Privacy Policy

The data controller is MYGDA OÜ, registered in Estonia. For anything privacy-related, contact therightpicai@gmail.com.

Account data: email address, password hash (or your Google account identifier if you sign in with Google).

Photos: selfies you save to your profile, photos you upload for enhancement, and the images you generate. Photos contain biometric-adjacent data (your face); we process them only to provide the service you request, based on your consent given at upload.

Billing data: subscription status, credit balance, and payment records. Card details are handled by Stripe, not us.

Full-resolution photos uploaded to the Enhancer are deleted promptly after processing. We retain a compressed preview so you can compare the before and after result in your account. Profile selfies, compressed before previews, and generated images are stored until you delete them or your account. Your photos are never used to train AI models and are never shared publicly unless you explicitly create a share link for a generation or custom scene. Share links are permanent once created and may be opened by anyone who has the URL.

We use a small set of processors to run the service:

Supabase (database, auth, and storage — hosted in the EU, eu-central-1) · Stripe (payments) · Replicate (AI image processing) · Vercel (hosting) · Google (optional sign-in).

Photo processing by our AI provider may occur outside the EU; it is covered by standard contractual clauses and images are not retained after processing.

You can access, correct, export, or delete your data, withdraw consent, or object to processing at any time. Profile selfies can be removed in the app; email us to delete generations or your full account. You also have the right to lodge a complaint with a supervisory authority; in Estonia that is the Andmekaitse Inspektsioon (AKI).

We keep account and billing records as long as your account exists, plus what accounting law requires. We use only the cookies needed to keep you signed in — no advertising or cross-site tracking cookies.

We record first-party product events when a share link is created, copied, or opened. These events help us understand whether sharing works; they are not used for advertising or cross-site tracking.

See also our Terms of Service.