Privacy Policy
Last updated: May 24, 2026
This Privacy Policy describes how FindPreset processes personal data when you use our website and Service.
1. Data controller
Controller: Ing. Radek Svoboda, OSVČ
IČO: 02393131
DIČ: CZ9307155099
Registered address: Slovanská 1870, 684 01 Slavkov u Brna, Czech Republic
Email: support@findpreset.com
We are not legally required to appoint a Data Protection Officer under Article 37 GDPR; the contact above serves as the privacy contact.
You have the right to lodge a complaint with the Czech data protection authority:
Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic — www.uoou.cz
2. What we collect and why
| Data | Source | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Email address | You (signup) | Account identity, service communications | Contract performance (Art. 6(1)(b)) |
| Name (if provided by social login) | Google OAuth | Display in your account | Contract performance |
| Uploaded images | You | AI or exact processing to generate presets | Contract performance |
| Reduced-size copies of uploaded images | Service processing | Recent extractions display, support requests, and checking and improving extraction quality | Contract performance and legitimate interest (Art. 6(1)(f)) |
| Operational 200×200 thumbnails | Service processing | Monitoring that extraction is working | Legitimate interest (Art. 6(1)(f)) |
| Generated presets | Service processing | History feature, downloads | Contract performance |
| IP address, user agent | Browser | Security, abuse prevention, basic logs | Legitimate interest (Art. 6(1)(f)) |
| Usage analytics (page views, events) | Google Analytics | Improving the Service | Consent (Art. 6(1)(a)) |
| Subscription status, payment email | LemonSqueezy webhooks | Service entitlement and access control | Contract performance |
| Marketing email preference and consent history | You (optional signup checkbox or account settings) | Sending product news, free presets and offers only if you opted in | Consent (Art. 6(1)(a)) |
We do not sell, rent, or trade your personal data.
Marketing emails: we send them only if you explicitly opt in, via the checkbox at signup or the toggle in your account settings. Every marketing email contains an unsubscribe link, and you can withdraw consent at any time in Billing & Profile. We keep a record of when and how consent was given or withdrawn, as GDPR requires. Transactional emails (sign-in codes, receipts) are part of the service and sent regardless.
3. Image handling specifically
AI mode: your image is transmitted to Anthropic, PBC (USA) for processing via the Claude API. Anthropic's API terms state that they do not train models on customer API inputs and retain inputs only for limited abuse-detection purposes (typically not exceeding 30 days). You can request deletion at any time.
EXIF mode: processing happens entirely on our server. The image is not transmitted to any AI provider. The same storage described below applies.
What we keep: if you are signed in, we save a reduced-size copy of the images you upload, up to 1024 pixels on the longest edge, alongside the generated preset. We use it to show your recent extractions, to answer support requests about a specific result, and to check and improve the quality of our extraction. Members of our team may view these images for those purposes. Location data, camera serial numbers and other embedded metadata are stripped before the copy is stored.
Original full-size images are not retained. They are discarded once processing completes. Reduced-size copies are deleted after 90 days, or sooner on request.
Operational thumbnails: separately from the above, every extraction adds a 200×200 pixel thumbnail to an internal feed we use to monitor that the service is working. This happens whether or not you are signed in. We keep only the 30 most recent, so each one is removed as newer extractions replace it.
4. Third-party processors
We rely on the following processors who handle personal data on our behalf under Data Processing Agreements (DPAs):
| Processor | Role | Country | Transfer mechanism |
|---|---|---|---|
| Supabase Inc. | Database hosting | USA | Standard Contractual Clauses |
| Clerk, Inc. | Authentication | USA | Standard Contractual Clauses |
| Anthropic, PBC | AI processing | USA | Standard Contractual Clauses |
| Vercel Inc. | Hosting and edge network | USA | Standard Contractual Clauses |
| Lemon Squeezy Inc. | Payment processing (merchant of record) | USA | Standard Contractual Clauses |
| Google LLC | Analytics | USA | Standard Contractual Clauses |
Standard Contractual Clauses (SCCs) are the EU Commission-approved mechanism for transferring personal data to countries without an adequacy decision under GDPR Article 46.
5. Retention
- Account data: retained for the lifetime of your account, plus 12 months after deletion for legal and accounting purposes.
- Generated extractions in history: retained while subscription is active plus 90 days after cancellation. Deleted on earlier request.
- Reduced-size copies of uploaded images: retained for 90 days, then auto-deleted. The generated preset is kept; only the image expires.
- Original full-size images: not retained, discarded after processing.
- Operational 200×200 thumbnails: only the 30 most recent are kept; each is deleted as newer extractions replace it.
- Invoicing data (via LemonSqueezy): 10 years, as required by Czech accounting law.
6. Your rights under GDPR
You have the right to:
- Access your personal data (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure ("right to be forgotten", Art. 17)
- Restriction of processing (Art. 18)
- Data portability: receive your data in a machine-readable format (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time, where consent is the legal basis (Art. 7)
- Lodge a complaint with ÚOOÚ or your local supervisory authority
To exercise any of these rights, email support@findpreset.com. We will respond within 30 days.
7. Cookies
| Cookie | Purpose | Type | Retention |
|---|---|---|---|
| Clerk session cookies (__session, __clerk_*) | Authentication | Strictly necessary | Session |
| _ga, _gid (Google Analytics) | Analytics | Statistical (consent required) | 2 years / 24 hours |
Strictly necessary cookies do not require consent under the ePrivacy Directive. Analytics cookies are loaded only after consent.
8. Security
We apply technical and organizational measures appropriate to the risk, including TLS encryption in transit, encryption at rest by our database provider, access controls limiting personal data to authorized personnel only, and a webhook signature verification layer to prevent forged requests.
9. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-app notice at least 30 days before they take effect.
10. Contact
Email: support@findpreset.com
Postal: Slovanská 1870, 684 01 Slavkov u Brna, Czech Republic