Privacy Policy

What this covers

ImageEnhance is an AI photo tool operated at imageenhance.app from the Hong Kong SAR. This policy explains what we collect, what happens to the photos you upload, and which other companies are involved in processing them.

We have tried to write it so that you can actually tell what happens to your photo. The section below is the part most people care about, so it comes first.

What happens to a photo you upload

We do not store your original photo. When you upload an image, it is sent straight to the AI provider that runs the model you chose, encoded inline in that single request. It is not written to our storage, and it is not kept on our servers after the request finishes.

The result is stored. The enhanced image is saved to Cloudflare R2 so that it stays available in your library and the link keeps working. It stays there until you delete it. Signed-in users can delete any result from Settings → My Library, which removes it from your library immediately.

Your photos are never used to train models. We do not train on your images, and we do not grant anyone the right to. The AI providers we use (listed below) offer API access under terms that do not include training on API inputs. We also do not look through user images except when you explicitly send us one to investigate a problem you reported.

Anonymous use. You can enhance a photo without an account. In that case we store the result and a hashed IP-derived identifier for the free-quota counter, but no account details, because there is no account.

Who else processes your data

Running this service means other companies see some of your data. This is the complete list:

| Provider | What they receive | Where | | -------------------------- | ---------------------------------------------------- | ----- | | fal.ai | The photo you upload, for models run there | USA | | Replicate | The photo you upload, for models run there | USA | | Cloudflare (R2) | The result image, stored | USA | | Cloudflare (Turnstile) | Anti-abuse signals for anonymous requests | USA | | Stripe | Payment details, email, billing address | USA | | Resend | Your email address, to send you mail | USA | | Google (optional) | Your email and name, only if you sign in with Google | USA |

Which AI provider receives a given photo depends on the tool you pick — for example colourisation and background removal run on Replicate, while upscaling and restoration run on fal.ai. Both are used purely as processors: they run the model and return the result.

We never sell your data, and we do not share it for advertising.

What we collect

• Account information — your email address, and your name and profile picture if you sign in with Google. Passwords are stored hashed; we cannot read them.
• Images — as described above: originals pass through, results are stored.
• Usage records — which tool you ran, when, the credit cost, and whether it succeeded. This is what your history and credit balance are built from.
• Payment information — handled entirely by Stripe. We receive the fact of a payment, the amount, and the last four digits of the card. We never see or store full card numbers.
• Technical data — IP address and browser type, used for abuse prevention and the anonymous free-quota counter, and to keep the service working.

We do not use advertising trackers or third-party analytics profiling.

Cookies

We use cookies for two things: keeping you signed in, and remembering interface preferences such as your language and light/dark theme. There are no advertising cookies.

How long we keep things

| Data | Retention | | ------------------- | ------------------------------------------------------- | | Original uploads | Not retained — passed through and discarded | | Result images | Until you delete them, or until you delete your account | | Account and history | For as long as your account exists | | Payment records | 7 years, as tax and accounting law requires | | Anti-abuse records | 30 days |

When you delete your account, we delete your account data and result images. Payment records are kept for the period above because we are legally required to, and cannot delete them on request.

Your rights

Wherever you live, you can ask us to give you a copy of your data, correct it, or delete it. If you are in the EU, UK, or another jurisdiction with data protection law — including California — you also have the rights that law grants you, such as objecting to processing or asking for portability.

To exercise any of these, email support@imageenhance.app. We respond within 30 days, and we do not charge for it. You do not have to explain why.

Our legal basis for processing, where the GDPR applies, is: performing the contract (running the tool you asked for, billing you), legitimate interests (preventing abuse of free quota), and consent where you have given it.

International transfers

The service is operated from the Hong Kong SAR, and the providers listed above are in the United States — so using ImageEnhance means your data is transferred to and processed in the US, wherever you are. Where the GDPR applies, these transfers rely on Standard Contractual Clauses with those providers.

Children

The service is not intended for anyone under 13, and we do not knowingly collect their data. If you believe a child has given us personal information, email us and we will delete it.

Security

Traffic is encrypted in transit. Secrets and payment credentials are encrypted at rest. Access to production systems is limited to the operator of the service. No system is perfectly secure, and we will not pretend otherwise — if a breach ever affects your data, we will tell you.

Changes

If we change this policy in a way that materially affects you, we will update the date at the top and notify signed-in users by email. Continuing to use the service after a change means you accept the updated policy.

---

ImageEnhance is operated from the Hong Kong SAR. Privacy questions: support@imageenhance.app.