Privacy Policy
Last updated 1 October 2026
This policy explains what personal data Vesold collects when you use our website and photo-editing service, why, how long we keep it, who we share it with and the rights you have. We wrote it to meet the EU and UK General Data Protection Regulation (GDPR).
1. Who we are
The controller of your personal data is [Vesold legal entity name], [Registered address], registered under [Company registration number] (“Vesold”, “we”). Contact us about privacy at privacy@vesold.com. [Data Protection Officer contact, if appointed]. [EU / UK representative, if required].
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email, password (stored only as a salted hash by our sign-in provider), sign-in provider identifiers, credit balance | You; Google or GitHub if you sign in with them |
| Photos and edits | Photos and reference photos you upload, including embedded metadata (EXIF, which can include camera details, dates and GPS location), previews, edit settings and versions, exports | You |
| Requests to the agent | What you ask for, the agent’s replies, the adjustments it made, your saved looks and your taste profile | You; generated while you use the service |
| Usage and billing | Credit balance and history (deposits and what each edit cost), storage used; payment details are handled by Stripe and never reach our servers | You; Stripe |
| Security data | Sign-in events, a keyed hash of your IP address (not the address itself), rate-limit counters keyed the same way, and for each signed-in device the IP address and browser that our server presented to the sign-in service | Your device |
| Consents | When you accepted our terms and whether you want product emails | You |
We do not use analytics or advertising trackers, and we do not buy data about you.
3. Why we use it, and our legal bases
- To provide the service (account, storage, editing, exports, support): performance of our contract with you, art. 6(1)(b) GDPR.
- To keep the service secure (sign-in protection, abuse and fraud prevention, audit logs): our legitimate interest in protecting you and Vesold, art. 6(1)(f).
- Billing, tax and accounting: legal obligation, art. 6(1)(c).
- Product news by email: your consent, art. 6(1)(a), which you can withdraw at any time in Settings → Privacy & data.
- Improving the service from aggregated, non-identifying usage counts: legitimate interest, art. 6(1)(f).
4. How the AI works with your photos
When you ask for an edit, a reduced-size preview of your photo, its statistics and your request are sent to the AI model provider listed in our sub-processors so the model can decide which adjustments to make. The adjustments themselves are applied by our own imaging engine to your original pixels; no image is generated. We use providers under terms that prohibit using your content to train their models, and we do not train models on your photos. [Confirm provider data-retention terms, e.g. zero or limited retention, and list them here.]
If you allow it, the agent writes notes about your stylistic preferences into your taste profile, which you can read, edit or clear in Settings → Taste profile. The service makes no decisions with legal or similarly significant effects about you (art. 22 GDPR).
5. Who we share it with
We share personal data only with service providers that process it on our behalf under data processing agreements (our sub-processors), with authorities where the law requires it, and with a successor if Vesold is sold or merged (we will tell you first). We never sell your data.
6. International transfers
Some providers process data outside the EEA / UK. Where they do, we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses with supplementary measures. [List each transfer and its safeguard.] Ask us for a copy of the relevant safeguards.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account, photos, versions, looks, requests | Until you delete them or your account. Deleted files are erased from storage within 24 hours and from backups within 30 days. |
| Exports (downloads) | 7 days, then erased automatically |
| Working copies on our editing servers | Up to 48 hours after last use (a cache, rebuilt when needed) |
| Live activity of an edit (step-by-step events) | 90 days |
| Model-call log (token counts, cost, timing and error details of each AI call; never your photos or your requests) | 13 months, tied to your account only by an internal ID |
| Security log | 12 months, with IP addresses stored only as keyed hashes |
| Email confirmation codes and password reset links | 15 minutes, single use |
| Signed-in devices (sessions) | Until you sign out or 7 days without use; erased a day after they expire |
| Billing records | As long as tax law requires [e.g. 10 years] |
8. How we protect it
Encryption in transit (TLS) and at rest, private storage reachable only through short-lived signed links, hashed passwords, per-account access checks on every request, rate limiting, least-privilege database access, audit logs and regular backups. See Security. If a breach affects your data, we will notify the supervisory authority within 72 hours and you without undue delay where required.
9. Your rights
You can, free of charge:
- Access your data and take it with you (Settings → Privacy & data → Download my data);
- correct it (Settings → Profile, or ask us);
- erase it (delete photos any time, or delete your account in Settings → Privacy & data);
- restrict or object to processing based on legitimate interests;
- withdraw consent to marketing emails at any time, without affecting earlier processing;
- complain to a data protection authority, e.g. where you live or work. [Name the lead supervisory authority.]
Email privacy@vesold.com for anything you cannot do in the app. We answer within one month.
10. Cookies
We only use cookies that are strictly necessary to sign you in and keep the service secure. See the Cookie Policy.
11. Children
Vesold is not for children. You must be at least 16 years old [or the age of digital consent where you live] to create an account.
12. Changes
We will post changes here and, for material changes, tell you by email or in the app before they take effect.