Privacy Policy

Controller and contact

The controller of your personal data is Pragmaq sp. z o.o., PRAGMAQ spółka z ograniczoną odpowiedzialnością, with its registered office at Jana Pawła II 10, 05-500 Piaseczno, Poland, KRS 0000360426, NIP 1231219561, REGON 142486202.

You can contact us about privacy matters at [email protected]. We have not appointed a data protection officer.

Summary

Removo is designed to process images temporarily. In normal operation, uploaded images are processed in server memory only, are not saved to disk, are not stored as account history, and are not used to train AI models.

We do not use advertising cookies, marketing trackers, analytics tools, session replay tools, or third-party advertising pixels.

We collect only the data needed to run the web app, authenticate users, enforce usage limits, process subscriptions, prevent abuse, and comply with legal obligations.

Anonymous use

You can use parts of the service without signing in. For anonymous use, we use your IP address in server memory to apply daily limits and protect the service from abuse.

Anonymous IP limit data is kept in memory for about 24 hours and is not stored in our database as part of normal operation.

We may also use a functional browser cookie or similar local identifier to enforce stricter free usage limits. This type of cookie is used for service functionality and abuse prevention, not advertising.

Google Sign-In and Google user data

When you choose to sign in with Google, Removo uses Google OAuth and Google Sign-In only to authenticate you and create or access your Removo account.

We do not request access to your Google Drive, Gmail, Calendar, Contacts, Google Photos library, files, documents, messages, or other Google account content. We do not receive your Google password.

Removo's use and transfer of information received from Google APIs to any other app or service will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Billing data

Payments and subscriptions are handled by Stripe. We do not store full payment card numbers and do not process card details directly in our app.

We store billing metadata needed to operate Pro subscriptions, such as Stripe customer ID, subscription ID, subscription status, current billing period, cancellation state, and relevant Stripe event data.

Stripe may send payment receipts, billing notices, payment failure notices, or other transactional payment emails according to your Stripe checkout and billing settings.

Image processing

When you upload an image or submit an image URL, the image is sent to our backend for processing. The image is held in RAM only for the time needed to process the request and return the result to your browser.

We do not intentionally save uploaded images, generated outputs, original file names, or visual image contents to disk. We do not keep a processing history of your images.

The processed output is returned to your browser. After that point, the output may remain available locally in your browser session until you close, refresh, clear, or replace it.

Our AI models run locally on our infrastructure. We do not send uploaded images to external AI model providers for processing.

No AI training

We do not use your uploaded images, submitted URLs, generated outputs, or account content to train AI models.

We do not build datasets from user uploads and we do not sell or share user uploads for training, advertising, or profiling.

Usage limits, retry tokens, and logs

To enforce limits and prevent abuse, we may temporarily process counters linked to an account, IP address, browser cookie, image hash, retry token, internal user ID, or selected processing model.

For retries, we may temporarily use an image hash and a list of models already used for that image so the same image cannot be retried abusively. Retry data normally lives for about 2 hours and cleanup may run periodically, for example every 6 hours.

Backend process output may include technical information such as IP-related processing events, approximate uploaded byte size, routed model, internal IDs, request status, and errors. These logs are used for operations and debugging and are not intentionally written to permanent log files in normal operation.

We do not intentionally log image contents, original file names, Google profile data, or full payment card data in processing logs.

Cookies and local storage

We use only cookies, local storage, or similar technologies needed for service functionality, authentication, session security, billing sync, app state, and usage limits.

The backend uses a signed and encrypted session cookie to keep you signed in. The frontend may use local storage for authentication state and billing sync state.

We do not currently use analytics cookies, advertising cookies, social media tracking cookies, or marketing pixels. If we add non-essential cookies in the future, we will update this policy and request consent where required.

Purposes and legal bases

We process account, image, usage, and billing data to provide the service and perform our agreement with you.

We process payment and accounting information to manage subscriptions, comply with legal and tax obligations, and handle disputes or chargebacks.

We process IP addresses, usage counters, cookies, retry tokens, image hashes, internal IDs, and technical logs based on our legitimate interest in securing the service, enforcing fair use, preventing abuse, detecting fraud, and maintaining reliability.

Where we rely on consent, such as for optional future analytics or marketing, you may withdraw that consent at any time.

Service providers and recipients

We use service providers that help operate the service, including hosting and infrastructure providers, Cloudflare for protection and proxying, Google for sign-in, and Stripe for payments and subscriptions.

These providers may process technical metadata such as IP addresses, request metadata, authentication data, payment metadata, and billing identifiers as needed to provide their services.

We may disclose information if required by law, to protect rights and safety, to investigate abuse, to handle disputes, or as part of a business transfer. We do not sell personal data.

International transfers

Our service is operated from the European Union where possible, but some providers, including Google, Stripe, and Cloudflare, may process data in or from countries outside the European Economic Area.

Where required, such transfers rely on appropriate safeguards, such as adequacy decisions, standard contractual clauses, provider transfer mechanisms, or other lawful transfer tools.

Retention

Uploaded images and generated outputs are not intentionally stored by us after processing in normal operation.

Anonymous IP usage counters are kept in memory for about 24 hours. Retry token data normally lives for about 2 hours, with periodic cleanup that may run less frequently.

Account data is kept while your account exists. If you want to delete your account, contact us at the email address above.

Billing metadata is kept for as long as needed to manage your subscription, resolve disputes, comply with accounting and tax obligations, and maintain legally required records. Stripe may retain payment data according to its own legal and operational requirements.

Technical logs are kept only as long as needed for operations, security, debugging, and legal protection, unless a longer period is required for a specific incident or legal obligation.

Your rights

Depending on your location and applicable law, you may have the right to access, correct, delete, restrict, object to processing of, or receive a copy of your personal data.

You may also have the right to withdraw consent where processing is based on consent and the right to lodge a complaint with a data protection authority. In Poland, the competent authority is the President of the Personal Data Protection Office.

To exercise your rights, contact us at [email protected]. We may need to verify your identity before fulfilling a request.

Children and sensitive data

The service is not directed to children. If you are under the age required by your local law to use online services or consent to personal data processing, you may use the service only with involvement and consent of a parent or legal guardian.

Do not upload images containing sensitive personal data, special category data, or data about other people unless you have a lawful basis and all required permissions.

Images can reveal information about faces, health, location, documents, or private life. We do not use images to identify people, but you are responsible for deciding whether an image is appropriate and lawful to upload.

Security

We use reasonable technical and organizational safeguards, including signed and encrypted session cookies and encryption for selected stored account data. No online service can guarantee perfect security.

If you believe your account or data has been compromised, contact us at the email address above.

Changes to this policy

We may update this policy as the service changes. The effective date above shows when it was last updated.

If we add analytics, marketing communications, additional cookies, external AI providers, image storage, or model training based on user uploads, we will update this policy and request consent where required by law.

Contact

For privacy questions or requests, contact Pragmaq sp. z o.o. at [email protected].