Privacy Policy

1. Who we are

TidyPhotosUp (“we”, “us”, “our”) provides tools for people reselling items online, including a service that turns a quick photo into a clean, marketplace-ready product photo while keeping your actual item. We are based in the United Kingdom and we are the controller of the personal data described in this policy. You can contact us at hello@tidyphotosup.com.

2. The law we follow

We process personal data in accordance with the UK GDPR and the Data Protection Act 2018, and we have regard to guidance from the Information Commissioner’s Office (ICO).

3. The personal data we collect

• Account and identity. Your email address, and, if you sign in with Google, your name, profile picture and Google account identifier. If you register with a password, it is set and stored in hashed form by our authentication provider and is never visible to us.
• Photos and results. The images you upload, the tidied results we create from them, and related details such as the look you choose, the image dimensions, the status and timestamps, and the text instruction used to produce a result (kept for troubleshooting).
• Billing and credits. Your plan, subscription status and renewal date, your current credit balance, and a ledger of credit changes, together with a Stripe customer reference. Card details are handled entirely by Stripe and are not stored by us.
• Technical and usage data. Your IP address and request information, used to keep you signed in, apply fair-use and rate limits, and protect the service.

4. How and why we use your data

We rely on the following lawful bases under the UK GDPR:

• Performance of a contract: to create and manage your account, process your photos, run your credit balance and take payment.
• Legitimate interests: to secure, maintain and improve the service and to prevent abuse, balanced against your rights and freedoms.
• Legal obligation: to keep records we are required to keep, for example for tax and accounting.
• Consent: where we ask for it, such as any optional marketing email. You can withdraw consent at any time.

5. Your photos and how they are processed

When you tidy a photo, the image is sent to our automated image-processing provider (OpenRouter) and the model providers it routes to, which return the tidied result. Your originals and results are stored in our storage (provided by Cloudflare R2) and recorded against your account.

Images are displayed through a content delivery network on our own domain (cdn.tidyphotosup.com) using long, unguessable links. Anyone who has a link can view that image, so please treat the links as private. You can delete any photo and its result at any time from your dashboard, which removes both the record and the stored image files.

6. Service providers we share data with

We use a small number of trusted providers who act as our processors and handle data only on our instructions:

• Supabase, for authentication and our database.
• Cloudflare, for hosting and compute, image storage, image delivery, and security and rate-limiting.
• Stripe, for payments.
• OpenRouter, for the automated image processing that creates your tidied results.

We do not sell your personal data, and we do not use it for advertising.

7. International transfers

Some of these providers process data outside the United Kingdom. Where that happens, we rely on safeguards recognised under UK law, such as UK adequacy regulations or the ICO’s International Data Transfer Agreement (or the Addendum to the EU Standard Contractual Clauses).

8. How long we keep your data

We keep your information while your account is active and as needed to provide the service. Deleting a photo removes it and its result; closing your account deletes your profile, photos and results. We may retain limited records, such as transaction records, for as long as we are legally required to.

9. Your rights

Under the UK GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to our use of it, to data portability, and to withdraw consent where we rely on it. To exercise any of these rights, email hello@tidyphotosup.com. If you are not satisfied with our response, you can complain to the ICO at ico.org.uk.

10. Cookies

We use essential cookies set by our authentication provider to keep you signed in. We do not use advertising or tracking cookies.

11. Children

The service is not directed to children under 13, and you should not use it if you are under that age.

12. Security and changes

We use reasonable technical and organisational measures to protect your data, though no method of storage or transmission over the internet is completely secure. We may update this policy from time to time; when we do, we will change the date at the top of this page.