Privacy Policy

What we collect

• Account. Your email address and password. The password is stored only as a secure hash by our sign-in provider. If you sign in with Google, we receive your Google email address and basic profile details (name and profile picture).
• Your content. Product photos you upload, images and videos we create for you, project names, the settings and prompts used for each generation, and the automatic product description made from your photos.
• Sparks. Your spark balance and a record of every charge and refund.
• Technical data. The IP address of requests, used to limit abuse and kept for no longer than one day, and standard server logs from our hosting provider.

How we use it

Only to run Photolisto: to sign you in, keep your projects, create your images, count sparks, stop abuse and fix problems. We do not sell your data or show ads. To see which pages work and where people get stuck, we count visits with PostHog in cookieless mode: nothing is stored in your browser, visits are joined by a hash that changes every day, and page addresses are sent without project ids or email addresses. When something breaks, the error message and the page address go to PostHog too, so we can fix it. We do not record your screen.

Who processes your data

• Supabase. Accounts, database and file storage, hosted in the EU (Ireland).
• Vercel. Hosting of the website and its server functions, which run in the EU (Dublin).
• Google Cloud (Vertex AI). Image and video generation and product analysis. Your photos and prompts are sent to Google to create results, under Google Cloud terms as our service provider. Processing may take place outside the EU.
• Google Sign-In. Only if you choose to sign in with Google.
• Stripe. Card payments for spark packs. Stripe receives your email address and payment details; we never see or store your card number. We keep a record of each purchase and refund.
• Cloudflare Turnstile. A check on the sign-up, log-in and password reset forms that stops bots. Cloudflare sees your IP address and browser signals for that check.
• PostHog. Cookieless visit statistics and error reports, processed in the EU (Frankfurt).

Cookies and local storage

We use cookies that keep you signed in and remember your language and theme. Your browser also stores interface preferences, such as the selected project and grid or list view. If you open a friend's invite link, the invite code is kept in your browser until you sign up. We do not use advertising cookies.

How long we keep it and how to delete it

We keep your data while your account exists. Deleting frames or projects in the app also deletes their files. To delete your account and everything in it, email hello@photolisto.com from the address you signed up with. We will delete it within 30 days.

Your rights

You can ask for a copy of your data, a correction or deletion at any time by emailing hello@photolisto.com. If you are in the EU or UK, you can also complain to your local data protection authority.

Security

All traffic uses HTTPS. Files are kept in private storage and are only served to their owner through short-lived links. Every request for your projects, jobs and files checks that they belong to you.

Children

Photolisto is not intended for anyone under 16.

Changes and contact

If this policy changes, we will update this page and its date. Questions: hello@photolisto.com. See also our Terms of Service.