Your data, handled with care

Who is responsible for your data?

Division by Heroes e.U.
Liniengasse 48/22, 1060 Vienna, Austria
Email: support@bgfree.app

We are the controller for the personal data described in this notice. For privacy questions or requests, contact us at the email above.

What information do we process?

• Account details: email address, authentication identifiers and any profile details you provide through Supabase Auth.
• Workspace and service records: organization and membership details, API key name and prefix (the full secret is shown once and only its digest is stored), request status, image format and size, usage, errors, and service timing.
• Billing records: Stripe customer, subscription, payment and invoice identifiers, plan, amount, currency, billing status and invoice link. Card details are handled by Stripe and are not stored by bgfree.app.
• Images and request data: the image bytes and options you submit, including a public image URL or encoded image if you choose those inputs. Images may contain personal data such as a person’s face.
• Security and diagnostics: request identifiers, technical logs, and network information used for abuse prevention. Anonymous upload sessions use a one-way hash of the network address; Cloudflare Turnstile receives the request IP address for verification.
• Preferences and correspondence: your cookie choice, privacy requests, and information you include in messages to support.

Why do we use it?

• Contract: to provide accounts, workspaces, background removal, API access, support, subscription management and payment-related services you request.
• Legitimate interests: to protect the service, detect abuse, enforce rate limits, troubleshoot errors and maintain security, balanced against your rights.
• Consent: to load Vercel Analytics when you enable analytics in cookie settings. You can withdraw consent at any time.
• Legal obligations and claims: to keep required business records, respond to lawful requests, and establish, exercise or defend legal claims where necessary.

How image processing works

The API processes uploaded image data in memory and does not save the image or generated result to bgfree.app storage. The image is sent to Replicate to run the selected background-removal model, and the result is returned to your browser or API client. Authenticated API requests create service records such as format, byte counts, status, usage and processing time, but not the image itself. If you submit a public image URL, the API fetches that image for processing.

Replicate acts as an external processing provider. Its handling of request data is also subject to its service configuration and terms. Do not upload images unless you have the rights and authority to do so.

Who receives data?

We share only what is needed to operate the service with these providers:

• Supabase: account authentication and the database for account, workspace, usage and billing records.
• Replicate: image inference for background removal.
• Stripe: checkout, subscription and payment processing.
• Cloudflare: Turnstile security verification and, where configured, network delivery and protection.
• Vercel: website delivery and consent-enabled analytics.
• Infrastructure and communications providers: hosting, monitoring and email delivery needed to run the service or answer you.

These providers process data under their service terms and applicable data-protection agreements. Depending on provider configuration, data may be processed outside the European Economic Area. Contact us for information about the safeguards applicable to a particular processing activity.

How long do we keep information?

Image bytes and generated results are held in API memory only for the request and are not retained in bgfree.app image storage. Anonymous security counters expire according to their short rate-limit windows; a used Turnstile token digest is kept in Redis for five minutes. Account, workspace, API usage, billing, support and security records are kept while needed to provide the service, meet accounting and legal obligations, resolve disputes, and protect the service. The system does not currently apply one fixed deletion schedule to every record type; some records may remain after account closure where retention is legally required or necessary for security and claims.

Cookies and analytics

Your privacy rights

Depending on the circumstances, you may request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests, or withdraw consent for consent-based processing. Withdrawal does not affect processing that took place before withdrawal. Some information may need to be retained where the law requires it or where it is needed for legal claims.

Submit an export or deletion request from your account privacy settings, or email support@bgfree.app. The account form records your request so we can follow up; it does not perform an instant export or deletion. We may ask for information to verify your identity. You can also lodge a complaint with the Austrian Data Protection Authority.

Security, children and updates

We use access controls and technical safeguards appropriate to the service, but no internet transmission or storage system can be guaranteed completely secure. The service is not designed for children under 16, and we do not knowingly invite them to create accounts. If you believe a child has provided personal data, contact us.

We may update this notice as the service or legal requirements change. We will publish the current version here and update the date above.