Privacy policy

Your photos stay on your computer

OpenRetouch runs its AI models on your own computer. Photoshop talks to the local OpenRetouch service over your machine's loopback connection only. Image data is kept in memory while a tool runs and discarded afterwards. We never receive your photos.

The plugin and service send no usage data, analytics or crash reports. The Free plan works without any personal data at all.

About once a day the engine checks for a new version by downloading a small version file from our licence server. The request carries no account, device or version information; like any web request it reveals your IP address, which appears in our security logs. You can turn the check off (OPENRETOUCH_UPDATE_CHECK=0).

Who is responsible

The controller of your personal data is DataDine sp. z o.o., ul. Żabiniec 85/60, 31-215 Kraków, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0001062828, kept by the District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division of the National Court Register; NIP 9452280600, REGON 526637807, share capital PLN 5,000.00. Contact for all privacy matters: [email protected].

What we process, why, and on what legal basis

• Account and licence: your e-mail address, one-time sign-in codes (stored hashed), sessions, your plan, and for each activated computer a device name, operating system, app version, a device key and when it last checked in. Pro checks your subscription about once a day and sends only this device identifier and the app version. Basis: performing our contract with you (art. 6(1)(b) GDPR).
• Payments and invoices: Stripe processes your payment. We receive your Stripe customer and subscription status, billing country and address, a tax ID if you enter one, and invoices. Basis: contract (art. 6(1)(b)) and our legal obligations under tax and accounting law (art. 6(1)(c)).
• Support: what you write to us. Basis: contract, or our legitimate interest in answering your questions (art. 6(1)(f)).
• Waitlist: if you sign up, your e-mail address, the time, the page you signed up on and the consent text you saw, stored in our database at Cloudflare (EU region). We use it only to tell you about the launch and early-access offers. Basis: your consent (art. 6(1)(a)), which you can withdraw at any time by replying to any of our e-mails or writing to us.
• Security: IP addresses and request details (including update checks) in the logs of our licence server and website, kept for up to 30 days. Basis: our legitimate interest in keeping the services secure and preventing abuse of licences (art. 6(1)(f)).
• Claims: data needed to establish, exercise or defend legal claims. Basis: our legitimate interest (art. 6(1)(f)).

Giving your e-mail address is necessary to create an Account or subscribe; without it you can still use the Free plan.

This website

This website is hosted by Cloudflare, which processes your IP address to deliver pages and protect the site against attacks. We use no advertising or tracking cookies and no analytics. If you sign in on the account page, your browser stores a session token in local storage so you stay signed in; this is strictly necessary for the account page and is removed when you sign out.

Installing or updating AI models downloads them from the hosts listed in the installer. Like any download, those hosts see your IP address.

Who receives your data

We share data only with providers who help us run the services, under data processing agreements where required:

• Stripe (payments, subscriptions, invoices; for some purposes, such as fraud prevention, Stripe acts as an independent controller under its own privacy policy);
• Cloudflare, Inc. (website hosting, waitlist database, e-mail forwarding for our addresses, software downloads);
• the hosting provider of our licence server;
• Amazon Web Services (Amazon SES, EU region: sending our e-mails, including sign-in codes and replies from [email protected]);
• our accounting firm, and public authorities where the law requires it.

Some providers, such as Stripe and Cloudflare, may process data outside the European Economic Area, in particular in the United States. We rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses for such transfers.

How long we keep it

• Account and licence data: while your Account exists; deleted within 30 days after you close it (backups rotate within the same period).
• Invoices and accounting records: 5 years from the end of the calendar year in which the related tax payment deadline passed, as Polish tax law requires.
• Support messages: as long as needed to handle your request and possible claims, at most 3 years.
• Waitlist: until you unsubscribe or withdraw consent, and at the latest 6 months after launch unless you become a customer.
• Security logs: up to 30 days.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, to object to processing based on our legitimate interests, and to withdraw consent at any time without affecting earlier processing. Write to [email protected].

You can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or with the data protection authority of your EU country.

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

Changes

If we change how we process personal data, we update this page and, for significant changes, tell Account holders by e-mail.