Privacy Policy

1. Introduction and Data Controller

ProfileUpgraded ("we," "us," or "our") is committed to protecting your privacy and personal data. This Privacy Policy describes how we collect, use, store, and protect your information when you use our AI-powered photo enhancement services.

Data Controller: ProfileUpgraded is the data controller for the personal information processed through our services. We determine the purposes and means of processing your personal data.

2. Legal Basis for Processing (GDPR Compliance)

Under the General Data Protection Regulation (GDPR), we process your personal data based on the following legal grounds:

• Consent: For processing photos and optional data where you have given explicit consent
• Contract Performance: To provide our AI photo enhancement services
• Legitimate Interests: For service improvement, security, and website analytics
• Legal Obligations: When required by applicable laws or regulations

3. Information We Collect

3.1 Photos and Image Data

• Uploaded Photos: Images you voluntarily upload for AI processing
• Processed Images: AI-enhanced photos generated by our service
• Image Metadata: Technical information associated with your photos (size, format, upload time)

3.2 Technical and Usage Data

• Request Information: Request IDs, passphrases, and processing status
• Device Information: IP address, browser type, operating system
• Usage Analytics: How you interact with our website and services
• Performance Data: Processing times, error logs, and service metrics

3.3 Google Analytics Data

We use Google Analytics to understand how visitors use our website. This service collects:

• Anonymized IP addresses and location data
• Pages visited and time spent on our website
• Device and browser information
• Traffic sources and user behavior patterns

Opt-out: You can disable Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

4. How We Use Your Information

4.1 Photo Processing

• AI Enhancement: Processing your photos through our AI algorithms
• Service Delivery: Generating and providing enhanced images to you
• Quality Assurance: Ensuring optimal processing results

4.2 Service Operations

• Request Management: Managing your processing requests and downloads
• Technical Support: Troubleshooting and resolving service issues
• Security: Protecting against fraud, abuse, and security threats
• Legal Compliance: Meeting legal and regulatory requirements

4.3 Service Improvement

• Analytics: Understanding service usage and performance
• Research: Improving our AI algorithms and service quality
• Website Optimization: Enhancing user experience and functionality

5. Third-Party Processing and AI Training

5.1 Third-Party AI Services

To provide our AI enhancement services, we work with carefully selected third-party AI processing partners:

• Secure Transmission: Your photos are encrypted during transmission to our partners
• Private Processing: All processing is done in secure, private environments
• No Unauthorized Use: Partners are contractually prohibited from using your photos for any purpose other than processing your request
• Limited Access: Only authorized personnel have access to processing systems

5.2 AI Training and Model Improvement

Your photos may be used to improve our AI models under strict privacy protections:

• Anonymized Training: Photos used for training are processed without personal identifiers
• Consent-Based: We only use photos for training where explicit consent has been provided
• Secure Environment: All training occurs in secure, access-controlled environments
• No Distribution: Training data is never shared outside our trusted partner network

6. Data Retention and Deletion

6.1 Photo Retention Periods

• Uploaded Photos: Automatically deleted 30 days after processing completion
• Processed Images: Available for download for 30 days, then automatically deleted
• Temporary Files: Deleted immediately after processing completion

6.2 Technical Data Retention

• Request Logs: Retained for 60 days for security and support purposes
• Analytics Data: Aggregated and anonymized data retained for service improvement
• Security Logs: Retained for 60 days for security monitoring

6.3 Early Deletion

You can request immediate deletion of your data by contacting us. We will process deletion requests within 72 hours.

7. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

7.1 Right of Access

You have the right to request information about what personal data we hold about you and how it's processed.

7.2 Right to Rectification

You can request correction of inaccurate or incomplete personal data.

7.3 Right to Erasure (Right to be Forgotten)

You can request deletion of your personal data when:

• The data is no longer necessary for the original purpose
• You withdraw consent and there's no other legal basis for processing
• Your data has been unlawfully processed

7.4 Right to Restrict Processing

You can request restriction of processing in certain circumstances, such as when you contest the accuracy of your data.

7.5 Right to Data Portability

You can request a copy of your personal data in a structured, machine-readable format.

7.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

7.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw your consent at any time.

7.8 Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection supervisory authority if you believe your rights have been violated.

8. Data Security Measures

We implement comprehensive security measures to protect your data:

8.1 Technical Safeguards

• Encryption: All data is encrypted in transit and at rest using industry-standard encryption
• Secure Servers: Data is stored on secure, access-controlled servers
• Regular Security Audits: We conduct regular security assessments and vulnerability testing
• Access Controls: Strict access controls limit who can access your data

8.2 Operational Safeguards

• Staff Training: All personnel receive privacy and security training
• Confidentiality Agreements: Staff sign comprehensive confidentiality agreements
• Incident Response: We have procedures in place to respond to security incidents
• Regular Backups: Secure backup systems protect against data loss

9. International Data Transfers

When we transfer your data outside the European Economic Area (EEA), we ensure adequate protection through:

• Adequacy Decisions: Transfers to countries with adequacy decisions from the European Commission
• Standard Contractual Clauses: Using EU-approved standard contractual clauses
• Certification Schemes: Working with partners who have appropriate certifications
• Binding Corporate Rules: Where applicable, using binding corporate rules

10. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience:

10.1 Essential Cookies

Required for basic website functionality and cannot be disabled.

10.2 Analytics Cookies

Used by Google Analytics to understand website usage and improve our services.

10.3 Managing Cookies

You can control cookies through your browser settings. Note that disabling certain cookies may affect website functionality.

11. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements:

• Notification: We will notify you of significant changes via email or website notice
• Effective Date: Changes become effective immediately upon posting
• Review: We recommend reviewing this policy periodically

12. Age Restrictions

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

13. Contact Information and Data Protection Officer

14. Supervisory Authority

If you are located in the EU/EEA and have concerns about our data processing practices, you can contact your local data protection supervisory authority. A list of supervisory authorities is available at edpb.europa.eu.