Privacy Policy

Sergey Bespalov ("we," "us," or "our") operates the EatFrame mobile application (the "App"). We are committed to protecting your privacy and handling your data in an open and transparent manner.

This Privacy Policy explains how we collect, use, and share your personal data when you use our App, in compliance with the General Data Protection Regulation (GDPR) and applicable Spanish laws.

1. Data Controller

The data controller responsible for your information is:

• Name: Sergey Bespalov
• VAT ID (NIF): ESZ2865470C
• Address: Calle Ezcurdia 44 (local), 33202 Gijón, Asturias, Spain
• Email: [email protected]

2. Information We Collect

To provide our AI photo generation services, we collect and process the following data:

• User Content (Images): Photos of food and beverages that you upload or capture via the App.
• Usage Data: Anonymous information about how you use the App (e.g., device model, OS version, crash logs) to help us improve stability.
• Technical Data: IP address and device identifiers required for secure communication with our servers.
• Advertising Attribution Data: Apple Ads attribution information provided by Apple, such as campaign, ad group, keyword, creative, and conversion metadata, when available.

3. How We Use Your Data & AI Processing

We use your images solely to perform the service you requested—generating professional food photography.

• AI Processing: We utilize artificial intelligence technology provided by Google Gemini API. When you generate an image, your original photo is securely transmitted to Google's servers for processing.
• Apple Ads Attribution: We use Apple Ads attribution to understand which advertising campaigns lead to app installs, subscriptions, and purchases. We send this attribution information to RevenueCat to connect campaign performance with subscription and purchase events.
• No Training: We do not use your private photos to train our own AI models.

4. Data Sharing and Service Providers (Sub-processors)

We do not sell your personal data. However, to operate the App securely and efficiently, we share data with trusted third-party service providers ("Sub-processors"):

• Hetzner Online GmbH (Germany): Our main backend servers and databases are hosted in secure data centers within the European Union (Germany/Finland). This ensures your data remains under strict EU privacy protection laws.
• Cloudflare, Inc. (USA/Global): We use Cloudflare for secure temporary storage of images and Content Delivery Network (CDN) services to ensure high speed and security.
• Google LLC (USA): Used specifically for the AI image analysis and generation process.
• Apple Inc. / Apple Distribution International Ltd. (USA/Ireland): Provides Apple Ads attribution data used to measure advertising campaign performance.
• RevenueCat, Inc. (USA): We use RevenueCat for subscription entitlement management, purchase analytics, and attribution analytics. Apple Ads attribution data is shared with RevenueCat for these purposes.

All service providers are bound by data processing agreements to ensure your data remains confidential and secure.

5. Data Retention (24-Hour Policy)

We implement a strict data minimization policy:

• Temporary Storage: Original images and generated results are stored on our secure servers (Hetzner/Cloudflare) only for the duration necessary to allow you to download them.
• Automatic Deletion: All User Content is automatically and permanently deleted from our servers within 24 hours of upload/generation. We do not keep a history of your photos.

6. International Transfers

While our main servers (Hetzner) are located in Europe, some service providers (Google, Cloudflare, Apple, RevenueCat) may process data in the United States. When data is transferred to the US, we rely on Adequacy Decisions (such as the EU-US Data Privacy Framework) or Standard Contractual Clauses (SCCs) approved by the European Commission to guarantee the safety of your data.

7. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Right of Access: You can ask what data we hold about you.
• Right to Erasure: You can request the deletion of your data (though our 24-hour auto-deletion policy usually handles this automatically).
• Right to Complaint: You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you believe your rights have been violated.

8. Children's Privacy

Our Service is not directed to children under 13. We do not knowingly collect personal data from children. If you are a parent and believe your child has provided us with personal data, please contact us immediately.

9. Contact Us

If you have any questions about this Privacy Policy, please contact us at: [email protected]