP addresses, cookie or device identifiers and interactions with the site. Relevant providers may also process data under their own privacy policies. You can manage, block or delete cookies using browser settings; blocking necessary cookies may prevent some Service functions from working. For questions about cookies or to exercise your data protection rights, contact support@deep-image.ai.

8. Mobile applications

Our iOS and Android applications may operate without a Deep-Image account, or you may sign in using the same account you use on our website. When you sign in, we use account identifiers, entitlement status and credit-balance and usage information to recognise your eligible website credits or subscription in the app and keep the account's usage consistent across supported devices. We may record the addition of 25 new subscription credits for each paid weekly mobile period, standard monthly allocations for annual mobile subscriptions, and any discretionary bonus credits or early replenishments to administer benefits and prevent misuse. App-store purchases may be associated with store transaction or subscription identifiers independently of website sign-in.

Our mobile applications use RevenueCat for purchases and subscription management and Google services including Google Analytics, Google AdMob and Google Ads for analytics, advertising and measurement. Ads shown in our applications are non-personalised. Nevertheless, technical and device identifiers may be processed to deliver ads, measure effectiveness, limit repetition and prevent fraud.

The applications display relevant notices or choices where applicable. Purchases made in Apple App Store or Google Play are also subject to the stores' payment and privacy rules. The standard credit allocations for weekly and annual mobile subscriptions, and their respective billing periods, are described in our Terms.

9. Your rights

Subject to the conditions set by law, you may request access to your personal data, its correction or deletion, restriction of processing and portability. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent at any time without affecting the lawfulness of processing beforehand.

YOUR RIGHT TO OBJECT TO DIRECT MARKETING: You may object at any time and free of charge to the use of your personal data for direct marketing, including any related profiling. After such an objection, we will stop processing your personal data for that purpose. Use the unsubscribe link, update your profile preference or contact support@deep-image.ai.

You can exercise your rights at support@deep-image.ai; we may need to verify your identity. You can lodge a complaint with a supervisory authority, including the President of the Personal Data Protection Office (UODO) in Poland (https://uodo.gov.pl).

Providing data is generally voluntary, but certain information is needed to create an account, process a requested operation or complete a purchase. We do not make solely automated decisions producing legal or similarly significant effects on you within the meaning of Article 22 GDPR.

10. Security, younger users and updates

We apply technical and organisational safeguards suited to the risks, including limited staff access to customer files. No online service can guarantee absolute security.

Use of the Service by a person lacking independent legal capacity requires any involvement or permission of a parent or legal guardian prescribed by law. The Service must not be used to process images of minors unlawfully or in violation of the restrictions in our Terms.

We may update this Policy when the Service, suppliers or applicable law change. The current Policy is made available on our website, and we provide additional notice where legally required.