Privacy Policy
Last updated: 29 June 2026
Your family photos are personal. Privacy isn't a feature we bolt on — it is how Recolor the Past is built. This policy explains, in plain language, what we do and do not do with your data, and the rights you have under the EU General Data Protection Regulation (GDPR).
The short version
- We process your photos on EU-hosted infrastructure.
- We never use your photos to train AI models.
- We never sell your photos or your personal data.
- Uploads and results are deleted automatically after a short retention window, and you can delete them yourself at any time.
- We strip embedded metadata (e.g. GPS/EXIF) from images by default.
1. Who is responsible (data controller)
SIA CrowFoundry, a Sabiedrība ar ierobežotu atbildību (SIA) — private limited company registered in Latvia, European Union. Registration No. 50203733521, VAT No. LV50203733521, registered address Mednieku iela 17, Sigulda, Siguldas novads, LV-2150, Latvia. Privacy contact: [email protected]. Data protection contact: [email protected].
2. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account email + password hash | Create and secure your account | Contract (6(1)(b)) |
| Uploaded images (transient) | Provide the restoration/colorization you requested | Contract (6(1)(b)) |
| Processing results (transient) | Deliver your download | Contract (6(1)(b)) |
| Credit ledger & payment metadata (via Stripe) | Sell credits, comply with accounting/tax law | Contract + Legal obligation (6(1)(b),(c)) |
| Minimal logs, anti-abuse signals (IP, rate counters, Turnstile) | Security, fraud/abuse prevention, service reliability | Legitimate interests (6(1)(f)) |
We do not intentionally collect special-category data. Photographs can nonetheless depict identifiable people. We therefore treat all uploads as sensitive and apply the protections described here. You are responsible for having the right to upload and process any image you submit.
3. We do not train on your photos
We do not use uploaded customer photos, or the results we generate, to train, fine-tune, or evaluate AI models. Your images are used solely to produce the output you asked for.
4. Retention and automatic deletion
Image bytes live only in object storage, never in our primary database. They are deleted automatically:
- Anonymous free-preview uploads/results: within ~24 hours.
- Paid uploads/results: within the retention window shown in the app (≈7 days), and sooner after you download when "delete after download" is in effect.
- You can delete any image immediately from your account.
Billing and tax records are retained as long as required by Latvian/EU law.
5. Who else processes data (sub-processors)
We use a small set of EU-focused providers strictly to run the service:
- Hosting & object storage — EU data centres.
- Payments — Stripe (card processing, fraud checks). We never see full card numbers.
- Bot/abuse protection — Cloudflare Turnstile (privacy-preserving, no tracking cookies).
- Email delivery — for transactional emails (receipts, download links).
We do not send your images to any third party for advertising or model training.
6. International transfers
Processing is performed on EU-hosted infrastructure. Where a sub-processor involves a transfer outside the EEA, it is covered by an adequacy decision or EU Standard Contractual Clauses.
7. Your rights
Under the GDPR you may: access your data; rectify it; erase it ("right to be forgotten"); restrict or object to processing; and receive your data in a portable format. Email [email protected] and we will respond within the legal time limits. You also have the right to lodge a complaint with your supervisory authority — in Latvia, the Data State Inspectorate (Datu valsts inspekcija).
8. Cookies
We use only strictly-necessary cookies by default (session, anonymous-demo, and your consent choice). Non-essential cookies are never set without your consent. See the Cookie Policy.
9. Children
The service is not directed to children under 16. We do not knowingly create accounts for them.
10. Changes
We will post any material change here and update the date above. Significant changes affecting your rights will be communicated where appropriate.