Privacy policy

Service provider and contact details

Service provider and personal data controller: ProductShot Team. Email: info@productshot.tech.

Who this policy applies to

This policy applies to visitors, guests, account holders and people requesting support on the Product Shot website. It explains what data we receive directly from you or through your use of the website and why we process it.

Data required for accounts and photo processing is necessary to provide the requested feature. Without it, you cannot use that feature. Refusing optional analytics does not prevent you from using the service. Reading this policy does not constitute consent to analytics or advertising.

What data we process and why

We use data for the purposes listed below. A pseudonymous identifier or hash may be personal data; we do not consider it inherently anonymous.

Paskyros valdymas ir prašomas nuotraukų apdorojimas grindžiami sutarties vykdymu. Proporcingas saugumas, kvotų kontrolė ir minimali paslaugos veikimo suvestinė grindžiami teisėtu interesu apsaugoti paslaugą ir vertinti jos veikimą. Pasirenkama lankomumo analitika grindžiama atskiru atšaukiamu sutikimu.

Account and sign-in. Data: Email, hashed password, verification status, registration and sign-in times, and the accepted version of the terms. Legal basis: Entering into and performing a contract (GDPR Article 6(1)(b)).

Photo preparation. Data: The uploaded photo, its name, file size and checksum, processing options, results and job status. Legal basis: Providing the service you requested (GDPR Article 6(1)(b)).

Security and usage limits. Data: Technical account or guest identifier, IP address hash, request times and counts, and error and security events. Legal basis: Legitimate interest in protecting the service and its users and preventing abuse (GDPR Article 6(1)(f)).

Service usage summary. Data: View totals, registration, processing, download and credit pack selection events, timestamps, and a pseudonymous technical profile identifier. Legal basis: Legitimate interest in assessing service operation and fixing issues (GDPR Article 6(1)(f)).

Optional traffic analytics. Data: HMAC hashes of a random browser identifier and IP address, first and last visit dates, and daily page view counts. Legal basis: Your consent (GDPR Article 6(1)(a)).

Support and your requests. Data: The contact details you provide, correspondence and information needed to handle your request. Legal basis: Performance of a contract, legitimate interest in responding to an enquiry, or a legal obligation to fulfil data subject rights, depending on the request.

Your photos and AI processing

Photos are processed by an AI model running on the service's server. Uploaded photos and results are not used for model training or automatically made public. File access is checked against the uploading account or guest session.

Upload only photos you have the right to use. Do not upload identity documents, health information or other sensitive data that the service does not need. If other people appear in a photo, ensure you have an appropriate basis to use their likeness.

Background removal and technical request limiting are automatic. We do not carry out profiling or automated decisions producing legal or similarly significant effects. You can contact support if a limit was applied incorrectly.

Usage summary and optional analytics

The service usage summary counts views, registrations, processing jobs, downloads and selected credit packs. Repeated account or guest actions are distinguished using a pseudonymous technical profile identifier protected by a server key. This summary does not use an analytics cookie or IP address. Administrator usage is excluded from public usage metrics.

When you select a credit pack, we may store the pack, the displayed price, the time and your account if signed in. Selecting a pack is not itself a purchase. We link repeated anonymous selections to an analytics browser identifier only with consent.

Optional traffic analytics is enabled only after explicit consent. It uses our pk_visitor cookie and HMAC hashes of the browser identifier and IP address stored on our server. These analytics records do not store the IP address itself, browser description, referral source or URL query parameters. One browser or IP address does not necessarily correspond to one person.

We do not send analytics data to external advertising or analytics systems. Registration does not provide consent to marketing emails; we do not send newsletters. Legitimate interest in a minimal usage summary and security does not justify enabling optional browser tracking without consent.

Cookies and their settings

Cookies are small records stored in your browser. Essential cookies support the features you request and save your preferences; we do not request separate consent for them. The analytics cookie is optional and is not enabled in advance. All cookies listed here belong to this website.

Use “Essential only” to decline optional analytics. Use “Cookie settings” in the website footer or this section to review your choices and withdraw consent at any time. Withdrawal deletes pk_visitor and stops collecting new optional analytics records. Previously collected lawful records remain subject to their retention period; withdrawal does not affect the lawfulness of processing before withdrawal.

Your choice applies to the particular browser and device. You can also delete or block cookies in your browser settings. Blocking essential cookies may prevent sign-in, file access or forms from working. Closing the notice or continuing to browse is not consent.

To retry an interrupted upload safely, the website may temporarily save a technical request identifier and a hash of the request data in browser sessionStorage. These records prevent duplication of the same job and are not used for analytics; photo content and file names are not stored there. Completed request records are removed; other records disappear when the browser tab closes. Records older than 7 days are discarded the next time storage is used.

sessionid. Category: Essential. Purpose: Maintains your sign-in or guest session and provides access to your photos. Created when a session is needed. Expiry: Up to 1 d.

csrftoken. Category: Essential. Purpose: Protects forms and other requests that change data against forged actions. Expiry: Up to 364 d.

pk_consent. Category: Essential. Purpose: Remembers your cookie choice and its version. It is not used to track visits. Expiry: Up to 180 d.

django_language. Category: Essential. Purpose: Remembers your preferred interface language. It is not used for analytics or advertising. Expiry: Up to 365 d.

messages. Category: Essential. Purpose: Temporarily carries action confirmations and error messages, for example after signing in. Removed after the message has been read. Expiry: Until the message is shown or the browser is closed.

pk_visitor. Category: Analytics · only with consent. Purpose: Distinguishes browsers in internal traffic analytics only with your consent. Uses a random identifier. Expiry: Up to 90 d.

Cookie settings

How long we retain data

We apply different retention periods to files, accounts, technical records and analytics. Deleting photo files and removing technical database history are separate actions.

Nuotraukų failams taikomas svetainėje nurodytas iki 7 dienų terminas, detaliai statistikai – iki 90 dienų. Paskyros kontaktai saugomi, kol naudojama paskyra; ją uždarius jie pašalinami, jei nėra atskiro teisėto saugojimo pagrindo. Techninė darbų ir kreditų istorija tvarkoma atskirai nuo failų. Atsarginės kopijos naudojamos atkūrimui; jų saugojimas ribojamas atkūrimo poreikiu, o atkuriant iš naujo taikomi duomenų ištrynimo prašymai.

Photo and result files. Up to 7 days after upload, or less if you delete them yourself. Access closes when this period expires; files in active processing are physically removed safely after processing ends.

Account details. While you use your account. Closing it removes access; contact details are removed when there are no payments or accounting obligations. Technical account and credit history is managed separately from photo files.

Unregistered guest profile. Removed 8 days after creation once jobs have finished and their files have been deleted. If converted into a registered account, the account retention rules apply.

Rate limit records. Up to 2 days; periodic cleanup removes older request counters.

Service usage events and daily analytics. Up to 90 days. IP and browser hashes and their first and last visit dates are retained for up to 90 days after the last visit.

Job and credit history. Expiry of a file's storage period does not itself delete the job's database record or credit history. These records are needed to maintain credit balances, refund failed jobs, control repeated requests and handle enquiries. You may contact the data controller to request the removal of records associated with you.

Support correspondence. Until the enquiry is resolved and for as long as needed to substantiate its outcome or address a specific legal claim. Evidence of fulfilling data subject requests is retained separately from photo files.

Backups. If backups are made, deleted data may temporarily remain in a restricted-access backup until it is replaced or removed under the applicable backup retention cycle. Backups are used only for recovery; deletion decisions must be reapplied after restoration. Contact the data controller for the specific retention periods of the backups in use.

Who may access data

Only authorised service administrators can access data, to the extent needed for maintenance, security or handling your enquiry. We may use providers of server and data storage, email delivery and backup infrastructure. They receive only necessary access and are subject to confidentiality and data processing obligations.

We may disclose data to authorities where required by law or a lawful request, and as necessary to establish, exercise or defend a specific legal claim. We do not sell personal data or provide photos to advertising networks.

Duomenų gavėjų kategorijos: serverio ir duomenų saugojimo infrastruktūros, paskyros pranešimų siuntimo ir atsarginių kopijų infrastruktūros teikėjai. Prieiga suteikiama tik paslaugai atlikti reikalinga apimtimi. Nuotraukos apdorojamos paslaugos serveryje, išorinei DI ar reklamos sistemai nesiunčiamos. Konkrečių gavėjų ir tvarkymo vietų informaciją duomenų valdytojas teikia nurodytu kontaktu.

Transfers outside the EEA

Data location depends on the infrastructure used for the service. If a provider transfers personal data outside the European Economic Area, the transfer takes place only on an appropriate basis under GDPR Chapter V, such as a European Commission adequacy decision or standard contractual clauses and, where required, additional safeguards.

You can request information about the recipients, processing locations and transfer safeguards applicable to your data by emailing info@productshot.tech.

How we protect data

We store passwords using one-way hashing. Photo files are not published as public resources; access rights are checked before a file is delivered. We use request limits, form protection and account access controls. Public connections to the service are encrypted using HTTPS.

Absolute security of data transmission or storage cannot be guaranteed. Protect your password, use a trusted device and contact us if you notice a possible access breach. If a breach poses a high risk to your rights, you will be notified as required by law.

Your rights and how to exercise them

For enquiries about your data, email info@productshot.tech. You may request access and a copy, correction of inaccurate data, deletion, restriction of processing and, where applicable, portability. You may object to processing based on legitimate interest for reasons related to your situation and withdraw consent at any time.

Requests are usually handled free of charge. We verify identity proportionately. We respond within one month of receipt; the complexity or number of requests may justify an extension of two further months, with reasons provided within the first month. Rights apply under GDPR conditions; deletion does not cover data that must be retained for a legal obligation or substantiated legal claim.

If you disagree with data processing, you may contact the Lithuanian State Data Protection Inspectorate or the supervisory authority where you normally live or work. Contacting us first is not a prerequisite for a complaint.

Policy updates

The current revision date appears at the top of this page. We communicate material processing changes on the website or through available account contact details. A new purpose requiring consent is not introduced merely by changing this policy's wording.