Privacy policy

Controller

Conscious Innovation Lab OÜ, Tööstuse tn 48, 10416 Tallinn, Estonia. Registration number 14825448 (Estonian Business Register), VAT ID EE102459135. Contact: hello@fotoklar.com

1. What we process and why

a) Your selfies (biometric data, Art. 9 GDPR)

The core of our service: you upload 8–15 photos of yourself, from which an AI model creates professional images of you. This involves processing features of your face — special categories of personal data (biometric data). The sole legal basis is your explicit consent (Art. 9(2)(a) GDPR), actively given before upload. No consent, no processing. You may withdraw it at any time with effect for the future — fastest via the “Delete all my data now” button in your gallery. Your photos are used exclusively to create your images. No training of third-party AI models, no sharing for advertising, no use for other customers.

b) Order and payment data

Email address, chosen package, payment status (Art. 6(1)(b) GDPR — contract performance). Payments are processed by Stripe; we never store card data.

c) Transactional emails

Order confirmation, delivery notification and a single next-day follow-up (Art. 6(1)(b) and (f) GDPR). No newsletter without separate consent.

2. Retention and automatic deletion

• Uploaded selfies and the trained model: automatically deleted 7 days after delivery.
• Generated results: automatically deleted 30 days after delivery (please download before then).
• Instant deletion any time via your gallery.
• Invoice-related data is retained as long as statutory retention duties require.

3. Processors and recipients

• Supabase (database + file storage): EU servers, region Frankfurt, Germany.
• Vercel (website hosting): EU function region (Frankfurt).
• Stripe (payments): independent controller; US transfers possible under the EU-US Data Privacy Framework.
• Resend (transactional email): US transfers possible (EU Standard Contractual Clauses).
• fal.ai (AI image generation): training and generation run on fal.ai GPU infrastructure. Transparency note: processing may take place on servers outside the EU (incl. USA), safeguarded by EU Standard Contractual Clauses. Your selfies are transferred there only for the duration of processing and are not stored there permanently.
• Meta Platforms (only with cookie consent): Meta Pixel and Conversions API for ad measurement, using a hashed email address.
• Plausible Analytics (cookieless analytics, EU-hosted): no personal profiles, no cookies.

4. Cookies and tracking

Technically necessary storage (e.g. your cookie choice) happens without consent. The Meta Pixel loads only after your consent via the cookie banner; change your choice any time via “Cookie settings” in the footer.

5. Your rights

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent: email hello@fotoklar.com any time. Complaints: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or your local supervisory authority.

Version: July 2026.