Privacy Policy

This Privacy Policy describes how Photo Generator collects, uses, discloses, and protects your personal data. It applies to the AI image generator, AI photo editor, and related services operated by Photo Generator Ltd..

Last updated: 2026-03-20. We will notify you of any significant changes by posting a prominent notice on photo-generator.org or by contacting you directly when required by law.

1. Data Controller and contact

The Data Controller responsible for the processing of your personal data is Photo Generator Ltd., reachable at info@photo-generator.org.

The Data Protection Officer (DPO), appointed under Article 37 of the EU General Data Protection Regulation (EU) 2016/679, is represented by Photo Generator Privacy Team and can be contacted at the same email address.

2. Personal data we collect

We collect personal data only when it is necessary to provide our services or to comply with legal obligations. The categories include:

Technical data — IP address (truncated), browser type and version, operating system, device identifiers, screen resolution, language preferences, and referrer URL.
Usage data — pages visited, time spent on each page, click patterns, and interaction with our AI image generator.
Prompt data — the text prompts and source images you submit to our AI image generator. Prompts and images are processed to fulfil your request and cached to speed up repeat operations.
Consent data — records of the consent choices you make through the cookie banner (advertising, analytics, personalization, security, functionality).
Communication data — if you contact us by email, we retain the message content and metadata needed to respond to you.

3. How we use your personal data

We use the data we collect for the following purposes:

To operate, maintain, and improve Photo Generator, including AI image generation, photo editing, and gallery features.
To remember your preferences and consent choices.
To measure aggregated, anonymized traffic and usage patterns.
To detect and prevent abuse, fraud, or other security incidents.
To comply with our legal obligations and respond to lawful requests from public authorities.

4. Legal basis for processing (GDPR Art. 6)

We rely on the following legal bases, depending on the activity:

Consent (Art. 6(1)(a)) — for analytics, advertising, and personalization cookies.
Contract (Art. 6(1)(b)) — to fulfil your request to generate or edit an image.
Legitimate interests (Art. 6(1)(f)) — to keep the site secure, prevent abuse, and improve our services, balanced against your rights and freedoms.
Legal obligation (Art. 6(1)(c)) — to comply with applicable laws and respond to lawful requests.

6. Retention of data

We retain personal data for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods:

Server logs: up to 30 days.
Aggregated analytics: up to 14 months.
Generated image cache: up to 90 days; you may request earlier deletion.
Consent records: up to 12 months from the date of withdrawal.
Email communications: up to 24 months.

Once the retention period expires, we will delete, de-identify, or anonymize the personal data, or, if this is not possible (for example, because the personal data has been stored in backup archives), we will cease processing the personal data until deletion becomes possible.

7. International data transfers

Some of our service providers are located outside the European Economic Area, including in the United States. When we transfer personal data internationally, we rely on Standard Contractual Clauses (SCC) approved by the European Commission, or other lawful transfer mechanisms, together with additional technical and organizational safeguards such as encryption in transit and access controls.

8. Your rights as a data subject

Subject to applicable law, you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate or incomplete data.
Erasure — ask us to delete your personal data ("right to be forgotten").
Restriction — ask us to limit how we process your data while a complaint is investigated.
Portability — receive your data in a structured, commonly used, machine-readable format.
Objection — object to processing based on legitimate interests or for direct marketing.
Withdraw consent — at any time, without affecting the lawfulness of processing prior to withdrawal.
Lodge a complaint — with your local data protection authority.

To exercise any of these rights, contact us at info@photo-generator.org. We will respond within thirty (30) days.

9. Data deletion requests

You may at any time request that we delete the personal data and user-generated content we hold about you. This includes, where applicable:

text prompts you submitted to the AI image generator,
source photos you uploaded for editing,
generated images cached against your session,
communication records (emails you sent us), and
consent and usage logs tied to your identifiers.

How to submit a request: send an email to info@photo-generator.org from the email address you originally contacted us with (or any address you can prove belongs to you). Use the subject line "Data deletion request" and include:

your full name,
the email address you used on the site,
the approximate date(s) you used the service (if known), and
a clear statement that you want your data deleted.

We may need to verify your identity before acting on the request, in order to prevent unauthorized deletion of another person's data. We will acknowledge receipt of your request within seven (7) days and complete the deletion within thirty (30) days, unless we are legally required to retain certain records (for example, for tax or accounting obligations).

If part of your data cannot be deleted for legal reasons, we will inform you in writing which categories are retained, on what legal basis, and for how long.

10. How we protect personal information

We maintain administrative, technical, and physical safeguards designed to protect personal information against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or use. These include encryption in transit (HTTPS), access controls, regular backups, and staff training.

Please note that no electronic transmission of information can be entirely secure. We cannot guarantee that the security measures we have in place to safeguard personal information will never be defeated or fail, or that those measures will always be sufficient or effective.

11. "Do Not Track" disclosure

We do not track our users over time and across third-party websites to provide targeted advertising on our website. Some third-party websites track your browsing activities when they deliver content to you, enabling them to tailor what they present to you. If you visit such websites, you can set a "do not track" signal in your browser to let third parties know that you do not want to be tracked. We honor "Do Not Track" and global privacy control signals in end-user browsers.

12. Children's privacy

Photo Generator is not directed at children under the age of sixteen (16), and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at info@photo-generator.org and we will take steps to delete the data.

13. Updates to this Privacy Policy

This Privacy Policy may be updated periodically. We will post a notice on photo-generator.org to inform you of any significant changes, and indicate at the bottom of the policy when it was last updated. We will also notify you of changes as required by applicable law.

14. Contact us

If you have any questions about this Privacy Policy or our data practices, please contact us at info@photo-generator.org.

Last updated: 2026-03-20. This page is informational and does not constitute legal advice.