Privacy policy

1. Data controller

• Controller: [[PENDIENTE: nombre y apellidos o razón social del titular]]
• Tax ID (NIF): [[PENDIENTE: NIF o CIF del titular]]
• Address: [[PENDIENTE: domicilio postal completo]]
• Privacy contact email: [[PENDIENTE: email de contacto para privacidad]]
• Data protection officer: [[PENDIENTE: datos de contacto del delegado de protección de datos si se designa; si no hay, borrar esta línea]]

2. What data we process

• Account data: your email address (which is your username), your password (we only store a cryptographic hash of it: nobody can read it, including us), your sign-up date, the date you accepted the terms and privacy policy, and whether you have confirmed your email.
• Usage and balance: your plan, your available credits and upscales, and a log of activity (what action you took, with which quality or model, how many credits or upscales it used, which image or job it relates to, and when).
• Content you upload or generate: the text and instructions (prompts) you write, the reference photos and images you upload to upscale or edit, the images and vectors generated, the characters you save, and titles and keywords. If you upload photos of people, this content may include other people's personal data (see section 9).
• Billing: payments are handled by Stripe on its own page. Stripe processes your name, billing address, country, tax ID (for businesses) and card details. We never see or store your card details: we only store your Stripe customer and subscription IDs, the subscription status, your plan, the end date of the paid period and whether you have asked to cancel.
• Communications: the service emails we send you (email confirmation, password change) and any messages you send us.
• Technical data: the IP address and request data (browser, date and time) that reach our servers. We use your IP address to limit login and sign-up attempts; our hosting providers record it in their technical logs. We also use a session cookie (see the cookie policy).

5. What runs in your browser

Some editor tools (selecting an object and erasing it) run in your own browser: images you edit this way don't leave your device for that task. To work, your browser downloads the required models from Hugging Face and jsDelivr. As with any download, those services see your IP address and browser details, but they don't receive your images.

6. International transfers

Several of our providers are based in the United States or may process data outside the European Economic Area. In those cases, the transfer relies on the EU-U.S. Data Privacy Framework, where the provider is certified, or on the standard contractual clauses approved by the European Commission (Article 46 GDPR). [[PENDIENTE: confirmar mecanismo de cada proveedor (adhesión al Marco de Privacidad de Datos UE-EE. UU. o cláusulas contractuales tipo)]]

You can ask us for more information about the safeguards for each transfer by writing to the privacy email.

7. How long we keep data

• Account, balance and activity data: for as long as you have an account. When you close it, we'll keep it blocked for as long as legal claims may arise and then delete it. [[PENDIENTE: plazo de conservación tras cerrar la cuenta]]
• Images, vectors and text you upload or generate: [[PENDIENTE: plazo de conservación de imágenes]]. Download anything you want to keep: the app is not a backup service.
• Billing data: for as long as tax and accounting laws require (in Spain, up to 6 years for accounting records under Article 30 of the Commercial Code).
• Technical data and server logs: [[PENDIENTE: plazo de conservación de los registros técnicos]].
• Email links: the email confirmation link expires after 7 days and the password reset link after one hour; each can only be used once.

8. Your rights and how to exercise them

You can exercise these rights over your data at any time, free of charge:

• Access: find out what data about you we process.
• Rectification: correct inaccurate data.
• Erasure: ask us to delete it, including closing your account.
• Objection: object to processing based on our legitimate interest.
• Restriction: ask us to stop using it while a complaint is resolved.
• Portability: receive the data you gave us in a commonly used format.

To exercise them, email [[PENDIENTE: email de contacto para privacidad]] from your account email address and tell us which right you want to exercise. If we can't confirm that you own the account, we'll ask you to prove it. We'll reply within one month, which may be extended by two more months for complex requests (we'd let you know).

If you think we haven't handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the data protection authority of your country of residence in the European Union.

9. Other people's data in your content

If you upload photos showing other people (for example, as a reference for a character), you must have their permission or another legal basis to do so. To sell images showing recognizable people, stock sites usually require a signed model release. See the acceptable use section of the terms.

10. Security

We apply technical and organizational measures appropriate to the risk, including:

• Encrypted connection (HTTPS) between your browser and our servers.
• Passwords stored only as a cryptographic hash; changing your password logs out all open sessions.
• Session kept in a signed cookie that JavaScript can't read (HttpOnly).
• Limits on failed login and sign-up attempts.
• Each user can only see their own content and balance.
• Card details never pass through our servers: you enter them on Stripe's checkout page.

11. Minimum age

Stock Creatives is a paid service for professionals and adult individuals. You must not sign up if you are under [[PENDIENTE: edad mínima para usar el servicio]] years old.

12. Changes to this policy

We may update this policy when the service, our providers or the law change. We'll publish the new version on this page with its date and, if the change is significant, we'll let you know by email.