Używamy plików cookies

    Używamy cookies aby zapewnić najlepsze doświadczenie na naszej stronie. Cookies niezbędne są zawsze aktywne, ale możesz wybrać czy chcesz akceptować cookies analityczne i marketingowe.

    Polityka Prywatności
    UpVinti Logo

    UpVinti

    Privacy Policy for UpVinti

    Last updated: November 17, 2025

    MP Merlin Limited ("we", "our", or "us") operates the website www.upvinti.com, an AI-powered photo editing platform designed for e-commerce standards. This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the UK GDPR, EU GDPR, and other applicable laws.

    1. Who We Are

    • Company: MP Merlin Limited
    • Address: 97 Wordsworth Road, M27 9SJ, Swinton, UK
    • Email: contact@upvinti.com

    We are the controller of your personal data collected through our website.

    2. What Data We Collect

    We collect the following types of personal data from you:

    • Name
    • Email address
    • Uploaded images (used for editing)
    • Payment information (processed securely by third-party provider)
    • Cookies and analytics data (e.g., IP address, device type)

    3. How We Collect Data

    Your data is collected through:

    • Account registration
    • Image upload forms
    • Cookies and tracking scripts
    • Payment processing (via Stripe or another third-party provider)
    • Non-code integrations (e.g., Lovable)
    • Backend services (e.g., Supabase, Google AI Studio)

    4. Why We Use Your Data

    We process your personal data for the following purposes:

    • To provide and improve our AI photo editing service
    • To process payments securely
    • To send transactional communications (e.g., confirmations, password resets)
    • To improve the user experience and platform performance
    • To comply with legal obligations

    5. Legal Bases for Processing

    Under GDPR, we rely on the following legal bases to process your data:

    • Contractual necessity – to provide our service to you
    • Consent – for cookies and optional communications
    • Legitimate interest – for platform improvement
    • Legal obligation – where required by law

    6. Cookies and Tracking

    We use cookies to:

    • Analyze website traffic and usage
    • Maintain user sessions
    • Improve functionality

    You will see a cookie consent banner when you visit our site, allowing you to manage your preferences. You can also update preferences via your account dashboard.

    7. Image Uploads and Retention

    Uploaded images are stored until you have created 50 edited images, after which they are automatically deleted. We do not use your images to train AI models unless we request and receive explicit consent.

    8. Account and Payment Data

    • Account data is stored as long as your account is active and deleted upon your request.
    • Payment data is processed and stored only by our secure third-party payment provider (e.g., Stripe). We do not store your full payment information on our servers.

    9. Your Rights

    You have the following rights under GDPR:

    • Access – Request a copy of your data
    • Rectification – Correct inaccurate data
    • Erasure – Delete your data
    • Objection – Object to certain types of processing
    • Data portability – Request a copy in a portable format
    • Withdraw consent – At any time for cookies or marketing

    You can exercise your rights by contacting us at: contact@upvinti.com or via your account dashboard.

    10. Data Sharing

    We may share your data with trusted third parties who help us run our service:

    • Supabase – Database and authentication services
    • Google AI Studio – Image analysis and enhancement
    • Lovable – No-code tool for interface and workflow management
    • Payment provider – e.g., Stripe, for secure payment processing

    All third-party processors are under data processing agreements (DPAs) and comply with GDPR standards.

    11. International Data Transfers

    Some of our service providers are located outside the UK and EU. We ensure adequate data protection using:

    • Standard Contractual Clauses (SCCs)
    • UK International Data Transfer Agreement (IDTA)

    These mechanisms ensure your data is handled securely even outside the EU/UK.

    12. Security Measures & Data Encryption

    We implement industry-standard security measures to protect your data, with special emphasis on protecting your images. Your privacy and data security are our top priorities.

    Data Encryption

    Your data is protected with military-grade encryption at every stage:

    • In-Transit Encryption (TLS/HTTPS): All communications between your device and our servers use HTTPS with TLS 1.2+ encryption. This includes images sent to our AI Gateway (https://ai.gateway.lovable.dev), API calls to our database, and all authentication requests.
    • At-Rest Encryption (AES-256): All images stored in our system are encrypted using AES-256 encryption. We maintain three private storage buckets: model-photos (your custom model images), input-images (original uploads), and generated-images (AI-processed results). Access is controlled through Row Level Security (RLS) policies and time-limited signed URLs (24-hour expiration).

    Image Processing Security

    We take special care to protect images you send for AI processing:

    • Encrypted transmission: Images sent to our AI system are always encrypted in transit using HTTPS/TLS.
    • Isolated processing: AI processing occurs in isolated, secure environments with no persistent storage.
    • No AI training: We do not store your images in AI systems. Your photos are processed and immediately discarded. We never use your images to train AI models without your explicit consent.
    • Automatic deletion: Old photo generations are automatically deleted when you exceed 50 generations, ensuring your storage doesn't accumulate unnecessary data.
    • Bearer token authentication: All AI requests use secure Bearer token authentication to prevent unauthorized access.

    Authentication & Authorization

    • JWT tokens: We use JSON Web Tokens (JWT) with automatic refresh for secure authentication.
    • Server-side secrets: Sensitive keys like Service Role Keys and API keys are used only on our servers (Edge Functions), never exposed to your browser.
    • Row Level Security: Database policies ensure you can only access your own data—other users' images and information are completely invisible to you.
    • Protected API endpoints: All backend functions verify your identity before processing any requests.

    Your Rights & Control Over Images

    • Right to deletion: You can delete individual images or custom models at any time from your account dashboard.
    • Automatic cleanup: After 50 photo generations, the oldest images are automatically deleted to manage storage.
    • Complete data removal: Using the "Delete Account" feature removes all your data, including every image, custom model, and generation history.
    • No external sharing: Your images never leave our secure infrastructure without your explicit authorization.

    Additional Security Measures

    • Regular security audits and vulnerability monitoring
    • Automated backup systems with encryption
    • DDoS protection and rate limiting
    • Secure password hashing (bcrypt)
    • Multi-factor authentication (coming soon)

    Despite our best efforts, no system is 100% secure. If you suspect unauthorized access to your account, please contact us immediately at contact@upvinti.com.

    13. Data Retention

    • Uploaded images: Automatically deleted after you create 50 edited images
    • Account data: Stored until you delete your account
    • Payment data: Handled solely by our third-party payment provider
    • Cookies and analytics: Retained based on your preferences

    14. Changes to This Policy

    We may update this Privacy Policy from time to time. When we do:

    • We will update the "Last Updated" date at the top of this page
    • Significant changes may be communicated via email or website notice

    15. Contact Us

    If you have any questions about this policy or your data rights, please contact:

    • 📧 Email: contact@upvinti.com
    • 📍 Address: MP Merlin Limited, 97 Wordsworth Road, M27 9SJ, Swinton, UK