Privacy policy

What we collect

• The photo you upload or capture, and the processed versions we create from it.
• The document type and age group you choose, and the results of our checks.
• For orders: your email, and for prints your name, mobile number and delivery address.
• For support requests: your name, email and message.
• If you choose to create an account after paying: your email, the orders you saved to it and whether you sign in with Google or a password. Sign-in runs on Google Firebase Authentication, which keeps your email, a one-way hash of your password if you chose one (we never see the password itself) and, if you continue with Google, the name and profile picture Google shares with it. We keep only your email.
• Basic technical logs (time, request path, error codes) to keep the service secure. We do not log photos or contact details.
• Anonymous usage counts: which pages are opened, which buttons start a photo, which lighting tips the camera showed and whether they were followed, whether a photo was taken automatically or by hand, whether a photo passed, whether an order was placed, and whether an account was created after payment. These events carry no cookie, no identifier, no IP address and no device fingerprint, photo and order references are removed before they are sent, and nothing is sent at all if your browser signals Do Not Track or Global Privacy Control. We read them only as daily totals, to improve the site.

Camera and live guidance

Live guidance runs entirely in your browser. The video from your camera is never uploaded or stored. Only the single photo you choose to use is sent to us.

How we use your data

• To create, check and deliver your document photo.
• To process payments and deliver prints.
• To answer support requests and handle refunds.
• We do not use photos for advertising, profiling or training models, and we do not sell personal data.

Payments

Payments are taken by Stripe on its own secure checkout page. Your card details go straight to Stripe; we never see or store them. Stripe receives your email address, the order amount and the order reference, handles them under its own privacy policy (stripe.com/privacy) and may store them outside the UAE.

AI expert review

When the AI expert review is enabled, the processed photo and the original are sent to our AI provider (Anthropic) solely to review compliance. The provider does not use this data to train its models. You can switch the AI review off for any photo before uploading it; the measured checks still run.

Expert check by our team

After you pay, a member of our team looks at your processed photo, the original you sent and the automatic check results, to confirm the photo meets the ICP rules. Only staff who carry out this check can open your photo, each of their actions is logged, and they use your email and order details only to contact you about the photo. We email you when the expert decides.

If the expert corrects your photo, we keep the automatic version with your order until the photo is deleted under the retention periods below.

Cookies, Google Analytics and Google Ads

With your consent, we use Google Analytics and Google Ads, loaded through Google Tag Manager, to understand how the site is used and to measure our advertising. You choose in the banner shown on your first visit, and you can change your choice at any time from "Cookie settings" at the bottom of every page.

If you accept, Google may set cookies and receives: the pages you open, with photo, checkout and order references removed; the steps you take, such as starting a photo, a photo passing its checks, starting checkout and leaving for payment; and, for a purchase, the amount, the document type and a one-way code made from the order number. To link a purchase to an ad click, Google also receives a scrambled (SHA-256 hashed) form of your email address. Google never receives your photo.

If you reject, or your browser sends Global Privacy Control, Google sets no cookies and receives no hashed email. Google may still receive signals without cookies (its consent mode), which it uses only for aggregated measurement.

Google handles this data under its own privacy policy (policies.google.com/privacy). The staff console never loads Google tags.

If you sign in to an account, we set one strictly necessary cookie that keeps you signed in for up to 30 days. It is sent only to our account service, is never readable by scripts on the page and is not used for measurement. Signing out deletes it.

Signing in talks to Google Firebase Authentication directly from your browser: your email and password, or your choice of Google account, go to Google, which confirms to us who you are. Firebase also sends password-reset emails for us. Google handles this data under its privacy policy and the Firebase terms, and may store it outside the UAE, including in the United States. Firebase sets no cookies on our site and forgets the sign-in in your browser once our own cookie holds it.

How long we keep it

• Photos you do not pay for: deleted automatically 24 hours after upload.
• Paid photos: deleted 30 days after payment, so you can download them again.
• Paid photos you save to an account (optional, offered after payment): kept for 2 years after your last visit to My photos, then deleted. After the first 30 days, only someone signed in to the account can download them.
• Your account (your email with us, and your sign-in record at Google Firebase): kept until you delete it. Deleting your account from My photos also deletes the photos saved to it and your Firebase sign-in record, immediately.
• Order records (without photos): kept as long as required for tax and accounting.
• You can delete a photo immediately from its result page.

Your rights

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) you may ask to access, correct or delete your personal data, or object to its processing. Contact us using the contact page and we will respond within the time the law requires.

Security

Data is encrypted in transit (HTTPS) and stored on servers we control. Access is limited to staff who need it to provide the service.