Privacy Policy

1. Data controller

Filip Zemek, business ID (IČO) 23584203, Drnovec 1, 471 54 Cvikov Email: info@fasthdr.cz The Provider has not appointed a Data Protection Officer (DPO), as personal data is not processed on a large scale and does not concern special categories of data.

2. What data we collect and why

Registration and billing data We collect your email address, name, business ID, VAT ID and billing address. We need this information to create a user account, provide the service and issue accounting documents. The legal bases are performance of a contract and a legal obligation under accounting legislation. Photographs If you upload photographs containing personal data (such as recognizable people, vehicle registration plates or property addresses), we process them solely to provide the Service — image editing. Photographs are not analysed for other purposes and are not shared with third parties except the infrastructure processors listed in section 4. Technical and operational data When you use the Service, we automatically record your IP address, browser type and access times solely to ensure security and proper operation of the Service (legitimate interest under Article 6(1)(f) GDPR). Profile photo and custom logo If you use these optional features, we store your profile photo, its image source for later recropping and, if provided, your PNG logo. We use them to display your account and to add your logo to downloaded photos at your request. The avatar, logo and photos submitted for AI editing are separate. We do not send your avatar or logo to the AI editing service; we remove EXIF, including any location information, from uploaded profile images. Access to these files is limited to the signed-in owning account. Branded export creates a separate result and does not change the stored original or the clean edited photo.

3. How long we retain data

• Billing and accounting documents: 10 years (Accounting Act) • User account (email, name): for the duration of the account • Uploaded and edited photographs: 7 days after upload for unpaid photos and 7 days after payment for paid photos, followed by automatic cleanup • Technical logs (IP addresses, access): 30 days • Profile photo, crop source and custom logo: until replaced, removed or the account is deleted. Unused versions are cleaned up after a one-hour grace period that allows an export already in progress to finish; storage failures are retried. Active versions remain available only to the owning account.

4. Who can access data (processors)

We do not sell your data or share it with third parties for marketing purposes. We use only vetted processors to operate the Service: • Vercel Inc. — frontend application hosting (USA; EU Standard Contractual Clauses) • Railway Corp. — backend application hosting (USA; EU Standard Contractual Clauses) • WEDOS Internet, a.s. — supplementary server infrastructure (Czech Republic) • Supabase Inc. — user account database (USA; EU Standard Contractual Clauses) • GOPAY s.r.o. — payment gateway operator (Czech Republic) • UOL — issuing accounting documents and bookkeeping (Czech Republic) • Resend Inc. — transactional email delivery (USA; EU Standard Contractual Clauses) • Autoenhance Ltd. — AI photo processing (United Kingdom) Data transfers outside the EU take place exclusively on the basis of Standard Contractual Clauses approved by the European Commission (Article 46(2)(c) GDPR).

5. Connecting cloud storage (Dropbox and Google Drive)

The Service allows the User to optionally connect a Dropbox or Google Drive account and import photos for processing. Connecting is entirely voluntary — photos can also be uploaded directly from your device.

Scope of access. Connections use the secure OAuth 2.0 authorization protocol. When connecting, Dropbox or Google asks you to consent to access. The permissions are shown during authorization. For Dropbox, the app reads folder and file names and metadata so you can select photos to import. It downloads photo contents only as selected by you. For Google Drive, it uses a file picker with the drive.file permission. We do not delete or change files in the original storage.

Purpose of processing. Selected photos are downloaded from your storage solely to perform the requested AI edit (provide the Service). They are not analysed for any other purpose or shared with third parties beyond the infrastructure processors listed in section 4.

Access credentials (tokens). To complete and, if necessary, resume a transfer, we retain the access token on the server in encrypted form. It is used to import your selected files and is deleted when the job finishes or within two hours at the latest. You can revoke permissions in your Dropbox or Google account settings.

Retention period. Photos imported from Dropbox or Google Drive follow the same rules as other uploaded photos: they are available for 7 days after upload, or 7 days after payment once purchased. Automatic cleanup removes them after availability ends (see section 3).

Compliance with provider terms. Data obtained from Dropbox is used under the Dropbox API terms. Use of Google Drive data complies with the Google API Services User Data Policy, including its Limited Use requirements. FastHDR does not use data obtained from these services for advertising or sell it.

6. Your rights

Under the GDPR, you have the right to: • Access — find out what data we process about you • Rectification — have inaccurate data corrected • Erasure — request deletion of your data (the right to be forgotten) • Restriction of processing — limit how your data is processed • Data portability — receive your data in a machine-readable format • Object — to processing based on legitimate interest • Withdraw consent — where processing is based on consent To exercise these rights, contact info@fasthdr.cz. We will respond to your request within 30 days.

7. Cookies

The FastHDR web application uses only essential technical cookies needed for user accounts to function correctly (keeping you signed in) and to maintain security. We do not use analytics or marketing cookies or track users across the internet. As we use only strictly necessary technical cookies, their use does not require your consent under Article 5(3) of the ePrivacy Directive.

8. Data security

All communication with the Service is encrypted using HTTPS/TLS. Access to data is limited to the minimum necessary personnel. Automatic cleanup removes photos after the availability period described in section 3.

9. Changes to this policy

You will be informed of material changes to this policy by email or a notice on the website. The current version is always available at fasthdr.cz/ochrana-soukromi.

10. Supervisory authority

You have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ) Pplk. Sochora 27, 170 00 Praha 7 www.uoou.cz