Privacy

Effective 18 September 2026

Who is responsible

The controller is RG TECHNOLOGY EOOD (АР ДЖИ ТЕХНОЛОДЖИ ЕООД), UIC 208933605, 14A Naroden Geroy St., floor 1, apt. 3, Ovcha Kupel, Sofia 1618, Bulgaria. For questions and requests: studio.rggarage.com@gmail.com.

What we process and why

• Email, account identifier, session, credits and processing history — to sign you in and provide the service, under performance of a contract (GDPR Article 6(1)(b)).
• Selected photographs, backgrounds, settings and instructions — for the AI processing you request, on the same basis. Images can contain faces and registration plates. Only upload content you are entitled to use and avoid unnecessary personal data.
• Order, amount, currency, payment status and identifiers, selected terms and contractual messages — to fulfil and document the purchase; required accounting and tax records — for legal obligations (Article 6(1)(c)). Card details are entered with Stripe; we do not store full card numbers or CVCs.
• Correspondence, IP address and technical request/error information — for support, security, abuse prevention and handling disputes. The basis is our legitimate interest in operating a reliable service and defending rights (Article 6(1)(f)); legal requests are handled under Article 6(1)(c).

An email is needed for an account, a selected image for processing, and the required order information for a purchase. We do not make solely automated decisions with legal or similarly significant effects on you.

Providers and processing outside the EEA

We use Supabase for accounts and the database; OpenAI for AI processing; Stripe for payments; Resend for sign-in, purchase and withdrawal emails; Google/Gmail for support correspondence; and OpenAI Sites and Cloudflare for hosting and website delivery. Providers receive data needed for their function. Where there is a lawful basis, necessary records are provided to accounting/legal advisers and competent authorities.

We send OpenAI a prepared copy of the image, the selected background and instructions. Hiding a plate in the final result does not mean it was hidden before AI processing. We do not use your images to train our own models or for advertising.

Our Supabase database is in Frankfurt, but not all processing stays in the EU. Providers and their subprocessors may process data in the US or other countries outside the EEA. Applicable safeguards for those transfers are an adequacy decision where it covers the recipient, or European Commission standard contractual clauses and necessary supplementary measures. You can request information and a copy of the applicable safeguards by emailing us.

Further information: OpenAI, Supabase, Stripe, Resend, Google, Cloudflare.

How long data is kept

• Images and results: we do not maintain a permanent server-side image archive. We process them for the request and display results in the current session; download results you wish to keep. OpenAI may retain content in abuse-monitoring logs normally for up to 30 days, with legal and safety exceptions. We do not promise zero retention by providers.
• Processing history (filename, time, status and error): records older than 90 days are removed by the daily cleanup. Purchases and accounting documents are separate.
• Account and balance: while the account is used or until a deletion request is fulfilled. On closure, we separate records that must remain for legal obligations or specific claims.
• Orders, contractual confirmations and correspondence: until performance/the request is completed and applicable claim periods expire; for a dispute, until its final resolution. Accounting and tax document retention depends on the document type, reporting period and statutory periods, including any suspension or interruption. Account deletion does not automatically remove these documents.

Infrastructure providers remove technical logs and backups according to their applicable retention and recovery cycles; deletion from the active database does not mean immediate removal from every backup. On request, we explain the applicable periods and exceptions for your data.

Browser storage

We use local storage for sign-in and your language choice. Signing out removes the saved session; the language remains until changed or site data is cleared. We do not use advertising pixels or marketing cookies in the application. Stripe may use its own technologies on the payment page for functionality and fraud prevention.

Your rights

You may request access, correction, erasure, restriction and, where applicable, portability and object to processing based on legitimate interests. If processing relies on consent, you may withdraw it for the future. Email studio.rggarage.com@gmail.com, preferably from your account email. No form is required. Proportionate identity verification may be necessary. We normally respond within one month; if a permitted extension is needed, we notify you within that month and explain why. We explain any legal grounds for refusing a request or retaining specific records.

You may complain to the Bulgarian Commission for Personal Data Protection (CPDP) or the supervisory authority where you habitually reside, work or where the alleged infringement occurred.