Privacy policy
Who is responsible
Organisation: Genlabs Group SL
Registration identifier: B21641469
Address: Gran Via 1, 48001 Bilbao, Biscay, Spain
Contact: legal@imageforpost.com
Brand: Imageforpost
Scope of this notice
Browser social-image and video design, export and optional cloud sync.
Domains: https://imageforpost.com, https://app.imageforpost.com
Surfaces: website, application
This notice covers the currently operating scope described above.
Edit designs and prepare image or video exports in the browser; preserve anonymous work and branding on this device.
We do not receive the content through this software operation. Any direct transmission to another service is described below.
Data used by the software: Design text, selected or uploaded image files, layouts, colours, anonymous branding settings and the sample-design completion flag.
Files selected on this device and the content you enter in the browser. This path does not upload those design files to our cloud. Signing in can migrate saved anonymous work to the cloud path below; external image URLs may separately contact their hosts.
Retention period or criteria: Local designs and branding have no automatic expiry. Clear them through the editor or browser storage controls. Successfully migrated local work is removed from local storage; failed migrations retain the affected local work.
Save, retrieve, update and delete signed-in designs, branding and uploaded image files.
Our role in this activity: processor
Role and responsibilities: We carry out the submitted-content operation on the customer’s instructions, separately from our own account, security and usage administration.
Responsible controller and contact route: The creator or business commissioning the design determines the submitted content and its intended publication or other use.
Documented instructions (Article 28 GDPR): Save, retrieve, update and delete signed-in designs, branding and uploaded image files.
The relevant controller determines its Article 6 lawful basis and, where needed, its Article 9 condition. We process the data on its documented instructions; the service agreement is not presented as our own lawful basis for the customer's purpose.
Special-category data: Special-category information, where included by the responsible customer in the supplied text or media, such as health information or information revealing racial or ethnic origin, political opinions, religion, union membership, sex life or sexual orientation. An ordinary image or voice sample is not classified as biometric identification solely because it depicts or records a person.
Why this condition applies: Where customer-directed content includes special-category data, the responsible customer determines and must establish an applicable Article 9 condition in addition to its Article 6 basis. We process that content only for the requested operation on its instructions. Neither accepting the service terms nor uploading material is presented as explicit consent from the people concerned.
Special-category safeguards: Limit submitted content to what the requested operation needs; the customer must control who is entitled to supply it and provide the required privacy information. Hosted content is associated with the requesting account or device and handled through the described service path. These duties do not remove our own applicable controller or processor obligations.
Personal data: Account-linked design text, layouts, colour choices, image and logo files or URLs, company and branding fields, record identifiers and creation/update times.
People concerned: The user or creator and any people lawfully identified in the content supplied for this particular operation.
Source of the data: Content submitted while signed in and saved anonymous work migrated when you sign in. Untouched sample designs are excluded from that work migration. Uploaded files are stored separately from their design records. You must have all rights, permissions and lawful basis needed for the information you submit, including other people’s images or data. We do not routinely approve every submission in advance; our own applicable data-protection obligations remain.
Consequences of not providing the data: This feature is optional. Supply the information needed for the particular operation if you choose to use it.
Provision of data: Optional
Recipients for this activity: Google Cloud / Firebase
Generate a heading or description from the selected company and design-text context at your request.
Our role in this activity: processor
Role and responsibilities: We carry out the submitted-content operation on the customer’s instructions, separately from our own account, security and usage administration.
Responsible controller and contact route: The creator or business determines the content and purpose of the requested heading or description.
Documented instructions (Article 28 GDPR): Generate a heading or description from the selected company and design-text context at your request.
The relevant controller determines its Article 6 lawful basis and, where needed, its Article 9 condition. We process the data on its documented instructions; the service agreement is not presented as our own lawful basis for the customer's purpose.
Special-category data: Special-category information, where included by the responsible customer in the supplied text or media, such as health information or information revealing racial or ethnic origin, political opinions, religion, union membership, sex life or sexual orientation. An ordinary image or voice sample is not classified as biometric identification solely because it depicts or records a person.
Why this condition applies: Where customer-directed content includes special-category data, the responsible customer determines and must establish an applicable Article 9 condition in addition to its Article 6 basis. We process that content only for the requested operation on its instructions. Neither accepting the service terms nor uploading material is presented as explicit consent from the people concerned.
Special-category safeguards: Limit submitted content to what the requested operation needs; the customer must control who is entitled to supply it and provide the required privacy information. Hosted content is associated with the requesting account or device and handled through the described service path. These duties do not remove our own applicable controller or processor obligations.
Personal data: Company name and description, keywords, chosen platform and optional existing heading; generated text and request metadata. This endpoint does not accept image uploads.
People concerned: The user or creator and any people lawfully identified in the content supplied for this particular operation.
Source of the data: A signed-in user requests text generation. The selected text fields are sent through our hosted AI service. Image upload and local image rendering are separate from this request. You must have all rights, permissions and lawful basis needed for the information you submit, including other people’s images or data. We do not routinely approve every submission in advance; our own applicable data-protection obligations remain.
Consequences of not providing the data: This feature is optional. Supply the information needed for the particular operation if you choose to use it.
Provision of data: Optional
Recipients for this activity: Google Cloud / Firebase
Apply account AI allowances and keep request, token and cost totals for service administration.
Our role in this activity: controller
Role and responsibilities: We determine the purposes of administering our service configuration and access, independently of the contents of a customer’s designs or dictation.
Personal data: Account identifier, selected service feature and model, request counts, token totals, estimated cost and request times; not prompt or response content in these counters.
People concerned: Account or device users of this service.
Source of the data: Authenticated AI access checks and numeric usage metadata from completed generation requests.
Consequences of not providing the data: This feature is optional. Supply the information needed for the particular operation if you choose to use it.
Lawful basis: Legitimate interests (Article 6.1.f GDPR).
Legitimate interests: Our legitimate interest is to operate account allowances, control service costs and maintain reliable access without storing the content in these usage counters.
Provision of data: Optional
Recipients for this activity: Google Cloud / Firebase
Authenticate users, maintain account/session and send access links; optional Google sign-in when configured.
Our role in this activity: controller
Role and responsibilities: We manage access, authentication and administration of this service account.
Personal data: Account name/email and identifier, verification token, session data and optional OAuth account identifiers.
People concerned: Account users.
Source of the data: User entry, email sign-in and optional configured OAuth provider;
Consequences of not providing the data: The minimum sign-in and verification information is required for authenticated account access. Without it, you cannot sign in to the account; public pages remain available.
Lawful basis: Contract or requested precontractual steps (Article 6.1.b GDPR).
Provision of data: Required for this purpose
Recipients for this activity: Google Cloud / Firebase, Transactional email delivery and mailbox provider
Process optional paid plan and record access entitlement/payment status.
Our role in this activity: controller
Role and responsibilities: We administer purchases, subscription access and payment status for our service.
Personal data: Account user ID/email, Premium price and promotion choice, billing address/tax ID collected by Stripe, checkout/customer/subscription identifiers and subscription status.
People concerned: Purchasers and billing contacts.
Source of the data: Your checkout information and Stripe payment events.
Consequences of not providing the data: Buying a paid service is optional. The checkout information needed for the selected purchase must be supplied to complete it.
Lawful basis: Contract or requested precontractual steps (Article 6.1.b GDPR).
Provision of data: Optional
Recipients for this activity: Stripe, Stripe
Understand how the website and service are used by measuring visits and selected interactions.
Our role in this activity: controller
Role and responsibilities: We decide which website visits and bounded interactions to measure to understand and improve this website.
Personal data: Page URL, referral and campaign information, event name and any configured event properties; IP address and browser information are processed in the request path. Configured conversion paths can store a signup marker or checkout-session identifier locally to reduce repeat counts. The shared conversion wrapper does not send these deduplication identifiers to the analytics providers.
People concerned: Website visitors.
Source of the data: Your browser sends page and event information through our analytics relay. The relay processes technical request information, including IP address and browser information, and forwards the permitted event fields to our self-hosted analytics service.
Consequences of not providing the data: Analytics information is not a prerequisite for opening the public website.
Lawful basis: Legitimate interests (Article 6.1.f GDPR).
Legitimate interests: Our legitimate interest is to understand use of our informational website and improve its pages using limited visit and interaction information. This is not permission for terminal storage that separately requires consent.
Provision of data: Optional
Recipients for this activity: Google Cloud / Firebase
Answer the support questions you submit using an automated assistant and, if you request it, make the conversation available to a human support reviewer.
Our role in this activity: controller
Role and responsibilities: We determine how to answer enquiries and provide the requested support or follow-up.
Personal data: Your submitted messages, automated replies, product and language, conversation reference/status and technical timestamps. An email address is collected when you request human follow-up. Do not send passwords, payment details, health information or confidential documents.
People concerned: Visitors and users who choose to ask for product support.
Source of the data: Information you enter into the support chat and responses generated by the assistant. The conversation is stored before the assistant replies; a refusal to repeat sensitive information does not prevent its storage.
Consequences of not providing the data: Using chat is optional. A question is needed to answer it, and an email is needed only if you request human follow-up.
Lawful basis: Legitimate interests (Article 6.1.f GDPR).
Legitimate interests: Our legitimate interest is to answer the enquiry you choose to submit and organise the support or commercial follow-up you request. This does not authorise unrelated promotional messages.
Provision of data: Optional
Recipients for this activity: Google Cloud
Retention and deletion
Retention period or criteria: We retain saved cloud designs, branding and active uploaded images until deletion is requested. The provider’s recovery period for deleted image objects is seven days. Browser-only designs remain subject to the separate device-storage information.
Applies to: Save, retrieve, update and delete signed-in designs, branding and uploaded image files.
Retention period or criteria: The result is returned to the editor and may become part of a saved design. This endpoint does not create a separate prompt-and-response history in the application database. Service-usage records and any provider-held records are handled separately.
Applies to: Generate a heading or description from the selected company and design-text context at your request.
Retention period or criteria: Our policy is to retain service-administration records until deletion is requested, subject to any applicable obligation to retain particular records.
Applies to: Apply account AI allowances and keep request, token and cost totals for service administration.
Retention period or criteria: We keep your account information until you request deletion. Email sign-in links expire after 24 hours.
Applies to: Authenticate users, maintain account/session and send access links; optional Google sign-in when configured.
Retention period or criteria: Our policy is to retain these records until deletion is requested. We assess deletion requests through the privacy contact, taking account of any applicable obligation to retain particular records. This does not mean that every record is automatically erased as soon as a request is made.
Applies to: Process optional paid plan and record access entitlement/payment status.
Retention period or criteria: Our policy is to retain website-measurement records until deletion is requested. These records do not have an automatic expiry. We assess requests using information we can reasonably link to the requester.
Applies to: Understand how the website and service are used by measuring visits and selected interactions.
Retention period or criteria: Conversations are scheduled to expire 30 days after the last conversation message or status change, and internal notification records 30 days after creation. Automatic deletion is asynchronous. Provider or separate email copies are not covered by this timer.
Applies to: Answer the support questions you submit using an automated assistant and, if you request it, make the conversation available to a human support reviewer.
Deletion: Account deletion blocks further account writes while cleanup is pending, removes active uploaded files in the account UID namespace including orphaned uploads, and deletes saved account and design records and sign-in records. If an upload or billing operation has an unresolved outcome, deletion remains pending for retry or investigation rather than reporting completion. A minimal deleted-UID marker is retained to prevent stale sessions or callbacks from restoring the account. Stripe invoice and provider history, downloaded copies, separate legal records and provider recovery copies are not erased by this operation.
Applies to: Save, retrieve, update and delete signed-in designs, branding and uploaded image files.
Deletion: You may request erasure through the privacy contact. Closing the chat or marking a question resolved does not itself delete the stored conversation.
Applies to: Answer the support questions you submit using an automated assistant and, if you request it, make the conversation available to a human support reviewer.
Who receives the data
- Google Cloud / Firebase (processor; europe-west3 / europe-west4 (Firestore / Storage); global): Host signed-in design and account records and uploaded images, and process requested Gemini text generation using company context, keywords and the selected platform. Anonymous browser editing and export are separate from signed-in cloud saving. Google may process service data globally under its applicable published data-processing and transfer terms: https://cloud.google.com/terms/data-processing-addendum .
- Stripe (processor; Ireland / United States; international payment and service infrastructure): Process Imageforpost account subscriptions, collect billing address/tax ID at Stripe checkout and return user-linked entitlement/status events. Stripe acts on our payment instructions for this function.
- Google Cloud (processor; Google Cloud (global)): Host the requested support conversation, store messages and responses, and generate automated help through Vertex AI. Google may process service data globally under its applicable published data-processing and transfer terms: https://cloud.google.com/terms/data-processing-addendum .
- Transactional email delivery and mailbox provider (processor; DE / US): Deliver requested sign-in links using recipient addresses, email content and delivery information.
- Stripe (controller; Ireland / United States; global operations): Stripe separately controls payment security, fraud prevention, legal compliance and its own service operations under its privacy notice.
International transfers
Stripe (United States (where the applicable Stripe recipient processes data)): Adequacy decision. Stripe publishes reliance on the EU-US Data Privacy Framework for covered US transfers, with standard clauses where applicable. Scope depends on the recipient and service.
Published terms and information about safeguards: https://stripe.com/legal/data-transfers-addendum
Transactional email delivery and mailbox provider (US): No transfer safeguard identified; transfer legality remains unresolved. Email delivery may involve processing in the United States. We have not identified an applicable adequacy decision or other GDPR transfer safeguard covering this email service.
No identified transfer-safeguard copy is available for this email service. Contact legal@imageforpost.com for current information.
Children's data
You must have the legal capacity required to use the service and enter the relevant agreement, or valid authority to act for the organisation concerned. Content supplied for the requested operation may identify children. The supplying person or organisation must have the required authority and lawful basis and provide any required information to the child or representative. We do not routinely verify every subject’s age or treat uploading as parental permission.
Automated decisions
We do not make solely automated decisions that produce legal or similarly significant effects in this scope.
Your data protection rights
Depending on the applicable conditions, you can request access, rectification, erasure, restriction and portability, and object to processing (Articles 15–21 GDPR).
Request erasure through Account or the privacy contact. If deletion cannot finish, the Account page offers a retry while the recovery session is valid and a contact route afterwards.
Rights contact: legal@imageforpost.com
You can lodge a complaint with a competent supervisory authority, including in the Member State of your habitual residence, workplace or the alleged infringement (Article 77 GDPR).