Privacy Policy

1. Data controller

The data controller for the Service is:

Name: UserFirst, an individual
Privacy email: easytoreach365@gmail.com
Data protection officer: Not applicable

2. Personal information we collect

2.1 Information you give us

Account information from Google sign-in: name, email address, profile picture, and Google account identifier. We do not ask you to create a separate password.
Content you submit: photos you upload, text prompts, and images you choose to save to your account.
Payment information: for each one-time credit purchase, the package, amount, payment status, and transaction identifier. We do not store your full card number, and we do not keep a card on file for a later or recurring charge. Card data is handled by our payment processor, as described in Section 5.
Support messages: emails you send us, including refund requests.

2.2 Information collected automatically

Device and network data: IP address, device type, operating system, browser type, and time zone.
Usage data: pages viewed, features used, and session length.
Log data: request time, error logs, and performance data.

2.3 Google sign-in

When you sign in with Google, we receive the basic profile information Google shares with us: your name, email address, and profile picture. Google’s handling of your account is described in Google’s Privacy Policy.

3. How we use personal information

Purpose	Legal basis
Provide and maintain the Service, including image generation	Contract
Process one-time credit purchases and payments	Contract
Customer support and refunds	Contract and legitimate interests
Service messages about billing, security, and policy updates	Legitimate interests
Security and fraud prevention	Legitimate interests
Product improvement and analytics	Legitimate interests
Legal compliance	Legal obligation

We may aggregate or de-identify information for statistics. That information does not identify you. We do not use your photos, prompts, or generated images to train our own AI models.

4. Cookies and similar technologies

Type	Purpose	Can you turn it off?
Strictly necessary	Keep you signed in and run core features. Your sign-in token is stored in your browser’s local storage.	No
Analytics	Count visits and see which pages are used, so we can improve the Service.	Yes, through your browser settings

We use Umami for analytics. Pages also load fonts from Google. You can limit cookies and local storage in your browser settings. We do not run a separate cookie-preference center, and we do not use marketing or advertising cookies.

5. Sharing and disclosure

We do not sell your personal information, including a “sale” as that word is used in the CCPA. We share information only in these cases:

Service providers. Vendors that host the Service, process one-time payments, generate images, or measure traffic, under confidentiality obligations. Card data for each purchase is handled only by our PCI-DSS compliant payment processor, Waffo Pancake, and is not stored on our servers.
OpenAI. Photos and prompts you submit for generation are sent to OpenAI so it can produce the image. See OpenAI’s Privacy Policy.
Google. Google provides sign-in and web fonts. See Google’s Privacy Policy.
Legal requests. We may disclose information if a law, court order, or lawful request from an authority requires it.
Business transaction. If the Service is sold or transferred, we will tell you in advance and require the recipient to keep these protections.
Your consent. We may share information for another purpose when you have clearly agreed in advance.

6. Security

Traffic to the Service is encrypted with TLS / HTTPS.
We do not store full payment card numbers, and we do not keep a card on file for recurring charges.
Sign-in is handled by Google. We store the sign-in token in your browser, not a password you create with us.
Access to account data is limited to what is needed to operate the Service.

If a security incident affects your rights, we will notify you and the relevant authority within 72 hours of becoming aware of it, where the law requires notice. Keep your Google account secure and do not share access to it.

7. How long we keep information

Data	Retention	Then
Account information	While your account is open, then 90 days after the account is closed	Deleted
Uploaded images and prompts you do not save	Up to 24 hours	Deleted
Images you save to your account	Until you delete them, or 90 days after the account is closed	Deleted
Transaction records	7 years	Deleted or archived
Support messages	2 years	Deleted
Security and error logs	12 months	Deleted

8. Your rights

To use these rights, email easytoreach365@gmail.com. We will respond within 30 calendar days.

Right	What it means
Be informed	Know what we collect and how we use it
Access	Receive a copy of your personal information
Correction	Fix information that is wrong or incomplete
Deletion	Ask us to delete information when the law allows it
Restriction	Ask us to pause processing in the cases the law allows
Portability	Receive your information in a machine-readable format
Object	Object to processing based on legitimate interests
Withdraw consent	Withdraw consent where processing is based on consent

If you think we have not handled a request properly, you can complain to the data protection authority where you live.

9. International transfers

Our providers, including OpenAI, Google, Umami, and Waffo Pancake, may process information in the United States and in other countries where they operate.

When information leaves your country, we use these safeguards:

Data-processing terms that include the EU Standard Contractual Clauses where those clauses are required.
Transfers only to recipients that provide a comparable level of protection.

10. Children

The Service is for people who are at least 18 years old. We do not knowingly collect information from anyone younger. If you believe a child has given us information, email easytoreach365@gmail.com and we will delete it.

11. Third-party links and services

The Service links to other sites and uses Google, OpenAI, Umami, and Waffo Pancake. This policy covers information we collect. Those providers have their own policies, and we are not responsible for their practices. Read their policies before you use them.

12. Changes to this policy

For a material change, we will email the address on your account at least 14 days before it takes effect and update the “Last updated” date at the top of this page. Continuing to use the Service after that date means you accept the updated policy.