Privacy Policy
The short version
- You upload a photo of a face. That makes it biometric data — a special category under EU law — so we only process it with your explicit consent, which you can withdraw at any time.
- Your photo is sent to AI providers (OpenAI, and for some runs OpenRouter) to be edited. It is not used to train anyone's models.
- We measure how closely the result resembles you. We keep the similarity score, not the mathematical map of your face — that is discarded when the job finishes.
- Photos are deleted automatically: 7days if you don't buy, 30 days after you do.
- No advertising, no analytics, no tracking cookies. We do not sell or share your data for marketing.
- Who we are
- What we collect
- Biometric data
- Why we use it
- Who else sees it
- International transfers
- How long we keep it
- Security
- Your rights
- US state privacy rights
- Children's photos
- Cookies
- Changes
- Contact
1. Who we are
PhotoDoc is operated by Andrei Filippov, a sole trader established in Portugal. Under the EU General Data Protection Regulation we are the data controller for the personal data described here. You can reach us at [email protected].
This policy covers https://getphotodoc.com and the photo-editing service offered on it. It does not cover sites we link to.
2. What we collect
The photo you upload
The image file itself, plus whatever it contains — your face, and any technical information embedded in the file. We normalise colour profile and orientation on upload; we do not retain camera metadata or location tags beyond that processing step.
Information derived from the photo
To do the job, our pipeline measures the face: its position, tilt, the location of eyes, chin and head top, and a numerical representation of facial geometry used to check that the edited photo still looks like you. See section 3.
Order and contact information
- The document type you selected (for example, US passport).
- Your email address, so we can send you the finished photo, and if you write to support, the content of that message.
- Payment confirmation from Stripe. Stripe handles the payment itself — we never receive your card details.
Technical information
- A randomly generated session identifier stored in your browser, used to tie your upload to your result and to your purchase.
- IP address and basic browser signals, collected by our host and by Cloudflare Turnstile to tell humans from bots.
- Server logs, and a job record noting the outcome of the run (succeeded, rejected at the quality gate, or failed) and its processing cost to us.
3. Biometric data
A photograph of a face processed to identify or verify a person is biometric data: a special category of personal data under Article 9 GDPR, and "biometric information" under several US state laws. We treat it as such, and we want you to know exactly what happens to it.
Our pipeline computes a face embedding — a list of numbers describing the geometry of your face — from your original photo and from each candidate result. Comparing the two tells us whether the edit still looks like you rather than like a stranger. That check is the core of the product; without it we would be shipping flattering pictures of someone else.
What we do with it:
- Legal basis: your explicit consent, given by ticking the consent box before you upload (Article 9(2)(a) GDPR). You may withdraw it at any time — see section 9. Withdrawal does not affect processing already carried out.
- Lifetime: the embedding exists only in memory while your job runs. It is never written to our database or file storage, and it is discarded when the job ends.
- What we keep: a single similarity score between 0 and 1. That number cannot be used to reconstruct or recognise your face.
- Never used for: identifying you elsewhere, building a face database, training models, matching against other users, or any purpose other than producing the photo you asked for.
4. Why we use it, and on what legal basis
| What we do | Legal basis |
|---|---|
| Process your face photo and derive face geometry | Explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR) |
| Produce and deliver the photo you ordered, handle refunds | Performance of a contract (Art. 6(1)(b)) |
| Answer support requests | Performance of a contract, or our legitimate interest in supporting users (Art. 6(1)(f)) |
| Block bots, prevent abuse, cap runaway processing costs | Our legitimate interest in keeping the service running and affordable (Art. 6(1)(f)) |
| Keep records of sales for accounting and tax | Legal obligation (Art. 6(1)(c)) |
We do not use your data for advertising, profiling, or automated decisions that produce legal effects concerning you.
5. Who else sees your data
We are one person, not a data centre. Running the service means using other companies, which act as our processors under contract and may only use your data to provide their service to us:
| Provider | What for | What they see | Where |
|---|---|---|---|
| OpenAI | Image generation and automated quality review | Your uploaded photo and the generated image | United States |
| OpenRouter | Alternative image-generation models (used for some runs) | Your uploaded photo and the generated image | United States |
| Supabase | Database and encrypted file storage | Your photos, job record, email address | Ireland (EU) |
| Railway | Application hosting | Photos in transit during processing, server logs, IP address | United States / EU |
| Stripe | Payment processing (merchant of record) | Payment and billing details, email address. We never see your card number. | United States / Ireland |
| Resend | Delivery of your finished photo and support replies | Your email address, the finished photo | United States |
| Cloudflare | Bot and abuse protection (Turnstile) | IP address, browser signals | United States / global network |
On AI providers specifically: your photo is sent to OpenAI (and for some runs OpenRouter) purely to generate your image. Data submitted through their business APIs is not used to train their models. They may retain it briefly for abuse monitoring under their own policies.
Beyond these, we disclose personal data only where we are legally required to, or where it is necessary to establish or defend legal claims. We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
6. International transfers
Several of the providers above are established in the United States, so your data is transferred outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses, or on the provider's certification under the EU–US Data Privacy Framework where applicable. You can ask us for details of the safeguards in place.
7. How long we keep it
| Data | Kept for |
|---|---|
| Face embeddings | Not stored — discarded when the job finishes |
| Uploaded photo and result, no purchase | Deleted after 7 days |
| Uploaded photo and result, after purchase | Deleted 30 days after purchase, so you have time to download it again |
| Job record without images (outcome, cost, document type) | Up to 24 months, for fraud prevention and service statistics |
| Support correspondence | Up to 12 months |
| Sales and tax records | As required by law in Portugal, typically several years |
You do not have to wait for those windows — ask us and we will delete your photos sooner.
8. Security
Photos are stored in a private bucket that is not publicly readable. Your browser only ever receives a short-lived signed link to the watermarked preview; the clean full-resolution file is released after payment. Data is encrypted in transit and at rest by our storage provider, and access keys are held on the server only.
No system is perfectly secure. If a breach affects your rights, we will notify the competent supervisory authority and, where required, you.
9. Your rights
If you are in the EEA or the UK, you have the right to:
- access the personal data we hold about you, and get a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to processing;
- receive your data in a portable format;
- withdraw your consent to biometric processing at any time, which means we stop processing and delete your photos.
Write to [email protected]. We answer within one month. There is no charge. If you are unhappy with how we handled it, you can complain to the data protection authority in Portugal or in the country where you live.
10. US state privacy rights
Biometric information notice
As described in section 3, we collect a scan of face geometry in order to verify that your edited photo still resembles you. We collect it only after you consent, we do not sell, lease, trade or otherwise profit from it, and we destroy it when the job that created it finishes — in all cases within the retention schedule set out in section 7.
Illinois
PhotoDoc is not offered to residents of the State of Illinois, and we ask that you do not use the service if you are one.
California and other states
We do not sell personal information and do not share it for cross-context behavioural advertising. Residents of California, Colorado, Connecticut, Virginia and other states with comparable laws may request access to, deletion of, or correction of their personal information, and will not be discriminated against for doing so. Use the same address: [email protected].
11. Children's photos
The service is not for use by anyone under 16. Children do need passport photos, though — so if you are uploading a photo of a child, you must be that child's parent or legal guardian, and you are giving consent on their behalf, including to the biometric processing described above. Do not upload a photo of a child you are not responsible for.
12. Cookies
We use no advertising or analytics cookies, and there is nothing here to opt out of. The only browser storage we rely on is strictly necessary: a session identifier that links your upload to your result and your payment, and the storage Cloudflare Turnstile uses to confirm you are not a bot.
13. Changes to this policy
If we change how we handle your data we will update this page and the effective date at the top. If the change is significant and we have your email address, we will tell you directly.
14. Contact
Andrei Filippov, Portugal
[email protected]
See also our Terms of Service.