Privacy Policy
Last updated: October 13, 2026
This Privacy Policy describes how FindPreset processes personal data when you use our website and Service.
1. Data controller
Controller: Ing. Radek Svoboda, OSVČ
IČO: 02393131
DIČ: CZ9307155099
Registered address: Slovanská 1870, 684 01 Slavkov u Brna, Czech Republic
Email: support@findpreset.com
We are not legally required to appoint a Data Protection Officer under Article 37 GDPR; the contact above serves as the privacy contact.
You have the right to lodge a complaint with the Czech data protection authority:
Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.cz
2. What we collect and why
| Data | Source | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Email address | You (signup) | Account identity, service communications | Contract performance (Art. 6(1)(b)) |
| Name (if provided by social login) | Google OAuth | Display in your account | Contract performance |
| Uploaded images | You | AI or exact processing to generate presets | Contract performance |
| Reduced-size copies of uploaded images | Service processing | Recent extractions display, support requests, and checking and improving extraction quality | Contract performance and legitimate interest (Art. 6(1)(f)) |
| Operational 200×200 thumbnails | Service processing | Monitoring that extraction is working | Legitimate interest (Art. 6(1)(f)) |
| Generated presets | Service processing | History feature, downloads | Contract performance |
| IP address, user agent, error reports (page address, browser, screen size, account ID if signed in) | Browser | Security, abuse prevention, basic logs, fixing errors | Legitimate interest (Art. 6(1)(f)) |
| Lightroom settings text from a photo whose settings we could not copy exactly, with other details blanked out (never the photo) | Your browser, read from your photo | Finding and fixing problems in exact extraction | Legitimate interest (Art. 6(1)(f)) |
| Usage analytics (page views, events) | Google Analytics | Improving the Service | Consent (Art. 6(1)(a)), if you accept analytics cookies |
| Basic signals without cookies before or without your consent (a page view or purchase, with the IP address and browser details of the request) | Google Analytics and Google Ads | Aggregate statistics that Google estimates from them | Legitimate interest (Art. 6(1)(f)) |
| Advertising measurement and remarketing (which of our ads led to a visit or purchase; showing our ads to people who visited) | Google Analytics and Google Ads | Measuring and improving our advertising | Consent (Art. 6(1)(a)), if you accept marketing cookies |
| Product usage events (pages viewed, the site or campaign you came from, steps taken in a tool, whether you are signed in, device type, country), stored with no identifier that links your visits | Our own server | Measuring how people find and use the Service, and where they drop off | Legitimate interest (Art. 6(1)(f)) |
| Subscription status, payment email | LemonSqueezy webhooks | Service entitlement and access control | Contract performance |
| Marketing email preference and consent history | You (optional signup checkbox or account settings) | Sending product news, free presets and offers only if you opted in | Consent (Art. 6(1)(a)) |
We do not sell, rent, or trade your personal data.
Marketing emails: we send them only if you explicitly opt in, via the checkbox at signup or the toggle in your account settings. Every marketing email contains an unsubscribe link, and you can withdraw consent at any time in Billing & Profile. We keep a record of when and how consent was given or withdrawn, as GDPR requires. Transactional emails (sign-in codes, receipts) are part of the service and sent regardless.
3. Image handling specifically
AI mode: your image is transmitted to Anthropic, PBC (USA) for processing via the Claude API. Anthropic's API terms state that they do not train models on customer API inputs and retain inputs only for limited abuse-detection purposes (typically not exceeding 30 days). You can request deletion at any time.
EXIF mode: your browser reads the Lightroom settings saved in your photo and sends them to our server with the image, and we make the preset there. Neither is transmitted to any AI provider. The same storage described below applies.
What we keep: if you are signed in, we save a reduced-size copy of the images you upload, up to 1024 pixels on the longest edge, alongside the generated preset. We use it to show your recent extractions, to answer support requests about a specific result, and to check and improve the quality of our extraction. Members of our team may view these images for those purposes. Location data, camera serial numbers and other embedded metadata are stripped before the copy is stored.
Original full-size images are not retained. They are discarded once processing completes. Reduced-size copies are deleted after 90 days, or sooner on request.
Operational thumbnails: separately from the above, every extraction adds a 200×200 pixel thumbnail to an internal feed we use to monitor that the service is working. This happens whether or not you are signed in. We keep only the 30 most recent, so each one is removed as newer extractions replace it.
Settings we could not copy: if our exact extraction cannot copy the Lightroom settings saved in your photo into your preset as they are, we keep the text that holds those settings for 14 days to find and fix the problem, then delete it. We never keep the photo for this. It happens whether or not you are signed in, and only our team can read it. Before it is stored, every letter and digit in it is replaced with a placeholder, except in the editing settings, the field names and other technical labels, and the name and version of the software that saved the photo. This blanks out names, location, camera serial numbers, contact details, keywords, titles, descriptions, file names and the file's history. The layout of the text stays, so we can see where it breaks.
4. Third-party processors
We rely on the following processors who handle personal data on our behalf under Data Processing Agreements (DPAs):
| Processor | Role | Country | Transfer mechanism |
|---|---|---|---|
| Supabase Inc. | Database hosting | USA | Standard Contractual Clauses |
| Clerk, Inc. | Authentication | USA | Standard Contractual Clauses |
| Anthropic, PBC | AI processing | USA | Standard Contractual Clauses |
| Vercel Inc. | Hosting and edge network | USA | Standard Contractual Clauses |
| Lemon Squeezy Inc. | Payment processing (merchant of record) | USA | Standard Contractual Clauses |
| Google LLC | Analytics and advertising (Google Analytics, Google Ads) | USA | Standard Contractual Clauses |
Standard Contractual Clauses (SCCs) are the EU Commission-approved mechanism for transferring personal data to countries without an adequacy decision under GDPR Article 46.
5. Retention
- Account data: retained for the lifetime of your account, plus 12 months after deletion for legal and accounting purposes.
- Generated extractions in history: kept in your account so you can download them again, up to your 500 most recent. Deleted when you delete them, or on request.
- Reduced-size copies of uploaded images: retained for 90 days, then auto-deleted. The generated preset is kept; only the image expires.
- Original full-size images: not retained, discarded after processing.
- Operational 200×200 thumbnails: only the 30 most recent are kept; each is deleted as newer extractions replace it.
- Settings we could not copy: 14 days, then auto-deleted. Text only, never the photo.
- Product usage events: 90 days, then deleted.
- Error logs: 30 days, then deleted. A log of a failed payment or refund step is kept for 12 months, so we can put it right.
- Invoicing data (via LemonSqueezy): 10 years, as required by Czech accounting law.
6. Your rights under GDPR
You have the right to:
- Access your personal data (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure ("right to be forgotten", Art. 17)
- Restriction of processing (Art. 18)
- Data portability: receive your data in a machine-readable format (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time, where consent is the legal basis (Art. 7)
- Lodge a complaint with ÚOOÚ or your local supervisory authority
To exercise any of these rights, email support@findpreset.com. We will respond within 30 days.
7. Cookies
| Cookie | Purpose | Type | Retention |
|---|---|---|---|
| Clerk session cookies (__session, __clerk_*) | Authentication | Strictly necessary | Session |
| cc_cookie | Remembers your cookie choice | Strictly necessary | 6 months |
| fp_ref | Remembers the referral link you arrived from, so the person who invited you can be credited. Set only when you open a referral link. | Functional | 30 days, or until you sign in |
| _ga, _ga_BERRE797TR (Google Analytics) | Recognizes repeat visits from the same browser, so we can count visitors and sessions | Analytics, only with your consent | Up to 2 years from your last visit |
| Google advertising cookies (such as _gcl_au, and cookies Google sets on its own domains) | Measure which of our ads led to a visit or purchase, and let us show our ads to people who visited (remarketing) | Marketing, only with your consent | Up to 13 months |
Google Analytics and Google Ads set their cookies only if you accept them in the cookie banner: analytics cookies under Analytics, advertising cookies under Marketing. Until you choose, and if you reject them, Google's tags set no cookies and send Google only basic signals without cookies (for example, that a page was viewed or a purchase was made, with the IP address and browser details every web request carries), which Google uses to estimate statistics in aggregate. With marketing cookies, Google can recognize your browser across other websites to measure and show our ads. You can change or withdraw your choice at any time with Cookie settings at the bottom of every page; withdrawing deletes the Google cookies stored under findpreset.com. You can also block or delete cookies in your browser settings.
Our own product usage events set no cookie and store no identifier on your device. If your browser sends the Global Privacy Control signal, we record no product usage events from it. We look at these events in aggregate and do not link them to your account. You can object to this processing under Art. 21 by emailing support@findpreset.com.
8. Security
We apply technical and organizational measures appropriate to the risk, including TLS encryption in transit, encryption at rest by our database provider, access controls limiting personal data to authorized personnel only, and a webhook signature verification layer to prevent forged requests.
9. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-app notice at least 30 days before they take effect.
10. Contact
Email: support@findpreset.com
Postal: Slovanská 1870, 684 01 Slavkov u Brna, Czech Republic