1Who is responsible for your data
The data controller is Mikheil Chkhvirkia, individual entrepreneur, identification number 62005029525, Beliashvili St. 70b, Tbilisi, Georgia. For any question about your data, or to exercise any right below, write to mishikochkhvirkia@gmail.com. You do not need a Telegram account or any third-party service to contact us.
2What we collect
- Account data — email address, password hash, display name, chosen language, and where you sign in through a third party, the identifier that service gives us.
- Uploaded images — the vehicle photograph and any part photograph you send. These may contain personal data such as a registration plate, a building, or a person visible in the frame.
- Results — the images we generate for you.
- Usage data — Credit balance, ledger of Credits granted and consumed, edit type, timestamps, and success or failure of each Generation.
- Payment data — amount, currency, status, payment identifier, and where you save a card, the payment provider's token plus the masked card number and card type. We never receive or store your full card number, expiry or security code.
- Technical data — IP address, browser and device information, and error logs.
3Why we process it, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Producing the Results you request | Uploaded images, usage data | Performance of a contract (Art. 6(1)(b)) |
| Creating and running your account | Account data | Performance of a contract |
| Taking payment and preventing payment fraud | Payment data, technical data | Contract; legitimate interests (Art. 6(1)(f)) |
| Keeping the Service secure and preventing abuse of free allowances | Technical data, usage data | Legitimate interests |
| Accounting and tax records | Payment data | Legal obligation (Art. 6(1)(c)) |
| Answering your support messages | Whatever you send us | Legitimate interests |
| Service emails — receipts, renewal notices, failed payments, security | Account data | Contract; legal obligation |
| Occasional product news, if you opt in | Email address | Consent (Art. 6(1)(a)) |
Where we rely on legitimate interests, we have balanced them against your rights and you may object at any time under §7.
If an uploaded image contains data revealing something sensitive about an identifiable person, we do not seek it, do not analyse it, and delete the image under §4. We ask you not to upload images of people.
4How long we keep it
These periods are enforced technically, not by intention:
- Uploaded images — deleted within 24 hours of processing, by an automatic storage lifecycle rule. This applies whether or not the Generation succeeded.
- Results — kept in your account until you delete them or close your account, then removed within 30 days.
- Account data — kept while your account is open, then removed within 30 days of closure.
- Credit ledger and usage records — kept for 3 years to resolve billing disputes, then deleted.
- Payment records — kept for 6 years where required by Georgian accounting and tax law.
- Technical logs — kept for 30 days. Logs never contain image contents or image URLs.
- Backups — overwritten on a rolling 30-day cycle; deletions propagate as backups age out.
5Who else processes your data
We use the following processors. Each is bound by a data processing agreement.
| Processor | Purpose | Location |
|---|---|---|
| Black Forest Labs GmbH | Image editing | Germany (EU) |
| Hetzner Online GmbH | Application hosting and database | Germany (EU) |
| Cloudflare, Inc. | Content delivery and temporary image storage | EU and United States |
| Flitt | Payment processing and card tokenisation | Georgia / EU |
If we add or change an image-processing provider we will update this list before routing your data to it. The current list is always the one published here.
6Transfers outside Georgia and the EEA
Your images are processed in the European Union. Where a processor transfers data to the United States or elsewhere outside the EEA, that transfer is made under the European Commission's Standard Contractual Clauses together with supplementary technical measures, including encryption in transit and the 24-hour deletion rule above. You may request a copy of the relevant transfer mechanism from us.
7Your rights
You have the right to: access your data; have it corrected; have it erased; restrict our processing; object to processing based on legitimate interests; receive your data in a portable, machine-readable format; and withdraw consent where we rely on it, without affecting processing already carried out.
Write to mishikochkhvirkia@gmail.com. We will respond within 30 days and will not charge you for a first request.
Emails. We send service emails you cannot opt out of while you hold an account — receipts, renewal and price-change notices, failed-payment warnings and security alerts. Product news is separate, is sent only if you opt in, and every one carries an unsubscribe link. Unsubscribing from news never affects service emails.
You also have the right to complain to a supervisory authority — in Georgia, the Personal Data Protection Service of Georgia; in the EEA, your national data protection authority.
8Automated processing
Images are edited by automated models. This is image processing, not decision-making about you: no automated decision producing legal or similarly significant effects on you is made. Automated checks on payments and free-allowance abuse may temporarily block a transaction or a signup; write to us and a person will review it.
9Security
Uploads are encrypted in transit, stored in access-restricted storage, and deleted on the schedule in §4. Passwords are stored hashed. Access to production data is limited to the Provider. No system is perfectly secure; if a breach affects your rights we will notify you and the supervisory authority as required by law.
10Children
The Service is not for people under 16. We do not knowingly collect their data; if we learn we have, we delete it.
11Cookies
We use cookies and local storage that are strictly necessary to keep you signed in and to remember your language. We do not use advertising or cross-site tracking cookies. Where we add any non-essential analytics, we will ask for your consent first.
12Changes
We will post any change here and, where the change is material, notify registered users by email at least 14 days in advance.