Privacy Policy

BASILDON LIMITED runs this site and is the controller of the personal data on it.

BASILDON LIMITED
2 Navarre Street, London, England, E2 7JH
United Kingdom

The way to reach us about any of this is the contact page.

There is a plainer account of what happens to an uploaded photograph at what happens to your photo. This page is the formal one.

What we hold, and why we are allowed to

Your email address. An account needs one, and it is the only way we can answer you. We hold it to perform our contract with you.

Your password, as a hash. Not as text — we cannot read it and cannot tell it to you. Held to perform the contract, and to keep your account yours.

The photographs you upload and the sets made from them, for 7 days. Without the photograph there is no set: contract again.

Your token balance and the record of what was spent. Contract, and after that our legitimate interest in being able to settle a dispute about a balance — yours as much as ours.

Server logs. Our hosting provider records the address you connect from, in its own logs, as every web server does. We use them only to keep the site working and to see when somebody is attacking it — a legitimate interest. We do not run an analytics service, and no third-party script of any kind is loaded on these pages; the typefaces are served from here, not from Google.

Anything you write to us through the contact form — your message, the address you gave so we can answer, and your name if you gave one. Held on our own server so that nothing you tell us is lost, and kept while the matter is open and for a while after, because the same person often writes again about the same thing. Our legitimate interest in answering you, and in remembering that we did.

Ask us to delete a message once it is settled and it goes. We do not add the address to any list — there is no list.

Failed sign-in attempts and repeated form submissions, counted against the network address they came from and forgotten within the quarter of an hour. Without that count a password can be guessed at without limit. Legitimate interest, and a short-lived one.

Who else sees it

fal.ai, in the United States, receives the photograph — twice, for the two steps of the work. Nothing else is sent: not your address, not your name, not your balance. They act on our instructions and for no purpose of their own.

Our hosting provider holds the server the site runs on, and with it everything stored on it.

Nobody buys this data from us and nobody is given it for advertising. We give it to an authority only where the law requires it, and will tell you if that happens unless we are forbidden to.

Sending your photograph outside Europe

The cutting and the background are done by a company in the United States, so your photograph leaves the European Economic Area. Personal data may only be sent outside it with a safeguard the law recognises, and a photograph of a product on a kitchen table can be personal data — the kitchen is somebody's.

What travels is the picture alone, inside the request rather than as a link, so it is never sitting at an address anybody could visit, and it carries no name, address or account with it. That reduces the risk; it does not remove the requirement.

How long we keep it

Photographs and sets: 7 days, then deleted by a task that runs daily.

Account, balance and history: while the account exists. Ask us to close it and it goes, along with the balance.

Messages sent through the contact form: while the matter is open and for a while after. Ask and they go sooner.

Counts of failed sign-ins and repeated submissions: a quarter of an hour.

What you can ask for

If the law where you live gives you these rights — and in the European Economic Area and the United Kingdom it does — you may ask us for:

• A copy of the personal data we hold about you.
• A correction of anything wrong.
• Deletion of it, which for an account means closing it.
• A pause — that we hold it but stop using it while something is disputed.
• A portable copy, in a form another service could read.
• That we stop relying on legitimate interest, if your situation gives you a reason to object. We will stop unless we have grounds that outweigh yours, and we will say which.

Write to us. We answer within a month, free, and we do not ask why. If we need to be sure it is you, we will ask you to write from the address on the account rather than demand a document.

If you think we have handled it badly

Tell us first — it is faster and we would rather know. But you do not have to, and you may complain to a data protection authority instead. If you are in the UK that is the Information Commissioner's Office, at ico.org.uk. In the European Economic Area you may go to the authority in the country where you live, where you work, or where the problem happened, whichever suits you; the list of them is kept by the European Data Protection Board at edpb.europa.eu.

Keeping it safe

The site is served over an encrypted connection. Passwords are stored as hashes. Uploaded photographs sit in folders named by a long random string that cannot be guessed or counted up to from somebody else's. Guessing at a password is limited. The key that lets us talk to the cutting service is kept outside the website's own folders, where the web cannot reach it.

None of that is a guarantee, and anybody who tells you their site cannot be breached is selling something. If a breach happens that puts you at risk, we will tell you and the authority, quickly.

Children

This is a tool for selling things and is not meant for children. We do not knowingly hold data about anybody under eighteen. If you believe we do, write to us and it will be removed.

Decisions made by machine

A machine decides whether a file is a workable photograph and refuses it if not. That is the only automatic decision here, it has no legal effect on anybody, and the remedy is to send a different photograph. Nothing on this site profiles you or scores you.

Cookies

Only the ones that keep you signed in. Details on the cookie page.

Changes

When this page changes we date the change at the foot of it. If a change matters to you — a new recipient of your data, a new purpose — we will tell account holders by email rather than waiting to be noticed.

An honest note about this page

This was written by the people who built the site, and it describes what the software actually does — checked rather than assumed. A lawyer has read it.