Privacy Policy

This policy explains what personal data Retouchly collects, why, how long we keep it and what rights you have. It applies to everyone who uses the service.

Who is responsible for your data

The data controller is Zijlstra.tech, Archipelweg 111 D, Leeuwarden, the Netherlands (KvK 82728143). You can reach us about privacy at info@zijlstra.tech.

What we collect and why

• Your photos and the edited results. The photo you upload (and any reference photo) is sent to our AI provider to make the edit you ask for. We don’t keep your uploads. The full-quality result is stored for 24 hours so you can unlock and download it, then deleted automatically.
• Your email address, if you sign in. We use it to send you sign-in links and to link your credits and purchases to your account. Sign-in links work once and expire after 15 minutes.
• Usage records. For every preview we record your account or an anonymous device ID, your IP address and the time. We use this only to apply the daily free-preview limits and to prevent abuse, and delete it after 24 hours.
• Purchase records. When you buy credits, Stripe handles the payment. We receive and keep the amount, the number of credits and Stripe’s reference, never your card details.

Cookies

We only use cookies that the service needs to work: one that keeps you signed in (30 days) and one anonymous device ID that applies the free-preview limit when you aren’t signed in (1 year). We don’t use analytics, advertising or tracking cookies.

Faces in your photos

Many photos show people. We process them only to make the edit you request. We don’t use faces to identify anyone, don’t create face-recognition templates, don’t sell images and don’t use your photos to train AI models.

Legal bases

• Performance of a contract: making the edits you ask for, your account and the credits you buy.
• Legitimate interests: applying the free limits, keeping the service secure and preventing abuse.
• Legal obligation: keeping purchase records for tax and accounting purposes.

How long we keep it

• Uploaded photos: not stored; they are only sent to our AI provider for the edit.
• Edited results: 24 hours, then deleted automatically.
• Usage records: 24 hours.
• Your account and email address: until you ask us to delete them.
• Purchase records: 7 years, as required by Dutch tax law.

Who processes data for us

• Cloudflare — hosting, database, temporary storage of results and sending sign-in emails.
• OpenAI — the AI that edits your photos. Under its API terms, images sent for processing are not used to train its models.
• Stripe — payment processing.

We don’t sell your personal data or share it for advertising.

International transfers

Cloudflare, OpenAI and Stripe are based in the United States and may process data outside the EU. Where required, these transfers rely on appropriate safeguards such as the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

Your rights

You have the right to access, correct, delete or export your data, to restrict or object to its processing, and to ask us to delete your account. Email info@zijlstra.tech and we will respond within a month. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.

Children

Retouchly is for adults: you must be at least 18 to use it (see our Terms). If you believe a minor has used the service, contact us and we will delete their data.

Security

Data is encrypted in transit and at rest by our hosting provider. Sign-in links and sessions are stored only as one-way hashes, so they can’t be reused if our database were ever exposed.

Changes

We will update this policy as the service evolves and change the “Last updated” date above.