Privacy Policy

Effective date: 2026-10-05
Last updated: 2026-10-05

1. Who is responsible for your data

Dmitry Bykovskikh PR Beograd, a sole proprietorship registered in the Republic of Serbia, is responsible for the personal data described here.

We are the controller of your account, billing, usage, support and security data — we decide why and how it is processed.

For personal data contained in the images you upload — for example a model or an employee presenting your product — you decide what to upload and why, and we process it on your instructions. In that respect you are the controller and we act on your behalf. If you are a business customer in the EU and need a data processing agreement for that, write to privacy@picfinish.com.

Registered address: Resavska 33, stan 1, 11000 Beograd (Vračar), Serbia
Company registration number (matični broj): 67781830
Tax identification number (PIB): 114694433
Privacy contact: privacy@picfinish.com

This policy covers the PicFinish website and web application. It explains what we collect, why, who else sees it, how long we keep it, and what your privacy rights are.

2. What we collect

Account data. Your email address. If you sign in with Google, we receive from Google the basic profile information attached to that account — typically your email address, your name, your profile picture and an account identifier — together with confirmation that the address is verified. We do not receive your Google password, and we have no access to your contacts, files or other Google services. We store when your email was confirmed and when you last signed in.

Profile data. Your name, business name, country and tax number, where you provide them. None of these are required to use the Service.

Images you upload. The photographs you upload for processing, the edited images the Service produces from them, and the thumbnails we create to display your library.

Information embedded in your photographs. Photograph files often carry hidden information, such as where and when the photo was taken, the camera or phone used, and sometimes a name or a comment. We remove it when a photograph is uploaded, before it is stored and before it is sent to any AI provider, and keep only the picture itself. We record only whether the photograph already carried Content Credentials, and whether it carried a marking saying it was made or edited with AI, so that the marking we add can say so when it did. Photographs stored before we began removing this information still carry it in storage, but it is removed before they are sent to any AI provider.

What we add to the images we produce. The AI marking described in our Terms of Service contains no personal data: not your name, your email address, your account, your file names, your instructions or where a photograph was taken. It states that the image was made or edited with AI by PicFinish. Where the photograph you supplied already carried AI marking, it says so. Where a generated person was asked for (by one of our settings or in words you wrote, including when the check of your words could not tell), or the photograph you supplied already said it showed one, it says the image shows one. It usually also carries a time-stamp showing when the marking was added.

Instructions you write. The full text of any prompt or custom instruction you enter, including in Prompt Studio, together with the settings and options you choose. Prompts you save for reuse are stored until you delete them.

Usage data. Which tool was used, when, whether it succeeded, how long it took, how many credits it consumed, and any error returned. We keep the original filename of what you uploaded.

Billing data. Your plan, your credit balance, your purchases, renewals and refunds, identifiers assigned to you or to your transactions by our payment partner, and the amounts and currencies involved. We never receive or store your card number, expiry date or security code — those go directly to our payment partner and never touch our systems.

Acquisition data. Only with your consent to analytics: if you arrived through a campaign link or from another website, we record the campaign tags and the referring address, and on our website also the first page you opened. When you sign up, any campaign tags and referring address recorded this way are saved to your profile.

Analytics and advertising data. Only with your consent, given in our cookie banner as section 10 describes: how you use our website and the application, such as the pages you open and what you click, the device and browser you use, and an approximate location worked out from your IP address. Depending on the tool, this can include an identifier that links your visits together and, once you have signed in, to your account, and whether a visit led to a sign-up or a purchase.

Messages you send us. If you write to us, through the "write to us" form in the application or to one of our mailboxes, support@picfinish.com, billing@picfinish.com, privacy@picfinish.com or abuse@picfinish.com, we keep what you write, your email address, anything you attach and our reply.

Technical data. Server logs containing your account identifier and technical details of requests. These logs also contain the text of the instructions you write, because we need them to diagnose failed generations. We do not write your email address or your name into logs.

3. Why we use it and on what legal basis

What we do	Why	Legal basis
Create and operate your account	To let you sign in and use the Service	Performance of a contract
Edit, store and display your images	This is the Service you asked for	Performance of a contract
Track credits, plans and purchases	To provide what you paid for	Performance of a contract
Send service emails — sign-in links, password resets where you have set a password, account notices	You cannot use the Service without them	Performance of a contract
Provide support	To answer you	Performance of a contract
Screen prompts against our Acceptable Use Policy, and read whether they ask to show a person	To prevent misuse of an AI system, and to mark an image when your text asks for a generated person	Legitimate interests: preventing misuse, including uses our AI providers do not allow, and marking images accurately
Prevent fraud, abuse and payment disputes	To protect the Service and other users	Legitimate interests
Review generation records to fix problems and improve our tools	To make the Service work better	Legitimate interests
Keep records of payments	Serbian accounting and tax law	Legal obligation
Record how you found us	To understand which channels work	Consent
Measure how our website and the application are used, with analytics tools	To understand what works and improve the Service	Consent
Measure our advertising and show it to people who may be interested, with advertising tools	To reach people who may want PicFinish, and to see which advertising works	Consent
Keep the choice you make in our cookie banner	To respect your choice and to be able to show what you chose	Legal obligation
Answer what you send to our mailboxes or through the "write to us" form	To answer you and keep a record of the conversation	Performance of a contract, or legitimate interests where you are not a customer

Where we rely on legitimate interests, you may object — see section 9.

Where we rely on consent, you may withdraw it at any time through the "Cookie Settings" link on our website; withdrawing it does not affect what was done before.

We do not sell your personal data. Apart from the analytics and advertising providers described in section 5, which receive data only with your consent and may then use it under their own terms, we do not share it with third parties for their own marketing purposes.

4. Automated processing

Text you write is screened automatically before it reaches an image model, and a request is refused when it asks for content that section 4 of our Acceptable Use Policy says is refused. This check and the one below are made by an AI text model, reached through the same routing service as our image models; for both checks, the routing service and the model receive only the text you wrote, never your photograph. The initial screening is automated, and its effect is limited: the request is not carried out. It does not by itself close your account or affect you in any legal way. If you believe a refusal was wrong, write to support@picfinish.com and a person will review it. A person may also review prompts, images or account activity when handling a complaint, an appeal, a safety report or a payment dispute.

A second automated check, made at the same time on the same text, reads whether your text asks to show a person. If it does, or if the check cannot tell, the marking on the resulting image says that it shows a generated person, as our Terms of Service describe. This changes nothing else about the request.

Repeated or serious breaches may lead to account suspension. Those decisions are made by a person, not automatically.

5. Who else processes your data

We use a small number of service providers. Most of them act as our processors: they handle data on our instructions under contract and may not use it for their own purposes. A few act as independent controllers for part of what they do, under their own terms; these are identified below.

Hosting and storage. The providers who run our database, file storage, authentication, application servers and web front end.

AI model providers. To produce an image, we send the photograph you uploaded and the instructions you wrote to a routing service, which passes them to the model that creates the result.

We have configured our routing service so that requests are not routed to providers that train on submitted data. A provider may still hold a request briefly — for example to check for abuse or because the law requires it — but it is not permitted to use your images or prompts to train models.

Payments. Our payment partner acts as merchant of record. It receives what it needs to take the payment and issue your receipt. It is an independent controller of that transaction, not our processor, and its own privacy policy applies to it.

Email delivery. The provider that delivers sign-in links and service notifications.

Business email. The provider that hosts our mailboxes, and so receives what you send to support@picfinish.com, billing@picfinish.com, privacy@picfinish.com or abuse@picfinish.com, or through the "write to us" form in the application, which delivers your message to our support mailbox.

Analytics. Google Analytics and PostHog; we use PostHog in its EU region. They receive the analytics data described in section 2, and only if you have agreed to analytics in our cookie banner. Depending on the integration and the settings we use, each acts on our instructions or under its own terms.

Advertising. Google Ads and the Meta pixel. They receive information about your visits, and whether a visit led to a sign-up or a purchase, and only if you have agreed to advertising in our cookie banner. Depending on the integration and the settings we use, each acts on our instructions or under its own terms, in which case its own privacy policy applies to what it does with that information.

Consent management. The provider of our cookie banner, which records the choice you make in it so that we can respect it and show what you chose.

Time-stamping. To time-stamp the AI marking we add to an image, we send an independent time-stamping service, currently DigiCert or, if it does not answer, SSL.com, a fingerprint calculated from the marking. It receives neither the image nor anything about you. The time-stamping services are not our processors: they receive no personal data, and we use their public service under its own terms.

We choose providers that offer appropriate safeguards. If you want to know which providers we currently use, or if you are a business customer who needs a data processing agreement with us, write to privacy@picfinish.com.

6. Where your data is processed

Your account data, your images and our database are hosted in Switzerland, which the European Commission recognises as providing an adequate level of data protection; our application servers and the backup copy of your images are hosted within the European Union. The website itself is delivered through a global content delivery network, which caches pages and static files in many countries — it does not hold your images or your account data.

Your images are edited by AI providers that may process your image and prompt outside the European Economic Area, including in the United States. Where that happens, the transfer is covered by the European Commission's standard contractual clauses or another valid transfer mechanism.

Our payment partner, our email providers and the provider of our cookie banner may also process data outside the EEA on the same basis. The analytics and advertising providers, which receive data only with your consent, may process data outside the EEA, mainly in the United States, under the European Commission's standard contractual clauses or another valid transfer mechanism.

7. How long we keep things

Data	Kept for
Account, profile, images, prompts, library	While your account is open
Images you delete from your library	Moved to Trash when you delete them, and removed from storage when you delete them from Trash, when you empty it, or automatically once they have been in Trash for 30 days (we check daily, so within about a day after that). Every file of the image is removed with it, except a file that another image you have not yet deleted for good (in your library or in Trash) also uses, such as the photograph both were made from or the image an overlay was drawn on; that file is removed with the last image that uses it. While your account is waiting to be deleted, nothing is removed from its Trash automatically: everything in its Trash is deleted with the account, or, if you cancel the deletion, the next daily check removes what has by then been in Trash for 30 days, and the rest follows once its own 30 days have passed. A copy of the file and its database record may then remain in our backups, normally for up to 30 days, as the rows below describe
Server logs, including any instruction text they contain	Up to 30 days
Payment records	As required by Serbian accounting and tax law, after your account is closed
Database backups	Up to 30 days from the date of the backup
Copies of images in our file backup	Normally up to 30 days after the image is removed from our storage; longer only while our backup cannot confirm that it was removed
Analytics data, with your consent	As long as the provider keeps it under the settings and plan we use: in PostHog 1 year on its free plan and 7 years on its paid plans, which it does not let us shorten; in Google Analytics up to 14 months
Advertising data, with your consent	As long as the advertising provider keeps it under its own terms and the settings we use
Your cookie choice	On your device up to 12 months, after which we ask again; the record our banner's provider keeps, as long as it is needed to show what you chose
Messages you send us, and our replies	As long as we need them to answer you and to deal with anything that follows, and longer only where the law requires it or a dispute needs it

When you delete your account, it is deactivated at once. For 30 days you can cancel the deletion, and everything comes back as it was. After that we delete your account data, your profile, the images you uploaded and the images the Service produced from them, your prompts and your library; we check for accounts due for deletion daily, so this normally happens within about a day after the 30 days, and if one of our safety checks holds an account back, a person looks at it before anything is deleted.

Three things survive that deletion:

Payment records, because we are legally required to keep them. They are retained for the statutory period and are not used for anything else.
Backups, which are not edited to remove a single account. Any copy of your data in a backup disappears within 30 days of its deletion from the Service: database backups are rotated out, and copies of images are removed from our file backup, later only while our backup cannot confirm the deletion.
Messages you sent us, analytics and advertising data, and the record of your cookie choice, which are kept for the periods the table above gives, whether or not your account still exists.

8. How we protect your images

Your uploaded images and the edited images the Service produces are stored in private storage. They are not listed publicly, not indexed by search engines, and cannot be browsed by other users.

When the application needs to display an image to you, it creates a temporary signed link. That link works for about an hour and, during that time, will open the file for anyone who has it, without signing in. Treat such links as private — do not paste them into public chats, forums or issue trackers.

Access by us to accounts and images is limited to what is needed to operate and support the Service and to prevent misuse, and access to generation records to that and to improving the Service. A generation record holds the instructions as they were sent to the AI model, including any text you wrote, together with the settings you chose, the model used, the outcome, how long it took, the credits it used and what it cost us; a request our screening refused, or could not check, is recorded with the text you wrote and the reason. People who work on PicFinish for us can read these records, next to your email address, in our administration tools, only for those purposes.

9. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
correct data that is wrong or incomplete;
delete your data;
restrict processing, and object to processing based on legitimate interests;
receive a copy of data you provided, in a machine-readable format, and have it transmitted to another provider where technically feasible;
withdraw consent where processing is based on consent.

From your account settings you can delete your account and download a copy of your account data, your profile and your generation history, including links to your images. That download is a convenience, not the limit of your rights: for a complete copy of everything we hold about you, including the instructions you have written, write to privacy@picfinish.com and we will prepare it.

We respond within one month. If a request is complex we may extend that by two further months and will tell you why.

If you believe we have handled your data improperly, you may complain to a data protection authority. In the European Union that is the authority in the country where you live or work. Because we are established in Serbia, you may also complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection.

10. Cookies and local storage

Our website and the application share one cookie banner, provided by a consent-management provider. It sorts what is stored on your device, and the tools that store it, into three groups: necessary, analytics and advertising. Necessary storage is always on, and is used only to provide the Service and the features you use, as listed below. Analytics and advertising are used only if you agree to them, and nothing in either group loads unless you have agreed to it. Accepting and rejecting are equally easy, and one choice covers both picfinish.com and the application. You can change or withdraw your choice at any time through the "Cookie Settings" link in the footer of our website, and your browser keeps your choice for up to 12 months, after which we ask again.

Necessary

Your cookie choice. What you chose in our cookie banner, kept for up to 12 months so that we do not ask on every visit.
Sign-in session. A cookie that keeps you signed in. Without it the application cannot work.
Language preference. Your interface language, kept in a cookie for a year and in your browser's local storage until you clear it, so the application opens in that language. When you choose it on this device, a note saying so is kept with it until your account has been set to the same language.
A dismissed notice. If you close the suggestion to switch language, we remember that so it does not reappear.
Copies for speed. Your plan and credit balance, and the list of tools, as the application last loaded them, held in your browser tab so that pages open faster. They are gone when you close the tab.

Analytics, only with your consent

Where you came from. On the first page you open in a tab, we note any campaign tags in the address and the address of the page that sent you here, and on our website also the first page you opened. They are held in that tab and are gone when you close it. When you sign up, the application saves the tags and the referring address to your profile, as section 2 describes.
Analytics tools. Google Analytics and PostHog can store identifiers on your device to tell visits apart and to measure how our website and the application are used.

Advertising, only with your consent

Advertising tools. Google Ads and the Meta pixel can store identifiers on your device to measure which of our advertisements lead to a visit, a sign-up or a purchase, and to show our advertisements to people who may be interested.

11. Children

PicFinish is for business use and is not intended for anyone under 18. We do not knowingly let anyone under 18 use the Service or collect data from them directly. A photograph you upload may show a person under 18 only if you have obtained the explicit consent of everyone who holds parental responsibility for them under the law that applies (in some countries both parents); for such a photograph you are the controller, as section 1 describes. Our Acceptable Use Policy prohibits uploading a photograph that shows a person under 18, or asking the Service to show a person under 18, in an inappropriate context. If you believe a child has created an account, or that an image of a child has been uploaded without that consent or in an inappropriate context, write to privacy@picfinish.com; we will look into it and, where the report is well-founded, close the account or remove the image.

12. Changes to this policy

We may update this policy. The date at the top shows when it was last changed. If a change materially affects how we use your data, we will tell you by email or in the Service before it takes effect.

13. Contact

Dmitry Bykovskikh PR Beograd
Resavska 33, stan 1, 11000 Beograd (Vračar), Serbia

Privacy questions: privacy@picfinish.com
Everything else: support@picfinish.com