Skip to content
Get credits

Privacy Policy

How PixToolery collects, uses, stores and deletes your data and images, which processors we rely on, and how to exercise your GDPR rights.

Last updated: 2026-09-30

Draft — pending legal review before launch.

Who we are

PixToolery (https://www.pixtoolery.com) is an online image tools and AI photo editing service operated by a sole operator: [Operator legal name], [Postal address], [Country of establishment] ("we", "us"). We are the data controller for the personal data described in this policy.

Contact for any privacy question or request: [contact email: support@pixtoolery.com — to confirm].

The short version

  • Our free browser tools (compress, resize, crop, convert, watermark and similar) run entirely in your browser. The files you open in them do not leave your device and are never sent to us.
  • Our AI tools (background removal, upscaling, restoration, AI photo editor, face swap, AI image detector and similar) require us to upload your image to our servers and to an AI processor to produce the result.
  • We store uploads and results in private storage, delete them automatically after a set period, and do not use your images to train AI models.
  • We do not sell your personal data.

Data we collect

Account data. If you create an account: your email address, a hashed password (if you sign up with email and password), or your basic Google profile information (name, email, profile picture) if you use Sign in with Google.

Images and results (AI tools only). Images you upload to an AI tool, any text instructions or prompts you enter, and the generated results. For the AI photo editor this includes your chat history with the editor.

Usage and job data. Which AI tools you ran, when, the credits used, job status (completed, failed, timed out) and technical metadata about the files (size, format, dimensions).

Purchase data. Your credit purchases, credit balance and credit ledger (credits added, used, refunded or expired). Payments are processed by Stripe; we do not receive or store your full card number. We receive limited information from Stripe such as the order reference, amount, currency, country and payment status.

Guest data. If you use AI tools without an account, we process your IP address to enforce the daily free limit, and Cloudflare Turnstile processes technical signals from your browser to tell humans from bots.

Technical data. IP address, browser and device type, pages visited, and server logs, used for security, debugging and abuse prevention.

Communications. Messages you send us (for example support or abuse reports) and transactional emails we send you.

How we use your data and our legal bases

Under the EU and UK General Data Protection Regulation (GDPR), we rely on the following legal bases:

  • Performance of a contract — to create and manage your account, run the AI tools you request, deliver results, manage your credits and purchases, and send transactional emails (sign-in, password reset, purchase confirmations).
  • Legitimate interests — to secure the service, prevent fraud, abuse and multi-accounting, enforce free-usage limits and our Acceptable Use Policy, debug problems and improve the reliability of the service. We balance these interests against your rights and keep the data involved to a minimum.
  • Legal obligation — to keep accounting and tax records, respond to lawful requests from authorities, and handle reports of illegal content.
  • Consent — for non-essential cookies or analytics, if and when we use them. You can withdraw consent at any time.

Images you process

  • Browser tools: processed locally in your browser. We do not receive, see or store these files.
  • AI tools: your image is uploaded over an encrypted connection, stored in private Cloudflare R2 storage and sent to an AI processor only to generate the result you requested. Files are accessed only through short-lived signed links.
  • No training: we do not use your images, prompts or results to train AI models. We select AI processors that do not use your inputs to train their models [to confirm per provider].
  • Human access: we do not look at your images, except where strictly necessary to investigate a report of abuse or illegal content, to handle a support request you make, or where required by law.

How long we keep data

  • Guest uploads and results: deleted automatically after 24 hours.
  • Signed-in users' files and job history: kept for the history period attached to your credit tier (for example 30, 90 or 365 days), then deleted automatically.
  • Account data: kept while your account is active. When you delete your account, your files, jobs and AI editor chat history are deleted along with it.
  • Order and credit ledger records: kept, in anonymised or minimised form, for as long as required by accounting and tax law [retention period — to confirm, e.g. 10 years in France].
  • Security logs: kept for a limited period [e.g. up to 12 months — to confirm], unless needed longer to investigate an incident.
  • Backups: deleted data may persist in encrypted backups for a short time [period — to confirm] before being overwritten.

Processors and sub-processors

We share data only with service providers that help us run PixToolery, under contracts that require them to protect it:

  • Cloudflare — hosting, CDN, Workers, R2 file storage and Turnstile bot protection.
  • Supabase — database (accounts, jobs, credits).
  • Stripe (via Stripe Managed Payments) — payment processing; Stripe acts as the merchant of record for purchases.
  • Resend — transactional email.
  • kie.ai and fal.ai — AI image model inference.
  • Google — Sign in with Google (only if you use it).

For purchases, Stripe acts as merchant of record and, for the payment transaction and tax compliance, processes your data as an independent controller under its own privacy policy.

We may also disclose data where required by law, to protect our rights or users' safety, or to a successor if the service is transferred (with notice to you).

International transfers

Some of our providers process data outside the European Economic Area, including in the United States. Where this happens, we rely on an adequacy decision (such as the EU-US Data Privacy Framework, where the provider is certified) or on the European Commission's Standard Contractual Clauses, together with additional safeguards where appropriate. You can ask us for more information about these safeguards.

Cookies

We use:

  • Essential cookies for sign-in and session management, and to keep your account secure.
  • A locale cookie (PARAGLIDE_LOCALE) that remembers your language choice.
  • Cloudflare Turnstile, which may set or read technical data needed for bot protection.

These are strictly necessary and do not require consent. [Analytics: if analytics or advertising cookies are enabled, they are only set after your consent through our cookie banner, and you can change your choice at any time — to confirm / remove if not used.]

Your rights

Subject to the conditions set by law, you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data rectified;
  • have your data erased;
  • restrict the processing of your data;
  • receive your data in a portable format;
  • object to processing based on our legitimate interests;
  • withdraw your consent at any time, where processing is based on consent.

You can delete your account yourself from your account settings [to confirm], or email us at [contact email: support@pixtoolery.com — to confirm]. We may ask you to verify your identity. We respond within one month, which may be extended in the cases allowed by law.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work. In France, this is the CNIL (www.cnil.fr).

Security

We use encryption in transit, private storage with short-lived signed links, access controls and bot protection. No system is perfectly secure; if a data breach is likely to put your rights at risk, we will notify you and the relevant authority as required by law.

Children

PixToolery is not intended for anyone under 16 (or the age of digital consent in your country, if higher). We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy. We will change the date at the top and, for significant changes, notify signed-in users by email or on the site before they take effect.

Contact

[Operator legal name], [Postal address], [Country of establishment] — [contact email: support@pixtoolery.com — to confirm].