Privacy Policy

The data controller is MYGDA OÜ, registered in Estonia. For anything privacy-related, contact therightpicai@gmail.com.

Account data: email address, password hash (or your Google account identifier if you sign in with Google).

Service emails: we use your email address to send account verification, security, billing, and other essential service messages. Our email providers process the message and delivery status. We do not send marketing emails without your prior consent.

Photos: the six reference photos in the identity pack you save to your profile, photos you upload for enhancement, and the images you generate. Photos contain biometric-adjacent data (your face); we process them only to provide the service you request, based on your consent given at upload.

Generation instructions: custom-recipe prompts and optional generation or edit instructions you submit. We use these to provide the requested result and retain them with your related account content.

Result feedback: the optional thumbs-up or thumbs-down rating you give a generated image. We retain it with the related generation and use it to understand and improve result quality.

Billing data: subscription status, credit balance, and payment records. Card details are handled by Stripe, not us.

Catalogue activity: what you type into the scenes or looks search box, the filters you apply, how far you scroll, which scene or look cards are displayed on your screen and their position in the grid, which items you open, and when you download a generated image.

Site usage and performance: pages visited, referring pages, approximate country or region, device, operating system and browser type, and measurements such as loading speed, responsiveness, and visual stability. Vercel Web Analytics and Speed Insights collect this information without analytics cookies and do not associate it with your IP address or a cross-site profile.

Bot protection: Cloudflare Turnstile processes browser, device, and network signals when you use an account form. We use this only to stop automated abuse and protect account and email services.

Full-resolution photos uploaded to the Enhancer are deleted promptly after processing. We retain a compressed preview so you can compare the before and after result in your account. Profile selfies, compressed before previews, and generated images are stored until you delete them or your account. Your photos are never used to train AI models and are never shared publicly unless you explicitly create a share link for a generation or custom scene. Share links remain available until the underlying item or account is deleted, and may be opened by anyone who has the URL.

We use a small set of processors to run the service:

Supabase (database, auth, and storage, hosted in the EU, eu-central-1) · Stripe (payments) · Replicate (AI image processing, using model vendors that include OpenAI and Google) · Vercel (hosting, cookieless web analytics, and performance monitoring) · Resend (service email delivery) · Google (optional sign-in) · Cloudflare (Turnstile bot protection) · Meta and TikTok (advertising measurement).

Photo processing by our AI provider may occur outside the EU; it is covered by standard contractual clauses and images are not retained after processing.

You can access, correct, export, or delete your data, withdraw consent, or object to processing at any time. Your identity pack can be replaced in the app, and you can permanently delete your full account and its generations from the Account page. You can also email us for help with removing photos or with a deletion or export request. You have the right to lodge a complaint with a supervisory authority; in Estonia that is the Andmekaitse Inspektsioon (AKI).

Deleting your account removes its content and our local account records, cancels any active subscription, and clears this browser's first-party analytics identifier. Stripe may retain transaction records where accounting, tax, fraud-prevention, or other law requires it. We use cookies to keep you signed in, first-party analytics cookies that give your browser a random identifier, and advertising cookies set by Meta and TikTok so we can measure which ads bring people to TheRightPic.

In the EEA, the UK, Switzerland, and Quebec, none of those analytics or advertising cookies are set until you accept them. Everywhere else they are set by default and you can turn them off at any time using the link below.

When you create an account or make a purchase, we send Meta a one-way encrypted (hashed) copy of your email address, your IP address, and your browser's user agent, so it can match the event to an ad you saw. We cannot read the hashed address back, and we do not send Meta your photos, your generated images, or anything you type into the site. We record the two-letter country your visit came from so we can see where our visitors are; we do not store your IP address in our own database.

The TikTok browser pixel sends page views, the page address and time, your IP address and browser user agent, TikTok advertising cookie identifiers, page metadata, button interactions, completed account registrations, checkout starts, and completed purchases with their product, value, and currency. For registration and purchase events, we send hashed copies of your email address and account identifier. Automatic advanced matching is also enabled in TikTok, so the pixel can detect contact or account details shown on the page or entered in forms, hash them in your browser, and send the hash to TikTok. We do not add your photos, generated image content, or generation instructions to TikTok event payloads.

Those identifiers let us measure how our own site is used: which scenes and looks are viewed, what you search for in the catalogue, when a share link is created or opened, when checkout begins. If you create an account, activity recorded before you signed up is linked to it. This is used only to improve TheRightPic. This first-party event data is stored in our Supabase database. Apart from the conversion events described above, we do not sell it or share it with an advertising network. Separately, Vercel processes anonymous, cookieless page-view and performance data as described above, which is never joined to your advertising or analytics identifier.

Email us to ask what we hold about you, or to have it deleted.

See also our Terms of Service.