Privacy Policy
Who we are. The service is provided by Fine Grain LLC, 75 East 3rd Street, Sheridan, WY 82801, USA ("we"). Data questions: [email protected].
What we process. (1) Account: email address, chosen language and theme, sign-in times. There is no password — you sign in with a link sent to your email. (2) Photos you upload or connect through Dropbox, processed results, masks (the drawn area that is changed) and the processing report (CSV). (3) Credits: balance and ledger; payment details stay with Stripe — we see only amount, date and the last four digits of the card. (4) Technical logs: IP address, browser type, errors — kept 30 days for security and troubleshooting. No tracking cookies; only a session cookie and, if you arrived through a referral link, a first-party cookie with the referral code (90 days). To prevent referral abuse we compare the card fingerprint provided by Stripe — we never see or store the card number.
Why. To provide the service you asked for (processing, delivery, credit accounting), to email you when a folder is done, to keep your account secure, and to meet tax and accounting obligations. Your photos are not used to train our models unless you switch that on in Settings. If you do, we keep a separate copy of some of your processed photos (original, result and the system's findings) on the same EU server so our team can review and label them for training; they are not shared with anyone or published. While consent is on, we give back 10% of the credits charged for delivery. You can withdraw at any time in Settings: we then delete the stored copies within minutes; a model already trained on them is not rolled back.
Where the data lives. Photos and results: Cloudflare R2, storage in the European Union. Database: Neon, Frankfurt. GPU processing: RunPod, data centre in Romania (EU). Email: Resend, Ireland. Payments: Stripe (USA; Stripe is an independent controller for payment data). Application: Railway [region]. We have a data-processing agreement with each processor; transfers outside the EU exist only for Stripe and for our own account as a US provider, under standard contractual clauses.
Dropbox. If you connect Dropbox, we request access only to the folders you pick; we read photos from them and write results into a subfolder. You can disconnect in Settings or at dropbox.com — from that moment we access nothing.
How long. Originals and results: 7 days after the last download (Starter and Standard plans) or 14 days (Pro and Studio), then deleted automatically; a folder that was never downloaded is deleted 30 days after the last activity (warning email 3 days before). Masks and CSV reports: one year. Account data (email, language, and the billing name and country when you pay — these come from Stripe, we never ask for them at sign-up) and the credit ledger: while the account exists, then [5] more years for accounting (amounts and dates only, no photos). You can delete your account in Settings — photos, masks and the Dropbox connection are deleted immediately.
Your rights. Access, rectification, erasure, restriction, portability and objection (GDPR Art. 15–21), withdrawal of training consent, and a complaint to the supervisory authority in your country. Requests to [email protected]; we answer within 30 days.
Security. Everything runs over HTTPS; stored files are private; download links are single-use and time-limited; a clean full-resolution result does not exist anywhere you could reach before delivery, and we do not look at your photos except on your support request.
Changes. We notify material changes by email at least 14 days in advance. Effective: [date].