Privacy Policy

We do not store your photograph. Analysis runs inside your browser. The one moment your image reaches our server, it is held in memory only for the seconds it takes to render your file, and is then discarded. It is never written to disk, never placed in a database, never backed up, and never used to train anything.

We have no user accounts, and we do not ask for your email address before you buy anything. The only place we ever ask for one is the feedback form, where it is optional and used solely to reply to you.

A photograph of your face is biometric data. Under the UK and EU GDPR it is “special category” data under Article 9, which requires your explicit consent before it is processed. That is why the tool asks you to tick a box before you can add a photo — the box is not pre-ticked, and you can use the site without ticking it.

Here is exactly what happens to an image you add:

• It is decoded in your browser. Face detection, background separation and every measurement in the free check run on your own device. During the free check the image does not leave your computer at all.
• If you choose to generate a photo, the background-removed version is sent to our server over HTTPS. Our server renders your photo, the printable sheet and the certificate, returns them, and releases the memory. Nothing is persisted.
• If you buy, the same thing happens once more to produce the clean, unwatermarked file. We hold no copy afterwards, which is also why we cannot re-send a file later — we genuinely do not have it.

We also strip metadata. Camera photographs frequently carry GPS coordinates, a device serial number and a timestamp. None of that survives into the file you download.

• Payment details, handled entirely by Stripe. We never see or store your card number. Stripe processes your payment as an independent controller under its own privacy policy.
• Your email address, only if you give it to Stripe at checkout so they can send your receipt. It reaches us only if you email us.
• Aggregate, non-identifying usage counts — how many people used a country page, how many checks passed. No cookies are used for this and no individual is profiled.
• Standard server logs containing IP addresses, kept briefly for security and abuse prevention.

If you use the feedback form, we store what you wrote, the category you chose, which document you were working on, and how far through the tool you had got. If you enter an email address — which is optional, and only asked for so we can reply — we store that too.

We do not attach your photograph, the cut-out of you, or any measurement taken from your face to a feedback message. Nor do we store your IP address or browser details against it. The feedback form does not record audio: a voice recording can itself be biometric data, and that would contradict everything above.

Feedback is kept until it has been acted on. You can ask us to delete yours at any time — see “Your rights” below.

We use no advertising cookies, no analytics cookies and no third-party trackers. The site sets two strictly necessary cookies, both httpOnly and short-lived:

• An order cookie set when you begin checkout, so we can confirm the completed purchase belongs to your browser and not to someone who guessed a session identifier.
• A download cookie holding your purchase entitlement, valid for 30 minutes.

Both are removed when your download completes. Neither can be read by JavaScript, and neither tracks you across sites.

Stripe, for payment processing. Our hosting provider, which runs the server that renders your photo in memory. Nobody else. We do not sell data, and there is nothing here that could be sold.

Under GDPR and similar laws you may request access to, correction of, or deletion of your personal data, object to processing, and withdraw consent at any time.

In practice, because we retain no photographs and hold no accounts, there is usually nothing to return or erase. The two exceptions are feedback you chose to send us, and payment records, which are held by Stripe and retained as long as tax and accounting law requires. To make a request, email infopiyofficial@gmail.com — we reply within one working day.

Our hosting and payment providers operate globally, so processing may occur outside your country. Because no photograph is retained, the only data crossing a border in a stored form is your payment record, which Stripe protects under standard contractual clauses.

The tool is intended for adults, including adults preparing an application on behalf of a child. If you upload a child’s photograph you confirm you are their parent or guardian. Nothing about the photograph is retained.

If this policy changes we will update the date at the top. We will not make a change that weakens the no-retention commitment without saying so prominently, because that commitment is the reason the product is built the way it is.