Privacy Policy

In short — the product photos you upload are processed to remove their background and are not stored on our servers. We keep your account and purchase data needed to run the service. Payments go through Stripe. We never sell your data, and you have full GDPR rights.

This Privacy Policy describes how Dmitrii Bosiachenko, autónomo registered in Spain (NIF: Z3795401S) ("we," "us," or "PureWhite BG") collects, uses, and protects your personal information when you visit purewhitebg.com or purchase our product.

This policy is provided in compliance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and the Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).

Your product photos, specifically. Background removal runs in your browser. The image data required for processing is sent to our image provider only to produce your edited photo and is not saved to our servers or storage — not before, during, or after processing. Your source and result images live only in your browser session and are cleared when you leave or refresh the page.

01Data controller

Controller: Dmitrii Bosiachenko (autónomo) · NIF: Z3795401S · Postal address in our Terms of Service · hello@purewhitebg.com

02What data we collect

Product photos (not stored). When you upload a photo, it is transmitted securely and sent as image data to our image provider to generate your edited result. We do not save the image to our database or file storage at any point.

Account and purchase data (stored). When you create an account or buy a plan, our processors collect and store your email address, plan type, subscription status, Stripe order/subscription IDs, and your processing-quota usage counters. We do not collect or store full payment card data — that is handled exclusively by Stripe.

Website usage data. When you visit our Website, we collect standard analytics and advertising data (e.g. pages visited, device and browser type, approximate location from IP) via Google Analytics and, when our ads run, advertising pixels.

Communication data. If you email us at hello@purewhitebg.com, we retain the content of your message for support and quality purposes.

03Why we process your data

• Producing your edited images — performance of contract (Art. 6.1.b)
• Processing payment / subscription billing — performance of contract (Art. 6.1.b)
• Tax and accounting records — legal obligation (Art. 6.1.c), Spanish tax law
• Analytics and advertising measurement — consent / legitimate interest (Art. 6.1.a / 6.1.f)

04How long we keep your data

• Product photos: not retained — cleared after processing
• Account data: kept while your account is active; deleted on request
• Purchase records: 6 years (Spanish tax law requires invoice retention)
• Email correspondence: 2 years after last contact
• Analytics data: 14 months

05Who we share data with

• Stripe — payment and subscription billing
• fal.ai / Bria — receives image data to remove the background; not retained by us afterward
• Supabase — account authentication and database hosting
• Google (Analytics) — website analytics
• Advertising platforms — measurement when our ads run
• Spanish tax authorities (AEAT) — required reporting under Spanish tax law

We never sell your personal data.

06International data transfers

Some processors (e.g. Stripe, Google) may process data in the United States. All such transfers rely on GDPR Chapter V safeguards (EU-US Data Privacy Framework and/or Standard Contractual Clauses).

07Your rights

Under GDPR and Spanish law, you have the right to access, rectify, erase, restrict, and port your data, to object to processing based on legitimate interest, and to withdraw consent at any time. You may also lodge a complaint with the Spanish Data Protection Authority (AEPD) at aepd.es.

To exercise any of these rights, including deletion, email us at hello@purewhitebg.com. We respond within 30 days as required by GDPR.

08Security

We apply industry-standard security measures: TLS encryption in transit, encrypted storage at rest, and limited access on a need-to-know basis. Our payment processor Stripe is PCI-DSS Level 1 certified. If a data breach occurs that affects your data, we will notify you and the AEPD within 72 hours as required by GDPR Article 33.

09Children

PureWhite BG is not directed at children under 16. We do not knowingly collect personal data from children.

10Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Material changes affecting your rights will be communicated by email where we have your address.

11Contact

Dmitrii Bosiachenko · Autónomo (registered in Spain) · hello@purewhitebg.com