Privacy Policy

The data controller is Song Zhijun. For any privacy question or request, contact [email protected]. A data protection officer is not appointed, because we do not carry out the large-scale or special-category processing that would require one.

We collect the following categories of personal data. For each, we rely on the legal basis noted, as required by the UK/EU GDPR:

• Account data — your email address and a hashed password, or a basic profile (including a profile image URL) supplied by Google if you sign in with Google. Basis: performance of our contract with you.
• Images you trace — the image you submit. The hosted app posts it to our server (api.pic2svg.com) to trace it with our own engine. Basis: performance of our contract with you.
• Payment data — the amount, status and an order identifier for your subscription, and the email associated with the purchase. Full card numbers never reach our servers; they are handled entirely by the payment processor. Basis: performance of our contract and our legal obligations.
• Usage and technical data — such as IP address, browser and device type, and error and request logs, kept to operate and secure the Service. Basis: our legitimate interests in running a secure, working service.
• Communications — messages you send to our support address, and our replies. Basis: performance of our contract and our legitimate interests in supporting customers.

To trace an image we write it to a temporary file on our server, run our own deterministic engine on it, and delete that temporary file when the trace finishes. We do not store your traced images in the application database, and we do not send them to any third-party AI or cloud vectorizer. If a trace fails partway, the temporary file can remain in the server's temporary directory until that directory is cleared; it is not copied anywhere else and is not backed up.

A copy of the images you add, and of their traced output, is also kept in your own browser (in IndexedDB) so that a reload does not lose your work. That browser copy is local to your device and is removed when you clear that work or your browser storage; you can delete it at any time by clearing site data for this domain.

There is one exception you should know about. If you create a share link, the traced vector — and, for the link preview, a small JPEG version of your source image — is stored on our server so that anyone you give the link to can open it. A share link stays available until it is removed, and removing it currently requires you to ask us (see section 7). Do not create a share link for an image you are not comfortable keeping on our server.

We use a small number of service providers (sub-processors) to run the Service. They process data only on our instructions, in these categories:

• Hosting and compute, for the application and the tracing engine.
• Content delivery, DNS and network security.
• Transactional email, for verification and password-reset messages.
• Payments, tax and merchant-of-record services, provided by Waffo Pancake.
• Third-party sign-in, if you choose to sign in with Google.
• Managed PostgreSQL database hosting for the application data described above.

Some of our providers are based in the United States or store data there. Where personal data is transferred out of the UK/EEA, we rely on the UK and EU adequacy decisions for the United States (including the EU-US Data Privacy Framework where the provider is certified), or on standard contractual clauses with the provider.

Account data is kept while your account is open and for a short period afterwards so you can recover it. Payment and billing records are kept for as long as tax and accounting law requires. Server logs are kept for a short, rolling period. Temporary trace files are deleted when the trace finishes, and any left behind by a failed trace persist only until the server's temporary directory is cleared (see the note in section 3). Trace results that you turned into share links are kept until the link is removed.

Under the GDPR you have the right to access your data, to correct it, to erase it, to restrict or object to certain processing, to data portability, and not to be subject to purely automated decisions that significantly affect you. You also have the right to complain to your local data protection authority.

To exercise any of these — including asking us to delete your account or a share link — email [email protected]. We will respond within the time the law allows (normally one month). Because deleting your account or a share link is completed by our team on request rather than by a self-service control today, please allow us a reasonable period to carry it out.

We do not use advertising or analytics cookies, and we do not sell your personal information. We use a small amount of browser storage that is strictly necessary for the Service to work: a session token kept in local storage that keeps you signed in, session storage used to return you to the page you were on, and an IndexedDB record that preserves in-progress work so a reload does not lose your images. Because these are strictly necessary, no consent banner is shown.

The Service is not directed to children, and you must be at least 18 years old — or the age of majority where you live, if that is higher — to create an account, use the Service or subscribe.

We will post any change to this policy here with an updated date. For anything about this policy, email [email protected].