Privacy policy

1. Who is responsible

• Data controller: the operator of photoeditor, the service at https://photoeditor.my. The legal name on the Waffo Pancake checkout is the name of that operator.
• Privacy and support email: support@photoeditor.my
• Data protection officer: not appointed.

2. What we collect

2.1 Information you give us

• Account: the email address from Google sign-in, and the name Google shares. We do not collect or store a password.
• Photos and prompts: the image you upload, the text you submit, and the still or clip the model returns.
• Payment status: the plan or pack, the amount, the currency, and whether the charge is pending, paid, or refunded. We do not store the full card number. Card data is handled by the payment processor in section 5.
• Messages: what you send from the contact form or to support@photoeditor.my.

2.2 Information collected automatically

• Device and network: IP address, browser type, operating system, and the time of the request, in server logs.
• Use of the product: the model you select, the credit cost of a run, whether the run finished, and error logs needed to return credits when a run fails.

We do not collect precise location. Sign-in is Google only. We do not offer sign-in with a password, WeChat, or another identity provider.

3. Why we use it

We do not send marketing email. We may use aggregated counts that do not identify you, for example how many runs finished in a day.

4. Cookies

A browser can block cookies. Sign-in will not work if the necessary cookies are blocked. A draft you have not submitted stays in your browser’s own storage and is not sent to us until you generate.

5. Who else receives data

We do not sell personal information, including a “sale” as the CCPA uses that word. We share data only as follows.

• Waffo Pancake, the seller of record and our PCI-DSS payment processor. Card data is processed by Waffo Pancake and is not stored on our servers. They receive the amount, the currency, and the billing details required to charge the card or wallet and to calculate tax.
• Google, for sign-in. Their policy is at policies.google.com/privacy.
• Supabase, for the account database and the sign-in session. Their policy is at supabase.com/privacy.
• Cloudflare, for hosting, and Cloudflare R2, for stored files. Their policy is at cloudflare.com/privacypolicy.
• Kie, the generation vendor. The photo and the prompt are sent only to produce that run.
• Resend, to deliver mail you send from the contact form, and mail we send to you. Their policy is at resend.com/legal/privacy-policy.
• A court, a regulator, or a law that requires disclosure.
• A buyer of the service, if the business is sold. We would tell you before the data moves, and the buyer would have to honor this policy.

We do not share account data with an advertising partner. We do not give your photos to another customer.

6. Security

• The site is served over HTTPS.
• Sign-in is through Google. We do not keep a password that could leak.
• Access to the account database and the file store is limited to the people who operate the service.
• An upload is deleted within one hour after that run finishes.

If a breach is likely to affect you, we will tell you and, where the law requires it, the relevant authority without undue delay. Where the GDPR applies, that notice to the authority is within 72 hours of our becoming aware of the breach. Keep your Google account to yourself.

7. How long we keep it

The same upload and training lines sit beside the upload control, before you generate. We do not use your photos or prompts to train our own models.

8. Your rights

Write to support@photoeditor.my. We respond within 30 days.

• To be told what we hold and why.
• To receive a copy.
• To correct something that is wrong.
• To ask for deletion, where the law allows it.
• To ask us to restrict processing in the cases the law lists.
• To receive a portable copy of the data you provided.
• To object to processing based on legitimate interests.
• To withdraw a consent. The service does not rely on consent for the core account, the run, or the charge.

You can also complain to the data protection authority where you live. If we refuse a request, the reply will say why and name that route.

9. Mail you can and cannot opt out of

We do not send promotional mail, so there is no marketing list to leave. Receipts, security notices, and policy updates are part of the service. Those messages are not marketing, and they continue while the account is open.

10. International transfers

The operator, and the providers in section 5, may process data in the United States, the European Union, Singapore, or another country where that provider hosts the service. Where a transfer from the EEA or the UK needs a safeguard, we rely on the provider’s standard contractual clauses, or on an adequacy decision, when that provider offers one.

11. Children

The service is for people who are 18 or older. We do not knowingly collect information from anyone younger. If you believe a child has given us information, write to support@photoeditor.my and we will delete it.

12. Other sites

A link to Google, Waffo, or another site leaves this policy. Their own policy applies once you are there. We are not responsible for how they handle data.

13. Changes

A material change is announced at least 15 days ahead, by email to the account address or by a notice on the site, and the date at the top of this page is updated. Using the service after that date means you accept the update.

14. Contact

• Privacy and support: support@photoeditor.my
• Form: the contact page
• Service name: photoeditor
• Website: https://photoeditor.my

The terms of service link to this page. Checkout uses the same address.

This policy is written for the way the service actually works. It is not a formal legal opinion.