1. Who we are
This Privacy Policy describes how Imazho (“Imazho,” “we,” “us,” or “our”) processes personal information in connection with the imazho.com website and the Imazho applications and services (together, the “Service”). For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), Imazho is the data controller of the limited personal data described below.
[Before launch, insert your registered legal entity name, company number, and registered address here.]
2. The short version
- Your stored originals are end-to-end encrypted and we cannot decrypt them. Optional AI analysis is a separate consented exception.
- We collect the minimum needed to run your account, billing, and the website.
- We do not sell or “share” your personal information, and we do not show ads.
- We use a small number of trusted processors (hosting, payments, email) under contract.
- You can access, export, correct, or delete your data at any time.
3. Information we process
3.1 Information you provide
- Account data: name (optional), email address, and authentication credentials (password hashes, passkeys, or third-party sign-in identifiers).
- Encrypted content: your original photos and videos are encrypted on your device. We store their ciphertext and cannot decrypt it.
- Optional AI analysis data: if you enable AI, we receive an unencrypted low-resolution thumbnail or video sample plus generated tags, face embeddings, captions, and related metadata. You can purge this data without deleting your encrypted originals.
- Payment data: processed by Polar as our Merchant of Record. We receive the customer, order, subscription, plan, and tax status needed to provide access, but never handle full card numbers.
- Support communications: messages you send us and their contents.
3.2 Information collected automatically
- Device & usage data: IP address, device/browser type, operating system, app version, timestamps, and basic feature/usage events used to operate and secure the Service.
- Storage metadata: file sizes, counts, and encrypted-object identifiers needed to manage your quota and sync.
- Cookies / local storage: see Section 6.
3.3 Information we do NOT have
We do not have access to your encryption keys or passphrase and cannot decrypt stored originals. If you enable optional cloud AI, we can process the separate low-resolution analysis copy described above; see Section 10. If you lose your passphrase and recovery key, we cannot recover your content.
4. How we use information & legal bases (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Provide, maintain, and secure your account and the Service | Performance of a contract |
| Process payments and manage subscriptions/trials | Performance of a contract; legal obligation (tax/accounting) |
| Prevent fraud, abuse, and ensure security (incl. CAPTCHA) | Legitimate interests |
| Respond to support requests | Performance of a contract; legitimate interests |
| Product analytics & improvement (privacy-preserving) | Legitimate interests; consent where required |
| Send service/transactional emails | Performance of a contract |
| Send marketing emails (if any) | Consent (withdraw anytime) |
| Comply with law and enforce our Terms | Legal obligation; legitimate interests |
5. Cookies & similar technologies
We use strictly necessary cookies/local storage to keep you signed in and to secure the Service. Where required by law (e.g., EU/UK ePrivacy, California), we request consent before setting any non-essential (analytics) cookies and provide controls to change your choices. We honor Global Privacy Control (GPC) signals where applicable.
6. How we share information
We do not sell your personal information. We share limited data only with:
- Service providers / sub-processors who process data on our behalf under contract, including cloud hosting & encrypted object storage, our payments provider, transactional email, and bot/abuse protection.
- Legal & safety: when required by valid legal process, or to protect rights, safety, and security. Because content is encrypted, we can only ever produce the limited account/metadata we hold.
- Business transfers: in connection with a merger, acquisition, or asset sale, subject to this policy.
[Maintain a current sub-processor list and link it here / in your DPA.]
7. International data transfers
We may process information in countries other than your own. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum) or an adequacy decision.
8. Data retention
We keep account and billing data for as long as your account is active and as needed to comply with legal, tax, and accounting obligations. When you delete your account, we delete or irreversibly anonymize your data within a commercially reasonable period (typically within 30 days), except where retention is legally required. Encrypted content is deleted from active systems and purged from backups on a rolling schedule.
9. Security
We protect your data with end-to-end encryption, encryption in transit (TLS) and at rest, access controls, and the principle of least privilege. No method of transmission or storage is 100% secure, but our encrypted originals remain unreadable without your key. Optional AI analysis copies and generated metadata are not covered by that zero-knowledge guarantee. Report vulnerabilities to support@imazho.com.
10. AI & automated processing
Imazho offers optional AI features such as search, tagging, and people grouping. When enabled, the client creates an unencrypted low-resolution analysis copy and sends it for cloud processing. Analysis assets and generated metadata are retained until you use the AI purge control or delete the account. Encrypted originals are not sent to the AI provider. We do not use your private content to train third-party models and do not make legal or similarly significant decisions about you solely by automated means.
11. Your privacy rights
11.1 EEA, UK & Switzerland (GDPR)
You have the right to access, rectify, erase, restrict, and port your data, to object to processing, and to withdraw consent. You may lodge a complaint with your local supervisory authority. To exercise rights, contact privacy@imazho.com.
11.2 California (CCPA/CPRA)
California residents have the right to know, access, delete, and correct personal information, and to opt out of “sale” or “sharing” and limit use of sensitive personal information. We do not sell or share personal information as those terms are defined under the CPRA, and we do not knowingly process the sensitive personal information of consumers for purposes requiring an opt-out. We will not discriminate against you for exercising your rights.
11.3 Other regions
We honor data-protection rights under other applicable laws, including Canada (PIPEDA), Brazil (LGPD), Australia (Privacy Act / APPs), and other U.S. state privacy laws (e.g., Virginia, Colorado, Connecticut, Utah, Texas). Contact us to exercise any rights available to you.
We respond to verifiable requests within the timeframes required by applicable law (generally 30–45 days).
12. Children
The Service is not directed to children under 16 (or the minimum age in your jurisdiction), and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.
13. Contact us & representatives
Privacy questions or requests: privacy@imazho.com. General support: support@imazho.com.
[Appoint and list your Data Protection Officer (if required) and your EU and UK Article 27 representatives, with addresses, before launch.]
14. Changes to this policy
We may update this policy from time to time. We will post the new version here with an updated date and, for material changes, provide additional notice (e.g., by email or in-app).