Vai al contenuto
FinalFrame
Inizia gratis

Privacy Policy

Last updated: October 29, 2026

FinalFrame is an AI-powered photography critique service built for photographers. We know photographers care deeply about how their images are handled, so this policy is written in plain language. It explains exactly what data we collect, why, where it goes, and how you can control it.

1. Who We Are

FinalFrame is operated by Crypto Brains DOO, a company registered in Serbia. For any privacy-related questions, you can reach us at:

For the purposes of the EU General Data Protection Regulation (GDPR), Crypto Brains DOO acts as the data controller for the personal data described in this policy.

2. Data We Collect

2.1 Account Data

When you create an account, we collect and store:

2.2 Photographs and Image Data

When you upload a photograph for critique, we process the following data:

2.3 EXIF Metadata We Extract and Retain

We extract a limited set of photographic and editing metadata from your images to provide better critique. Specifically:

We do not extract or store GPS coordinates, camera serial numbers, or other personally identifying EXIF fields. GPS data is actively stripped from all stored copies of your images.

2.4 AI Critique Data

When the AI analyzes your photograph, we store the full critique results, including:

2.5 Curation Data

If you use the photo curation feature (selecting your best images from a set), we store the session data including individual image scores, rankings, strengths and weaknesses, cohesion analysis, and sequence reasoning.

2.6 Content Moderation Data

Every image uploaded to FinalFrame is screened through OpenAI's content moderation endpoint (omni-moderation-latest) before critique. For any moderation outcome that matches a monitored category (“soft_block,” “hard_block,” and any “pass” that still flagged a category), we log the verdict, the flagged categories, and their confidence scores for audit and threshold calibration purposes. A clean “pass” with no flagged category is not logged. For hard-blocked content (severe policy violations), we additionally log: a cryptographic hash (SHA-256) of the image, your IP address, user agent, and the timestamp. This metadata is retained for law enforcement cooperation and platform safety. The image itself is deleted immediately and is not retained in any form. Non-hard-block moderation logs do not include IP addresses or image hashes.

Third-party content databases: moderation metadata (image hashes, flagged categories, scores) is stored in our own Supabase database for the purposes described above. A daily internal summary of moderation actions is also emailed to our company mailbox (see the Google Workspace entry in Section 5). An emailed summary stays in the mailbox it was delivered to, including after an account it names is deleted, and your rights under Section 8 still apply to that copy. We do not forward image hashes or moderation metadata to NCMEC, PhotoDNA, GIFCT, StopNCII, or any other external hash-matching database. We may cooperate with law enforcement authorities upon lawful request: in that case, hashes or metadata would be disclosed only in response to a specific legal process.

Automated detection scope (transparency disclosure). Our automated content moderation uses OpenAI's omni-moderation-latest model, which evaluates images for adult sexual content (sexual), violence (violence, violence/graphic), and self-harm content (self-harm, self-harm/intent, self-harm/instructions). It does NOT provide automated detection specific to child sexual abuse material; the sexual/minors category in the moderation API is text-only and is not evaluated against image content. We rely on user reporting (see Section 9.4 of our Terms of Service) and the adult sexual category with an admin review queue for borderline scores (0.50–0.75 band) as proximate signals. We may add a dedicated image-CSAM detection partner in the future and will update this section before doing so.

2.6a Automated Decision-Making (GDPR Art. 22)

Image uploads are screened by automated content moderation before any AI critique begins. These automated decisions can have a significant effect on you: they may restrict public sharing of your image, or, in the case of severe policy violations, result in your account being suspended and any active subscription being cancelled. We rely on automated screening because the volume and sensitivity of the material (including adult sexual content, graphic violence, and self-harm imagery) make pre-review by a human infeasible and unsafe.

Your right to human review. You have the right to obtain human review of any automated moderation decision that affects your account or your ability to share content. To request a review:

2.6b AI Transparency (EU AI Act Art. 50)

The critique, score, tier, editing instructions, and any narrative text generated by FinalFrame are produced by AI models in OpenAI's GPT-5 family, operating on your image and optional EXIF metadata. The output reflects algorithmic analysis, not human judgement. It is intended as educational feedback, not as a professional appraisal, competition verdict, or legal document. The results may be incorrect, incomplete, or biased for reasons outside our control. You should use your own judgement when acting on any critique.

When you choose to publish an image to the public gallery (Section 6 of the Terms), its FinalFrame Score and tier are displayed publicly alongside the image, may appear on your public photographer profile, and can be shown in an embeddable badge you place on third-party websites you control. These scores remain an algorithmic assessment as described above; publishing is optional and reversible: unpublishing removes the public display, and the badge stops showing your statistics within approximately one hour.

OpenAI processes your image as a sub-processor on our behalf. See Section 5 (Third-Party Sub-Processors) for the specific processing role and data protection terms. Our data processing agreement with OpenAI is available on request.

2.6c Retention Periods for Moderation Actions

We retain data related to content-moderation actions for the following periods:

2.7 Payment Data

If you subscribe to a paid plan (Pro at $19/month or Premium at $36/month) or purchase credit packs, payment processing is handled by Paddle (“Paddle”), who acts as our Merchant of Record. Paddle contracts through more than one legal entity and the one that is your counterparty depends on where you purchase from; see Terms Section 11.5. This means Paddle is the legal seller of the subscription; they process payments, collect applicable taxes (VAT, sales tax, GST), and handle chargebacks on our behalf. We store:

We never see or store your full credit card number, CVV, or banking details. That data lives entirely within Paddle's PCI-compliant infrastructure. Invoices and receipts are issued by Paddle, not by FinalFrame.

2.7a Payment Retry Handling

When a subscription payment fails, we record the failure timestamp on your profile and retry the charge through Paddle for up to 30 days. During this retry window we send you up to three operational emails about the failure (first notice, midpoint reminder, and final notice before plan loss) so you can update your payment method. We also pause monthly credit refills beginning on the failure date: already-granted credits remain spendable, and credit balances are restored on successful payment. If all retries fail within the retry window, your plan reverts to Free and a final notice email is sent. We send these emails as part of our contract with you (GDPR Art. 6(1)(b), contract performance); they do not respect marketing-email opt-outs. The payment-failure timestamp is cleared when payment succeeds, when you cancel, or when a refund/chargeback is processed; otherwise it is purged after 180 days of account dormancy. We may also send you a pre-expiry notice up to 14 days before your card expires under the same legal basis.

Specific dunning email types we may send under this section:

2.7b Subscription Pause State

When you pause your subscription, we process pause-state data: pause scheduled date, pause start date, pause end date, and reminder-sent flag. Lawful basis: Art. 6(1)(b) GDPR (contract performance). We retain pause-state until the cap-enforcement window naturally expires (rolling 6 months) plus a 12-month dispute window.

2.8 Usage and Quota Data

We track:

2.9 Referral Program Data

If you participate in the referral program, we store:

To prevent self-referral abuse, we normalize email addresses (stripping Gmail +alias suffixes) and compare them during referral processing. This normalized form is not stored; it is computed transiently during the check.

People who open your referral link see your display name on the sign-up page (“[your name] invited you”), unless your photographer page is hidden, in which case it says “A friend invited you”.

2.10 Public Gallery and Sharing Data

FinalFrame has an opt-in public gallery. If you choose to publish a project or curation session, the following becomes publicly accessible:

Your photographer page shows your display name and the profile details you have set to anyone who opens it, whether or not you have published anything, and share links you create link to it. You can hide it at any time in your account settings.

You can also generate share links (tokens) that make individual critique results accessible to anyone with the link. A share page and its preview image show your display name as the author, even if your photographer page is hidden. You can unpublish projects or revoke share links at any time.

After you revoke a share link, the link becomes inaccessible immediately. However, cached previews on third-party platforms (WhatsApp, Facebook, X, Discord) may persist for 1–7 days. FinalFrame does not control third-party caching behavior.

Image URL expiry after revocation. When a viewer loads a share page, their browser receives a time-limited signed URL pointing directly to the image file. If you revoke the share link or delete the critique after a viewer has already opened the page, the share page itself stops loading for new visitors immediately, and the viewer can no longer obtain a fresh signed URL. However, a signed URL already issued to a browser remains fetchable from our storage provider until it expires. How long that is depends on the kind of image: at most 3 hours for images served on shared and public gallery pages, at most 3 hours for your profile photo and cover photo wherever they appear, including on your own account pages while you are signed in, and at most 1 hour for the other images on your own account pages. A thumbnail we embed in an email to you is signed for up to 7 days, so that copy can remain loadable in your own mailbox for that period. After the window that applies to the image closes, the image file can no longer be fetched from our storage provider by any previously issued URL. Some pages show a resized copy instead, which our hosting provider, Vercel, makes from the signed URL and keeps in its cache; anyone who requests the copy’s address, which contains the signed URL, receives it. A copy counts as current for 1 hour, or for the lifetime of the signed URL it was made from if that is longer, counted from when the copy was made. Copies of your profile photo and cover photo are the exception: they count as current for 1 hour. So a copy made just before the window closes stays current for up to 3 hours after the window closes for an image on a shared or public gallery page, and for up to 1 hour for your profile photo, your cover photo and the other images on your own account pages. After that, Vercel can still serve the old copy while it tries to refresh it, and the refresh fails because the signed URL has expired. Vercel’s documentation does not say how long it keeps or serves an expired copy, so we cannot give you an end time. Our emails load their thumbnail directly, not through this cache.

2.11 Challenge Data

If you participate in photography challenges, we store your entries, constraint scores, and feedback linked to the challenge.

2.12 Progress Insights and Coaching Data

As you use FinalFrame over time, we generate personalized progress insights and coaching briefs. These include a narrative assessment, focus areas, shooting and editing missions, patterns observed in your work, and a photographer identity label. This data is derived from your critique history and stored in your account.

2.13 Feedback Data

If you submit feedback through the in-app feedback form, we store your message, a screenshot (if you choose to include one), the page URL you were on, and your browser user agent string.

If you cancel your subscription, we ask for an optional reason (selected from a preset list, with an optional free-text field). This is stored alongside your feedback data to help us improve the service.

Lawful basis: We collect optional cancellation reasons to improve the product, under GDPR Art. 6(1)(f) legitimate interest. Our interest in understanding churn does not override your rights, because the data is minimized (enumerated category by default) and the free-text portion is purged automatically.

Retention: The enumerated reason code (e.g. “too_expensive”, “not_using_enough”, “other”) is retained with your account for as long as the account exists. Any free-text response you provide in the “Other” field is automatically purged after 90 days.

Right to object (GDPR Art. 21): You can request immediate purge of your cancellation free-text by emailing support@finalframe.photo. We will process the request within 30 days, and typically within a few business days.

2.13a Mid-Cycle Plan Change Consent Records

When you change your plan mid-cycle in a way that places an immediate charge, such as upgrading to a higher tier (for example, Pro to Premium, which unlocks the Coaching Brief as an additional feature), or changing your billing frequency (for example, monthly to annual, which commits you to a new, longer minimum term), we write a dedicated consent record to our consent_events table capturing your express request that the change take effect immediately, during the 14-day withdrawal period, and your acknowledgment of how that affects the right under EU Directive 2011/83/EU Art. 8(8), 14(3) and 16(a): if you withdraw after starting to use the change, you pay in proportion to the credits you have spent, and the right ends early only once you have spent every credit the change provided, as set out in Section 11.8 of our Terms.

Purpose. Record of your express request for immediate performance of the upgraded services (for example, Coaching Brief on Premium) and of the acknowledgment that accompanies it. Required under GDPR Art. 7(1) accountability and the Consumer Rights Directive 2011/83/EU: Art. 8(8) obliges us to obtain that request and acknowledgment, and Art. 14(3) and 14(4)(a) make the amount you owe for the part you used depend on our being able to show that we did. This is a separate consent moment from the request you made when you first subscribed (recorded under action “withdrawal_waiver_accepted”) and from the cookie- consent log described in Section 9.

Data retained. The action type “withdrawal_waiver_upgrade”, the timestamp, your IP address, your user agent string, the from-plan identifier, the to-plan identifier, and the price amount shown to you on the order screen at the moment of consent (retained as evidence that the price you consented to is the price you were charged). No payment-card data, no image data, and no critique content is written to this row.

Retention. 6 years from the consent event, aligned with the German Handelsgesetzbuch § 257 commercial record-keeping requirement (which applies to Crypto Brains DOO in respect of EU customer-facing contracts and may be invoked to prove that your express request and acknowledgment were obtained before performance began). After 6 years, the record is purged.

Lawful basis. GDPR Art. 6(1)(c): legal obligation to record consumer consent under Art. 7(1) GDPR together with the national transpositions of Consumer Rights Directive 2011/83/EU Art. 8(8), 14(3) and 16(a) (for example, § 356 Abs. 5 Nr. 2 and § 357a Abs. 2 BGB in Germany, Art. L221-25 and L221-28 1° Code de la consommation in France).

Your rights. You can request a copy of your upgrade-consent records through the self-service data export in Account Settings (which covers the consent_events table under Section 8.1), or by emailing support@finalframe.photo. Because this record is retained under a legal obligation, we cannot delete it before the 6-year retention period ends, even on an Art. 17 erasure request; we will restrict processing on request instead (Art. 18).

2.13b Critique Rating Feedback

Under each critique you can rate it from one to five stars. Alongside the rating you may optionally pick a reason from a preset list (for example “Tier or score felt wrong”, “It misread the photo”) and add a free-text note of up to 300 characters. Both the reason and the note are optional at every rating, and we store them with the rating, your account and the critique they refer to.

Marking a point that doesn't match your photo: Under the main issue in a critique, and under a permanent-limit note when there is one, you can mark that point as not matching your photo and pick a reason from a short preset list. We store which point you marked, the reason, your account and the critique. There is no free-text field. A mark follows the rules in this section for ratings, with one difference: it is not included in the daily internal summary. So it has the same purpose and lawful basis, it is private to you and FinalFrame and never shown to anyone else, it is never fed back into the AI, and it never changes your critique, score or credits. You can change the reason at any time from the critique, and the retention and removal rules below apply to marks as they do to ratings.

Lawful basis: We collect critique ratings to review and improve the quality of our AI critique, under GDPR Art. 6(1)(f) legitimate interest. Our interest in knowing where the critique is wrong does not override your rights: rating is entirely optional, the reason and note are optional within it, and the data is used only to review critique quality. The note field also asks you to keep it about the critique rather than about people, so we are not inviting information about anyone else.

Visibility: Ratings are private. They are never shown on your public profile, in the gallery, on a shared critique link, or to any other user, and they are never fed back into the AI to change how it critiques your work. Only FinalFrame sees them, in our admin tools. A daily internal summary emailed to us records that a rating arrived, its star value, a link to the critique, and any reason category you selected. Where a rating is low, that summary also counts reason categories by photography genre across accounts, and includes links to a small random sample of low-rated critiques for us to read. Your written note is not copied into that summary.

Retention: In our database, your rating, the selected reason and any free-text note are retained for as long as the critique they refer to exists. Deleting your account removes them immediately. Deleting the photo removes them once that photo is purged, which happens after its 30-day recovery window has passed. We run no separate retention window for rating feedback.

The emailed summary is not covered by those deletions. An email that has already been sent cannot be recalled by deleting a photo or an account, so each daily summary stays in the mailbox it was delivered to (summaries now go to our Google Workspace mailbox, see Section 5) with whatever it recorded at the time: the star value, the link, any category selected, the genre-and-category counts, and any sampled links. Your written note is not in it. Your rights under Section 8, including erasure, still apply to that copy.

Changing or removing it: You can change your rating at any time from the critique itself, which overwrites the previous one, including the reason and note. To have a rating removed entirely, email support@finalframe.photo. We will process the request within 30 days, and typically within a few business days.

2.13c Cancellation and Withdrawal Declarations (no-sign-in pages)

Two pages of our site take a declaration without a sign-in, because the law that requires them forbids one: the “Cancel your subscription” page (German § 312k BGB) and the “Withdraw from contract here” page (Directive 2011/83/EU Art. 11a). On each we record what you type (your name, the email address of the account, your description of the subscription or purchase, and the address for our confirmation), the page language, the date and time we received it, and the IP address and browser identification of the submission. We use the email address to find the account it names and, where one exists, send a copy of our confirmation to that account's own address, so the holder learns of a declaration made in their name. For a withdrawal we also record, at the moment of receipt, the credits each affected purchase provided and how many had been used, because that fixes the proportional amount under Art. 14(3) of the Directive, and we later record what we did with the declaration. Lawful basis: sending the confirmation is a legal obligation (GDPR Art. 6(1)(c)); keeping the record afterwards rests on our legitimate interest in being able to show what reached us and when (Art. 6(1)(f)). Retention, and what survives account deletion, is in Section 7.4. If you did not make a declaration sent in your name, reply to the copy we sent you or email support@finalframe.photo.

2.13d Free Plan Upgrade Question

When a Free account that has used all of its credits closes the upgrade window without upgrading, the window may ask one optional question, once: what the main reason is for not upgrading today. You answer with one tap from a short preset list (for example, that the price is the reason), or close the window without answering. There is no free-text field. We store the answer you picked, the date, and whether the free credits for uploading an edited version were still available to your account at the time. We also record that the question was shown to your account, and when, so that we never ask it again.

Lawful basis: We ask so that we can understand why Free accounts do not move to a paid plan and improve the product and its pricing, under GDPR Art. 6(1)(f) legitimate interest. Our interest does not override your rights: answering is entirely optional, the answer is one choice from a fixed list, it is never used for marketing or to decide anything about your account, and we delete it after a fixed period.

How we use it: We count the answers, by answer and by the campaign, if any, that brought each account to FinalFrame (the acquisition fields in Section 2.15a). What we keep from those counts is totals only, with no account identifiers. Your answer never changes your plan, your credits or any price shown to you. It is never shown to anyone outside FinalFrame, and it stays in our own database: we do not send it to our analytics provider.

Retention: We delete your answer, its date and the credit detail 12 months after you give your answer, or 12 months after the question was shown if you did not answer. The record that the question was shown to your account is kept while your account exists, so that we do not ask again. Deleting your account removes all of it immediately.

Removing it: To have your answer removed sooner, email support@finalframe.photo. We will process the request within 30 days, and typically within a few business days. You can also object to this processing under GDPR Art. 21 (Section 8).

2.14 Demo Session Data

If you try a demo critique without an account, we store a demo session linked to your IP address, the critique results, and the demo image. Demo images are cleaned up separately from account data. If you create an account, a demo critique you ran on this device may be linked to your new account so it appears in your dashboard.

Lawful basis. We process your demo image and the IP address under our legitimate interest (GDPR Art. 6(1)(f)) in providing the free trial you requested and in preventing abuse of it. Because the demo is a transient, one-off critique you initiate, we rely on legitimate interest rather than consent; there is no standing relationship to manage and no consent-withdrawal mechanism for data this short-lived; you can instead ask us to delete a demo session at any time (see below).

Sub-processor. Before we generate the critique, your demo image is sent to OpenAI (US) for content moderation and AI analysis, exactly as it is for account critiques. OpenAI acts as our sub-processor for this step; the transfer safeguards (Standard Contractual Clauses and the EU-U.S. Data Privacy Framework) are described in Section 5 (Third-Party Sub-Processors) and Section 6 (International Data Transfers).

EXIF metadata. As with account uploads, we read a limited set of photographic and editing metadata from your demo image (camera make and model, lens, exposure settings, and any editing settings the file records) to inform the critique. GPS location data is always stripped and is never stored. See Section 2.3 for the full list of EXIF fields we read.

IP address retention. What happens to the IP address recorded with a demo session depends on whether you go on to create an account:

These periods apply to the IP address itself. Our product analytics separately keep a daily-changing hash of it (see Section 2.15a), and when a demo fails our server logs record the same hash. Our hosting provider, Vercel, keeps those server logs for up to 30 days and then deletes them.

2.15 Cookies and Local Storage

FinalFrame stores your cookie consent preference (“accepted” or “rejected”) in localStorage and in a matchingff_consent cookie, so the choice can be honoured on our servers as well as in your browser. Supabase Auth uses its own cookies/storage for session management. FinalFrame also remembers some interface choices you make on a device in localStorage, and keeps profile changes you have not yet saved in the sessionStorage of the browser tab you are editing in. See Section 9 for full details.

2.15a Telemetry and Analytics Stream

FinalFrame uses PostHog (EU Cloud instance at eu.i.posthog.com, hosted in Frankfurt, Germany) to log structured product-analytics events. This subsection names every event our servers send, grouped by purpose, and discloses the data fields each group carries (an event carries some or all of the fields listed for its group), the lawful basis for each, and your rights relating to this data. Events your browser sends are covered by Section 9.2 and are sent only if you accepted analytics cookies; the first row of the table shows one of them, the sign-up event.

Event types and lawful basis

EventData fieldsLawful basis
signup_completed (sent from your browser)method, whether a confirmation email is needed, whether you arrived through a referral link, source (direct, demo or shared link), whether the page ran in an in-app browser, and the demo tier or call to action that brought you, if anyArt. 6(1)(a): your consent. Sent only if you accepted analytics cookies.
signup_provisioned (acquisition fields)acquisition_source, acquisition_medium, acquisition_campaign (marketing parameters from the link you arrived through), landing_referrer_host (the host name of the referring site only, e.g. news.ycombinator.com; never the full address, path, or query), signup_device (phone, tablet or computer), referral (whether you arrived through a referral link), demo_converted (whether you tried the demo first), plan, localeArt. 6(1)(f): legitimate interest. We record which marketing channel brought you to FinalFrame, read once from the page URL and the referring site (when you sign up, or on your demo visit if you ran a demo first) and, only if you accepted cookies, from the first-touch campaign cookies described in Section 9.2, so we can measure which acquisition channels are effective. We store the referring site’s host name only, never the full referrer URL. We do not profile you or make any automated decision from this data, and without your consent we set no cookie to collect it. Our interest is understanding how people find the product; it is proportionate given the data is minimal and internal-only. You have the right to object to this processing at any time (Art. 21(1)): see Section 8 (Your Rights).
Using the product: critique_started, critique_completed, critique_failed, paid_user_first_critique_completed, iteration_started, iteration_completed, iteration_failed, duplicate_upload_resolved, near_duplicate_measure, near_duplicate_reupload, over_edit_visual, comparison_started, comparison_completed, comparison_failed, comparison_disqualified_refund, curation_started, curation_completed, curation_failed, curation_iteration_completed, curation_iteration_failed, curation_result_viewed, curation_critique_cta_clicked, coaching_brief_unlocked, coaching_brief_emitted, coaching_brief_refresh_gated, share_link_created, gallery_published, challenge_entry_created, badge_rendered, project_delete_storage_deferreduser_id; your plan; the feature and the options you chose (lane, curation goal, number of images, the screen you started from, how the credit was paid for and, for a new version, your credit balance in broad bands); the identifiers of the project, version, critique, curation set, image or challenge concerned; the result in summary form (score and tier, the categories the critique named, the AI model that wrote it, whether it judged the image not to be a photograph or to be AI-generated, and the outcome of our automatic checks on it, such as over-editing or a suggested crop that did not fit; for a comparison, which image came out ahead and how confidently, both scores and how many categories each won; for a curation, summary counts and scores for the set; for a Coaching Brief, its main focus area and how many critiques it drew on); for a new version, how its score and tier changed; when an upload closely matches one of your earlier ones, measurements of how similar the two are (never the images); when something fails, the reason and whether your credit was refunded; for a share link, a one-way hash of its token (never the link itself) and when it was created; and, each time your embeddable badge is loaded, the count and tier it showedArt. 6(1)(f): legitimate interest in measuring how the features are used, whether they work and where they fail, so we can fix and improve them. These events are identified by your user ID, never by your email or name. You have the right to object to this processing at any time (Art. 21(1)): see Section 8 (Your Rights).
Credits, limits and account checks: credit_limit_hit, burst_limit_hit, credit_reset_lazy, concurrency_throttled, verify_gate_blocked, signup_alias_collision_blockeduser_id; your plan; credits remaining, unused or carried over, including at the monthly reset, and the day of your billing cycle; which limit you reached, its size and time window, how long until it frees up and, for the credit limit, how long ago you first submitted a new version of a photo; which action you tried before confirming your email address; and, when a sign-up is stopped because a confirmed account already uses the same mailbox, the kind of email that was requested (never the address)Art. 6(1)(f): legitimate interest in keeping usage limits fair, the service stable under load and sign-ups free of abuse, and in checking that these controls work. You have the right to object to this processing at any time (Art. 21(1)): see Section 8 (Your Rights).
Referral program, between accounts: referral_code_created, referral_signup_linked, referral_signup_skipped, referral_reward_granted, referral_reward_received, referral_cap_exceededuser_id; the reward credits; the referrer’s number of referrals when the reward limit is reached; and, when a referral is not credited, the reason (an unknown code, a suspended account or a self-referral)Art. 6(1)(f): legitimate interest in running the referral program and preventing referral fraud. You have the right to object to this processing at any time (Art. 21(1)): see Section 8 (Your Rights).
Billing and subscription: checkout_started, subscription_activated, subscription_renewed, subscription_changed, subscription_reactivated, credits_purchased, payment_recovered, cancellation_initiated, cancellation_confirmed, subscription_cancel_requested, save_offer_3mo_accepted, subscription_cancel_reversed, subscription_cancelled, subscription_pause_requested, subscription_pause_scheduled, subscription_pause_canceled, subscription_paused, subscription_resume_requested, subscription_resumed, refund_processed, subscription_refunded, subscription_partial_refunded, credit_pack_refunded, subscription_chargedback, chargeback_reversal_receiveduser_id; the plan or credit pack (and, on a change, the plans before and after), billing interval, price, amounts paid or refunded and their currency, and the payment provider; renewal number and days since sign-up, since your last renewal or since you cancelled, and days left in the billing period; credits granted, used, unused and carried over, and how much of your allowance you used; a discount code when one was applied; the Paddle transaction or event number; the dates a pause starts and ends or a subscription resumes; for a refund or chargeback, its kind and whether it came within 24 hours of activation; and, for a cancellation or a pause, only the reason you picked from our list, sent as a code (e.g. “too_expensive”). Never your email, name, payment details or a free-text answer.Art. 6(1)(f): legitimate interest in understanding conversion, renewal and churn so we can price and improve the service. Free-text cancel reasons are not forwarded to PostHog. Per-critique AI cost stays in our own records and is not sent to PostHog. You have the right to object to this processing at any time (Art. 21(1)): see Section 8 (Your Rights).
Free demo and referral-link events: demo_critique_completed, demo_conversion_started, demo_conversion_success, demo_conversion_failed, demo_ip_fallback_claim, referral_link_visited, referral_invalid_code_redirectIn place of a user ID: a one-way hash of your IP address combined with the day’s date, so it changes every day. With it: for a finished demo critique, its lane, tier and score; when you sign in with no critiques yet and we check for a demo to import, whether we found one for you, the imported project’s ID, how long it took and, if nothing was imported, the reason; when a demo is matched by IP address rather than by your browser, the demo’s ID and age, the matching window, which lookup matched and whether we accepted the match. Opening a referral link records only that it was opened and whether its code was valid. The internal critique quality checks (the posthoc_gate row below) also run on demo critiques, under the same hash.Art. 6(1)(f): legitimate interest in measuring whether the free demo and referral links lead to sign-ups, and in spotting when a demo is claimed across a shared network (an office, or a mobile carrier that puts many people behind one address) so that nobody imports a stranger’s demo. The hash is pseudonymous, not anonymous: it can be linked back to the IP address it came from, so it remains personal data. These events use no cookie and are sent whether or not you accepted cookies. We keep them for 12 months, like all our PostHog data (see “Retention” below). You have the right to object to this processing at any time (Art. 21(1)): see Section 8 (Your Rights).
posthoc_gate (internal critique quality checks)user_id, gate_event (which check fired, an enumerated name such as a crop-suggestion consistency check, an over-editing check, a slider-sanity check, or an unrecognised-editing-software probe) and that check's own numeric or enumerated result. For the slider-sanity check this includes the slider positions recorded in your file (Section 2.3) and the values the critique suggested. For the editing-software probe it includes the software name string recorded in your file's metadata, which metadata tag carried it, the software agents named in the file's XMP edit history, the XMP namespace names present, the container type, and the camera model. We do not send the image itself. Beyond the fields named above, individual checks can also record one or more short excerpts of the critique text the check evaluated, the internal storage key and record identifiers of the image, project or critique the check ran on, a short label the check itself generated naming the part of the photograph it examined (for example the subject's nearer eye), and the check's own diagnostic values; which fields each check can send is determined by our code, not by who you are. The same events are also written to our server logs, which Sentry (Section 7) captures. Our hosting provider, Vercel, keeps those server logs for up to 30 days and then deletes them.Art. 6(1)(f): legitimate interest in measuring and improving critique quality, for example teaching our editing-software registry a tool it could not name. You have the right to object to this processing at any time (Art. 21(1)): see Section 8 (Your Rights).

New profile columns

As part of the analytics pipeline, we store the following additional fields on your profile record:

AI call cost tracking

We maintain an internal ai_calls table that logs per-request AI cost data (model, token counts, computed cost in USD, call type, success/failure). This table is used exclusively for internal cost monitoring and is never exposed to users via any API or export. It is subject to column-level access controls that prevent any authenticated user from reading it via the database API. Lawful basis: Art. 6(1)(f): legitimate interest in monitoring operational costs. Retention: 24 months, a period we set ourselves for this internal table. It is separate from, and not tied to, the period that applies to our PostHog analytics (see the “Retention” subsection below). Rows that age past this window are purged automatically by a daily background job. These internal cost-monitoring rows are not financial accounting records: Paddle, our payment processor and merchant of record, holds the invoices and financial records subject to longer statutory retention.

PostHog as recipient and data residency

PostHog Inc. (US-domiciled) is our analytics sub-processor. We use PostHog's EU Cloud instance (eu.i.posthog.com), which stores all event data in Frankfurt, Germany. A Data Processing Agreement (DPA) and Standard Contractual Clauses (SCCs) are in place to cover any US-domiciled data access by PostHog staff.

Retention

We retain PostHog event data for no longer than 12 months, the retention period of the PostHog Cloud plan we have chosen for that purpose, after which PostHog deletes it. Our internal AI cost-monitoring data has its own, separately stated period (see the “AI call cost tracking” subsection above), which is not tied to this one.

Right to erasure (§5 cross-reference)

When you submit a deletion request under GDPR Art. 17 (available in Account Settings or by emailing support@finalframe.photo), we delete:

Events recorded under a hashed IP address (the free demo and referral-link row above) are not part of that record, so deleting your account does not remove them; PostHog deletes them at the end of the retention period above. Once your account is gone, or if you never made one, we cannot link them to you on our own: if you want them deleted sooner, email support@finalframe.photo with the IP address and the dates concerned, and we will delete the matching events (Art. 11(2)).

See Section 8.1 (Right to erasure) and Section 7.4 (Account Deletion) for the full deletion cascade.

Regulatory references

Our marketing-attribution capture reads UTM parameters and the referring host from page navigation, not from device storage, so that read falls outside the consent gate of ePrivacy Art. 5(3) (EDPB Guidelines 2/2023 on technical storage and access); the processing of that data rests on legitimate interest (Art. 6(1)(f)). CJEU Planet49 (C-673/17) governs cookie storage and access, which this navigation-read path deliberately avoids. The one exception is the first-touch campaign cookies of Section 9.2: storing UTM values in your browser between visits is storage within ePrivacy Art. 5(3), so those cookies are set only after you accept the cookie banner and are removed when you reject or reset your cookie preferences. The legitimate-interest basis is documented in our internal Legitimate Interest Assessment (LIA) referenced in the DPIA §11.

2.16 Newsletter

We do not currently offer a newsletter or any other email list you can sign up for, and we hold no newsletter subscriber data. If we introduce one, we will update this section before we collect any sign-ups. The emails described in Sections 2.16a to 2.18 go only to account holders, on the lawful basis stated in each section.

2.16a Monthly Recap (Existing Customers)

Monthly progress recap email: a once-a-month summary of your critique activity and progress, sent only to existing paying customers who are drifting: users on a Pro or Premium plan who were active in the last 60 days but not in the last 14 days. This is lifecycle mail about the paid service you already use, not a general newsletter, so it does not use double opt-in.

Lawful basis (two layers). The permission to send it rests on the existing-customer “soft opt-in” under the ePrivacy Directive 2002/58/EC Art. 13(2) (and its UK PECR Reg. 22(3) equivalent), which applies where (a) we obtained your contact details in the course of a sale of a similar product, (b) every message markets only our own similar photography-critique service, and (c) you are offered a simple, free means to refuse this use both when we collect your details and at any time afterwards. The processing of your contact details to prepare and send it rests on our legitimate interest (GDPR Art. 6(1)(f); Recital 47 expressly recognises direct marketing as a legitimate interest). As in Section 2.17, legitimate interest is the basis for processing your data, not a licence for the marketing send itself: the send is permitted by the soft opt-in above.

On by default; opt out at any time. Because it relies on the soft opt-in rather than your explicit consent, this email is on by default (opt-out) for the eligible paying cohort. You were first given a simple, free way to refuse marketing email when you created your account, before any recap is sent, and you can turn this email off at any time thereafter using the emailMonthlyRecap toggle in your account's Email Preferences settings, or the one-click unsubscribe link in every recap email; under GDPR Art. 21(2) an objection to direct marketing is always upheld at once. The email is also suppressed automatically for users on a content-moderation pause, and for any address on our email suppression list, regardless of preference state.

2.17 Win-Back Email Consent

When you cancel a paid subscription, we offer an optional checkbox to receive a short series of win-back emails (up to 3 messages, the last about 60 days after your plan ends). We only send these emails if you explicitly tick the opt-in checkbox at the cancellation confirmation screen, or turn on Win-back emails in your account's Email Preferences settings: pre-ticked boxes are never used.

Lawful basis: Explicit consent (GDPR Art. 6(1)(a)). This is a separate consent moment from the cancellation-reason retention described in Section 2.13, which relies on legitimate interest (Art. 6(1)(f)) to analyse churn patterns. The win-back program is marketing; the reason retention is product analytics. We keep them legally distinct.

Data we log: A timestamp of when you opted in, the IP address and user agent at the moment of consent when you opt in at the cancellation screen (for Art. 7(1) demonstrability), and each win-back email we send to you via our standard email event log. We also record each time you withdraw win-back consent (the date and time of the withdrawal), so that both the start and the end of your consent are demonstrable.

What these emails contain: The 30-day win-back email may remind you what is waiting in your account, using your own account data: how your critique scores changed and how many projects you have and, if your plan before you canceled was Premium, the photographer identity label and the title of the main focus area from your latest Coaching Brief (Section 2.12). The Coaching Brief lines are left out when the brief is not in your account's language. This uses no data beyond what is already stored in your account; it goes only to your own email address, through our email provider (Resend, Section 5); and withdrawing consent stops it with the rest of the series. Win-back emails sent on the soft opt-in basis described below contain none of it.

How to withdraw consent: Click the unsubscribe link in any win-back email (ends the entire 3-message series instantly), toggle off win-back emails in your account settings, or click the global unsubscribe link in any of our marketing emails. Per GDPR Art. 7(3), withdrawing consent is as easy as giving it.

Involuntary (failed-payment) churn: soft opt-in basis. If your paid subscription ends not because you actively canceled but because we could not collect payment after the full dunning retry cycle, we may send the same short win-back series to the email address you gave us when you subscribed. For this cohort the lawful basis is not explicit consent and is not legitimate interest (GDPR Art. 6(1)(f) does not license a direct-marketing send): it is the existing-customer “soft opt-in” under the ePrivacy Directive 2002/58/EC Art. 13(2) (and its UK PECR Reg. 22(3) equivalent). That exemption requires that (a) we obtained your contact details in the course of a sale of a similar product, (b) every message markets only our own similar photography-critique service, and (c) you are offered a simple, free means to refuse this use: available at any time via your account settings, the global marketing-unsubscribe link, and a one-click unsubscribe in every message we send.

How you can refuse: at signup and at any time: The simple, free opportunity to refuse these emails is offered to you at the point of signup: when you create your account we tell you we may send occasional marketing emails about the FinalFrame service and give you a one-step way to opt out before any is sent. That same refusal also covers this win-back series. You can additionally opt out at any later time via the win-back toggle in your account settings, the global marketing-unsubscribe link, or the one-click unsubscribe link in every win-back message. Opting out at signup, or using the global unsubscribe at any time, stops this series together with all our other marketing email. The footer of win-back emails to this cohort identifies you as a former FinalFrame subscriber rather than claiming you opted in, so the basis is never misrepresented.

Right to object (GDPR Art. 21(2)): immediate opt-out. You have an absolute right to object to direct marketing at any time. For the soft opt-in cohort, exercising that right via any of the routes above stops the entire win-back series immediately and with no further messages; we do not require a reason and there is no balancing test: an objection to direct marketing is always upheld at once.

2.18 Onboarding and Activation Emails

When you create a FinalFrame account, we send a short series of onboarding emails over your first few days (currently up to three messages within roughly 72 hours): getting-started guidance, a walkthrough of core features, and an explanation of what the Premium tier and Coaching Brief add. Their purpose is to help you activate and get value from the service you signed up for.

Lawful basis. These are first-party service and activation communications about the product you registered for: not a generic newsletter and not third-party marketing. We rely on performance of a contract (GDPR Art. 6(1)(b)) and our legitimate interest in helping new users successfully adopt the service (Art. 6(1)(f)). We do not rely on the existing-customer “soft opt-in” (ePrivacy Directive Art. 13(2)). That basis applies only where contact details were obtained in the course of a sale, and a free signup is not a sale. We do not treat the default-enabled state as your consent under Art. 6(1)(a).

How to opt out (at any time, before or after any message). Toggle off Getting started emails in your account's Email Preferences settings, click the one-click unsubscribe link in any onboarding email, or use the global marketing-unsubscribe link. Opting out stops the remaining series immediately. These emails are also suppressed for any account on a content-moderation pause, regardless of preference state.

Right to object (GDPR Art. 21(2)). You have an absolute right to object to direct marketing at any time. Exercising it via any route above stops the onboarding series at once: no balancing test, no reason required.

Data we log. Each onboarding email we send is recorded in our standard email event log (the message type and a timestamp), used to sequence the series and to honour your opt-out.

2.19 Contact Email and Messages to Photographers

If you are a photographer. Your profile has an optional contact email field. It is never displayed on the page itself. Setting it enables two separate things, and you can control each one:

We email the address to confirm it belongs to you. When you save a contact email, we send a short message to that address asking whoever reads it to confirm. Until someone does, the contact form does not appear on your profile and we relay nothing: so an address entered by mistake, or by someone else, never receives forwarded messages. The confirmation link is valid for 7 days, and saving the address again sends a new one. We limit how many of these confirmation messages any one address can receive per day.

If you received a confirmation request you did not expect. Someone entered your address on a FinalFrame profile. Ignore the message and nothing happens: no messages are relayed to you and no account of yours is created or changed. The message tells you only that an address was entered; it does not disclose who entered it.

If you are writing to a photographer. When you submit the contact form we collect and store your name, your email address, your message, your IP address, and the time of submission. Your name, email address and message are passed on to the photographer: your email address is placed in the message's reply field so that they can answer you directly, and their reply comes from their own address, not through FinalFrame. We do not verify that the address you enter belongs to you, we do not send you anything at that address, and we do not add you to any mailing list. The IP address is retained for abuse prevention only.

Lawful basis. Legitimate interest (GDPR Art. 6(1)(f)) in operating a correspondence channel that both parties want: the sender chose to write, and the photographer chose to publish a contact address and to leave the channel open. This is correspondence delivery, not marketing; we do not use a message, or a sender's address, to send FinalFrame's own promotional email.

Retention. Relay records, including refused submissions, are permanently deleted after 90 days (Section 7.7). The delivered message itself lives in the photographer's own mailbox after that point and is outside our control. Reporting a message does not extend that window: the relay record is deleted on the same schedule either way, and the copy you forward to support@finalframe.photo is what we work from.

Abuse. Automated bot checks, per-sender and per-recipient rate limits, and content limits apply to every submission. To report an abusive message, forward it to support@finalframe.photo: do not reply to it, since replying discloses your own address to the sender.

2.20 Notifications on Your Devices and the Installed App

Off by default. FinalFrame can tell you, on a device you choose, when a critique or an iteration critique is ready. Nothing is sent until you tap a button that says so and your browser then asks for its own permission. We never use this channel for marketing or reminders; it carries exactly two events, “your critique is ready” and “your iteration critique is ready”.

What we store when you turn it on. Your browser gives us a subscription: a delivery address (a web address at your browser's push service) and two encryption keys that belong to that browser. We keep it linked to your account, together with the device class (iPhone or iPad, Android, desktop or other) and the language you were using, so the notification is written in that language. If you turn notifications on on several devices, each one receives them. We delete a subscription when you turn notifications off on that device, when you sign out from the menu (what we keep then is described under “Signing out and back in” below), when the push service tells us it no longer exists (for example after you block notifications for FinalFrame in your browser), after repeated failed deliveries, or when you delete your account (Section 7.4). If someone else signs in to FinalFrame in the same browser and turns notifications on, the subscription moves to their account and is no longer linked to yours.

Who carries the message. A notification travels through the push service of the company that makes the browser you turned it on in: Apple for Safari and for FinalFrame added to an iPhone or iPad home screen, Google for Chrome and most other Chromium-based browsers, Microsoft for Edge, and Mozilla for Firefox. We encrypt the message on our server for your browser's keys before it leaves us, so the push service relays a sealed envelope it cannot read; it can still see that FinalFrame sent a message to that browser, and when. Because the notification can appear on your lock screen, its text is generic: one of the two lines above and a link that opens the project, never the photo, its title, a score or your name.

Quiet when you are already looking. If the critique finishes while you have FinalFrame open in front of you, we note that on our side and do not send the notification for it. That note is a timestamp on the notification record and nothing more.

The home-screen app. You can add FinalFrame to your phone's home screen; on iPhone this is the only way to receive notifications. The icon opens an address ending in ?source=pwa, which is the same for everyone (Section 9.1). If you have accepted analytics cookies, we record a launch from the icon, whether our server sees that address or the app notices it is running from the home screen: the date and the device class, linked to your account, at most one entry per device class per day. Separately, and again only if you have accepted analytics cookies, when you open the dashboard, start a critique or open the home-screen app on a phone or tablet running iOS or Android, we note the date and which of the two it runs, at most once a day, working it out from the browser identification (user agent) your browser sends with every request; on any other system we note nothing. We use both to measure whether FinalFrame is used as an installed app, and the launch entries also to stop showing you the iPhone how-to once you have opened FinalFrame from your home screen. We share neither with anyone, and neither follows you to other sites. We delete each launch entry after 90 days; the phone-use time is replaced the next time you use FinalFrame on that kind of device and deleted after 90 days without use, when you withdraw your consent (below) or with your account.

Lawful basis. Sending the notifications you turned on, and keeping the subscription, the note described above and the sign-out record described below that make them work, is part of our contract with you (Art. 6(1)(b)). The launch entries and the phone-use time rest on your consent to analytics (Art. 6(1)(a)), which you can withdraw at any time through “Manage cookie preferences”. Withdrawing stops anything new being recorded from that browser and, if you withdraw through the banner or “Manage cookie preferences” while signed in, deletes the launch entries and the phone-use time we hold for your account; if you withdrew while signed out or by clearing your browser's cookies, email us and we delete them (Section 8).

Turning it off. Account → Notifications → “Notifications on this device” removes that device's subscription. Your browser's site settings for finalframe.photo do the same from its side. If you block notifications there, we never show the browser's permission request again on that device; in FinalFrame added to a phone's home screen, a notice may say where to allow them, a few times at most. If you leave a device without signing out and your session ends on its own, that device keeps receiving these notifications until they are turned off on it or someone else turns them on there; to have it removed without the device, email us (Section 8).

Signing out and back in. Signing out from the menu stops notifications to that device. We delete its subscription and keep one small record with your account: a one-way code made from the delivery address, which cannot be used to send anything, and the time you signed out. While we hold that record, signing in to the same account in that browser turns notifications back on without asking you again, as long as the browser still holds its subscription and its own note of the sign-out (Section 9.1), and still allows notifications. A different account signing in there gets nothing from it. We delete the record when notifications come back on, when someone else turns notifications on in that browser, and in any case after 90 days; after that you can turn them on again from Account. To stop them on a device for good, turn them off there before you sign out; to have the record removed afterwards, email us (Section 8).

3. How We Use Your Data

We use the data described above for the following purposes:

We do not use your images to train AI models. Your photographs are sent to the OpenAI API solely for real-time critique. Under OpenAI's API data usage policy, API inputs and outputs are not used to train their models.

We do not sell your personal data. We do not share your data with third parties for their own marketing purposes.

4. Lawful Basis for Processing (GDPR)

If you are in the European Economic Area, the United Kingdom, or another jurisdiction where lawful basis is required, we rely on the following legal grounds:

5. Third-Party Sub-Processors

Your data is shared with the following service providers, each for a specific purpose. We have data processing agreements in place where required.

6. International Data Transfers

FinalFrame is operated by Crypto Brains DOO from Serbia. Most of our sub-processors listed above are US-based companies. If you are accessing the service from within the EEA or UK, your data will be transferred to and processed in the United States and Serbia.

For transfers from the EEA/UK, we rely on:

If you have concerns about international data transfers, please contact us at support@finalframe.photo.

7. Data Retention

Retention periods depend on your plan:

7.1 Free Plan

7.2 Pro Plan ($19/month) and Premium Plan ($36/month)

7.3 Purchased Credit Packs

7.4 Account Deletion

7.4a Billing Communications and Paddle (Merchant of Record)

Billing is processed by Paddle (“Paddle”) acting as our Merchant of Record. Paddle issues transaction receipts directly to the payment method on file and is responsible for VAT, sales tax, and GST collection and remittance. FinalFrame does not send a separate billing receipt for renewal charges.

Billing records (subscription_events, and the billing-tied rows of admin_audit_log as defined in Section 12.1) are retained for 10 years after the related transaction, in line with the Serbian rules for our billing books and records (Law on Accounting Art. 28: journal and general ledger kept ten years; Law on Tax Procedure and Tax Administration Art. 114: the ten-year absolute tax-limitation period). Paddle, as our Merchant of Record and the issuer of your invoice, is separately subject to its own invoice-retention obligations (including the EU One-Stop-Shop ten-year rule, Art. 369k of the VAT Directive), which attach to Paddle, not to us. This retention is a legal obligation under GDPR Art. 17(3)(b): even if you delete your account, the billing records described above are retained for the full 10-year window, but personal identifiers (your user_id) are dissociated from those rows at deletion time so the rows persist as pseudonymous accounting records. As with the moderation records in Section 7.4, these are pseudonymous rather than anonymous: the row keeps the Paddle transaction, refund and event identifiers alongside a one-way hash of your email address, so we can re-link it to you for finance, audit or chargeback-defence purposes. They therefore remain personal data under Art. 4(5) GDPR, and the rights set out in Section 8.1 apply to them. Because this retention is mandated by law, we cannot delete these rows before the 10-year period ends, even on an Art. 17 erasure request; we will restrict processing on request instead (Art. 18). Administrative audit rows that are not part of the billing record, such as moderation actions, appeal outcomes, reinstatements, regenerating your share tokens, threshold changes, and administrative reads of your data, are not covered by this ten-year obligation: they are retained for 36 months from the action, as set out in Section 12.1. If you delete your account before that period ends, your user ID is set to null on those rows, but the record itself persists until the 36 months elapse, as described in Section 7.4. Your rights over that processing, including the right to object, are set out in Section 8.1. Our billing_webhook_failures log is a separate short-lived operational record used to detect and resolve failed payment-provider webhooks; resolved entries are automatically purged 30 days after they are recorded. An entry that is still unresolved is retained until the underlying payment-provider failure is resolved, and is then purged on that same 30-day schedule: it is not deleted on a timer, because an unresolved payment failure is the record we need in order to correct your billing. Each entry also stores a full copy of the notification the payment provider sent us, so that a failed notification can be processed again once the fault is fixed. For a payment, that copy may include the name on the card, the card brand, its last four digits and its expiry date, or the email address of a PayPal account, but never the full card number or security code. The copy is deleted once the entry is 90 days old, even if the entry is still unresolved; an entry resolved before then is purged together with its copy on the 30-day schedule above. The rest of the entry (the type and reference of the event, your customer ID at the payment provider, the amounts involved, the error we encountered and, once resolved, how it was resolved) is kept for the periods above. It is not a statutory accounting record subject to the 10-year period. Paddle, our Merchant of Record, retains separate billing data under its own retention policy: see Paddle's privacy policy for their specifics.

If your account is paused for a content-moderation review, we suppress our own billing-related communications (including upgrade prompts and plan-change confirmations) to avoid sending conflicting signals while the review is open. Paddle, as the legal seller of your subscription, may continue to send tax documents, receipts, or regulatory notices directly to your payment-method email address. You can request an export of the Paddle-held transaction history at any time by contacting privacy@paddle.com.

7.5 In-App Deletion (Soft Delete)

When you delete individual comparisons or projects within the app, the data is soft-deleted and retained for 30 days to allow recovery in case of accidental deletion. After 30 days, soft-deleted records are permanently purged. Full account deletion (Section 7.4) bypasses the soft-delete period and permanently removes all data immediately.

7.6 Demo Sessions

7.7 Portfolio Contact Messages

8. Your Rights

8.1 Rights Under GDPR (EEA/UK Residents)

If you are in the EEA or UK, you have the following rights under GDPR Articles 15–22. Because we are established in Serbia, you have the same rights under Serbia's Law on Personal Data Protection wherever you live:

To exercise any of these rights, email us at support@finalframe.photo. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection supervisory authority, or with the Serbian Commissioner for Information of Public Importance and Personal Data Protection (Poverenik), which supervises us as a company established in Serbia.

8.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the right to:

To exercise these rights, email us at support@finalframe.photo or use the account deletion feature in Account Settings.

9. Cookies and Tracking Technologies

FinalFrame takes a consent-first approach to tracking:

9.1 Essential (Always Active)

9.2 Analytics and Performance (Consent Required)

The following are only activated after you click “Accept” on the cookie consent banner:

If you click “Reject,” none of the consent-gated technologies are activated. You can change your preference at any time using the “Manage cookie preferences” option in the page footer or in your account settings.

Withdrawing your consent (“Reject”, or “Manage cookie preferences”) takes effect at once, without reloading the page: the technologies above stop collecting, and PostHog's identifier (the ph_ff_ph cookie, which otherwise expires a year after it was last refreshed, and the localStorage entry of the same name, which has no expiry of its own) is removed from your browser. PostHog keeps a small marker in localStorage recording only that you opted out. Withdrawal does not affect the lawfulness of what was collected before it. Product-usage events your browser recorded before you withdrew but had not yet sent can still reach PostHog afterwards: normally within a few seconds, or later while the page stays open if an earlier attempt to send them failed. Data already sent is kept for the periods in Sections 2.15a, 5 and 7 and then deleted; to have your PostHog events or Sentry session replays deleted sooner, contact us (Section 8).

10. Children's Data

FinalFrame is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child under 16 has created an account, please contact us at support@finalframe.photo and we will promptly delete the account and all associated data.

11. Biometric Data

Photographs you upload may contain images of people. We want to be clear about what our AI does and does not do:

Our AI analyzes photographs for composition, lighting, color, technical quality, and artistic merit. When people appear in photographs, the AI may assess compositional elements (e.g., subject placement, posing, expression as it relates to mood) but does not perform any biometric measurement or identification.

This distinction matters under laws like the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and similar state laws. Since we do not collect, capture, or store biometric identifiers or biometric information, these laws do not apply to FinalFrame's image analysis.

12. Security Measures

We take the following measures to protect your data:

No system is perfectly secure. If you discover a security vulnerability, please report it responsibly to support@finalframe.photo.

12.1 Administrative Access and Audit Trail

Where administrative access is exercised, the following controls apply:

Our internal Data Protection Impact Assessment (DPIA), referenced in Section 2.15, contains the underlying analysis for these controls (DPIA §1.4 administrative-access scope and §3.5 moderation-threshold authority).

12.2 Personal Data Breach Notification

Despite the safeguards above, no system is immune to security incidents. If we become aware of a personal data breach (the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to your personal data), we will respond in accordance with our internal incident-response procedure as follows:

The detection, assessment, containment, and reporting workflow that governs this commitment is documented in our internal Data Protection Impact Assessment (DPIA §4.3).

13. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, our sub-processors, or applicable law. When we make material changes, we will:

We encourage you to review this policy periodically. Your continued use of FinalFrame after changes take effect constitutes acceptance of the updated policy.

14. Contact Us

For any questions, concerns, or requests related to this privacy policy or your personal data, please contact:

We aim to respond to all privacy-related inquiries within 30 days.

This privacy policy was drafted for attorney review and is not a substitute for formal legal advice. If you have specific legal concerns, we recommend consulting a qualified attorney in your jurisdiction.