Privacy Policy

In short

• Most tools work in your browser — your files never leave your device.
• Server tools delete the original right after processing (at most 1 hour) and the result after 1 hour for guests or 24 hours for registered users.
• We never sell your data and never use your files to train AI.
• An account is optional. Analytics and advertising, if enabled, run only with your consent.

1. Who is responsible

The Service imgeditoronline.com is responsible for the processing described here. Contact: info@imgeditoronline.com. We answer privacy requests within one month. This policy covers the website in all its languages; if versions differ, the English version prevails.

2. What we process and why

Browser tools. Files are processed on your device. We receive no file data — only the ordinary page request (see "Server logs").

Server tools. To perform the operation you request we process the uploaded file, its name, format, size and dimensions, the processing settings, a random job identifier and a salted hash of your IP address (used to enforce limits; the IP address itself is not stored with the job). Legal basis: performance of the service you request (Art. 6(1)(b) GDPR). Retention: original deleted right after processing and within 1 hour at the latest; result kept 1 hour for guests and 24 hours for registered users. Technical records of guest jobs (without files) are deleted after 24 hours. Files may contain personal data, for example faces or GPS coordinates in EXIF; we process such data only to carry out your instruction and remove metadata from results by default.

Account. The name you give at sign-up (we use it only to address you personally on your account page and in our e-mails; any name or nickname will do), e-mail address, password (stored only as a salted hash), confirmation status, sign- in times and, for your convenience, the history of your operations: tool, date, file name, format, dimensions, file sizes and settings, and the presets you save (a title and settings) — never the files themselves. Legal basis: Art. 6(1)(b) GDPR. Kept until you delete your account; after deletion the data is erased from database backups within 30 days.

Service e-mails. Address confirmation, password reset and important notices about the Service, sent through our e-mail provider Unisender Go. Legal basis: Art. 6(1)(b) GDPR.

News about the Service. We may occasionally e-mail registered users about the Service: new tools and features, important changes, and paid plans or AI features when they appear. Legal basis: our legitimate interest in informing users about the Service they use (Art. 6(1)(f) GDPR) or, where the law of your country requires prior consent for such e-mails, your consent (Art. 6(1)(a) GDPR) — then we send them only after you have given it. Every such e-mail contains an unsubscribe link, and you can also unsubscribe on your account page or by writing to us. If you tick the consent box, we record when and where (sign-up form or account page) you did so. We do not send news to guests, and we never pass your address to others for their advertising.

Server logs. When you open a page our web server records the IP address, time, requested address and browser type to keep the Service secure and fix errors. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). These logs are rotated daily and deleted after 14 days.

E-mails you send us. Your message and address, used to answer you and kept as long as needed for that. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Statistics. We use Yandex Metrica to count visits and see which pages and tools are used: pages opened, referring site, device and browser type, approximate region, and tool events (tool, language, file format, success or error). File names and file contents are never sent, and the tool area of every page is masked from recordings. Legal basis: legitimate interest in running and improving the Service (Art. 6(1)(f) GDPR). Session recording (Webvisor) and click maps are switched on only after you click "Accept" in the cookie banner (Art. 6(1)(a) GDPR).

We also use Google Analytics 4 in Consent Mode: until you click "Accept" it sets no cookies and receives only cookieless signals; after you accept it measures visits with cookies (Art. 6(1)(a) GDPR). You can change your choice at any time with "Cookie settings" at the bottom of every page.

Protection against bots. The sign-up, sign-in and password reset forms use Google reCAPTCHA to tell people from bots. reCAPTCHA collects information about your device and browser and sends it to Google for analysis; the Google Privacy Policy and Terms of Service apply. Signed-in users do not see it. Legal basis: legitimate interest in protecting accounts (Art. 6(1)(f) GDPR).

Advertising (only if enabled). We may show ads through Google AdSense. In the EEA, the UK and Switzerland, cookies for ads are used only after you consent through our consent banner; without consent Google may show non-personalised ads. Your files and account data are never shared with advertisers. Learn more at How Google uses information from sites that use its services and manage ad preferences at Google Ad Settings.

3. Cookies

Cookie	Purpose	Type	Duration
csrftoken	protects forms and uploads against forged requests	necessary	1 year
sessionid	keeps you signed in (only if you log in)	necessary	2 weeks
ieo_anon	random ID linking a guest to their own server jobs, so nobody else can download the results	necessary	30 days
ieo_consent	remembers your cookie choice	necessary	1 year
Google reCAPTCHA (_GRECAPTCHA)	protection against bots on account forms	necessary	6 months
Yandex Metrica (_ym_uid, _ym_d, _ym_isad and similar)	visit statistics	statistics	up to 1 year
Google Analytics (_ga, _ga_*)	visit statistics	only with consent	up to 2 years
Google AdSense cookies	advertising	only with consent, if enabled	set by Google

Necessary cookies do not require consent. You can delete cookies in your browser settings; without necessary cookies, signing in and server tools will not work.

4. Who receives data

• Hosting provider — our servers are rented from a VPS provider and located in Kazakhstan.
• Unisender Go — delivery of service e-mails.
• Yandex — visit statistics (Yandex Metrica).
• Google — Google Analytics (cookies only with your consent), reCAPTCHA on account forms, and advertising if it is enabled and you consent.
• Authorities — only where we are legally obliged.

We do not sell personal data and do not pass your files to anyone. If the Service is transferred to a successor, the data necessary to continue it will be transferred as well.

5. International transfers

Our servers are located outside the European Economic Area, in Kazakhstan. When you use a server tool or create an account, your data is transferred there because this is necessary to provide the service you request. Google may process data in the United States under the EU-US Data Privacy Framework and standard contractual clauses. Yandex Metrica data is processed by Yandex in Russia and Finland.

6. Security

Connections are encrypted (HTTPS), passwords are hashed, forms are protected against forged requests, job links are random and work only for their owner, and files are deleted automatically. Browser tools keep your files on your device by design. No system is perfectly secure, but we work to protect your data.

7. Your rights

You can request access to your data, its correction or deletion, restriction of processing, data portability, and object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. Write to info@imgeditoronline.com — from your account e-mail if the request concerns an account — so that we can verify it is you. You also have the right to complain to a data protection authority in your country. We do not make automated decisions that have legal or similar effects on you.

8. US residents

We do not sell personal data. If advertising cookies are enabled, this may count as "sharing" under some US state laws; you can refuse or withdraw consent in the consent banner, and we honour the Global Privacy Control signal.

9. Children

The Service is not directed at children under 16. We do not knowingly collect their personal data; if you believe a child has created an account, contact us and we will delete it. The tools can be used without an account and without giving any personal data.

10. Changes

We may update this policy. The date of the last update is shown on this page; for significant changes we will inform registered users in advance.