Privacy Policy

1. Data controller

This Privacy Policy explains how rembg.click (“we”, “us”, “our”) processes personal data when you use our website rembg.click, our API at api.rembg.click, and related services.

Data controller: the operator of rembg.click. Privacy contact: [email protected].

This policy is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and applies to users in the European Economic Area (EEA), United Kingdom, and Switzerland, as well as to all users worldwide unless a more specific notice applies.

2. Personal data we process

Account data: email address, optional name, password hash, OAuth provider identifiers, marketing preferences, referral data, and account timestamps.

Billing data: plan, order references, payment status, subscription interval, and transaction history. Payment card data is processed by WayForPay; we do not store full card numbers.

Usage data: API endpoints called, credits consumed, megapixels processed, free-call counters, IP address for rate limiting and security, user agent, and dashboard activity logs.

Support and communications: messages you send to us and records needed to handle requests.

Images: for standard endpoints (/removebg, /changebg, /upscale, demo tools) images are processed in RAM only and are not stored on disk after the response is sent. For the voluntary Improvement Program (POST /v1.0/improve) we temporarily store the uploaded file for manual review for up to 1 hour, then delete it automatically.

3. Purposes and legal bases (GDPR Art. 6)

Providing the service, account management, and API access — performance of a contract (Art. 6(1)(b)).

Payment processing and invoicing — performance of a contract and legal obligation (Art. 6(1)(b), (c)).

Security, fraud prevention, abuse detection, and rate limiting — legitimate interests (Art. 6(1)(f)); our interest is protecting the service and users; you may object (see section 9).

Product analytics via Vercel Analytics — consent (Art. 6(1)(a)); analytics loads only after you accept non-essential cookies in our banner.

Marketing emails — consent (Art. 6(1)(a)); you may withdraw at any time.

Compliance with law, tax, and accounting — legal obligation (Art. 6(1)(c)).

Improvement Program image review — consent when you submit via /improve and accept program conditions (Art. 6(1)(a)).

4. Recipients and processors

We use trusted processors who process data only on our instructions and under appropriate agreements (GDPR Art. 28), including: hosting/infrastructure providers, WayForPay (payments), Vercel (hosting and analytics, if consented), and email delivery providers if you opt in to marketing.

We do not sell personal data. We may disclose data to courts, regulators, or law enforcement when required by applicable law.

5. International transfers

Some processors may be located outside the EEA/UK (for example the United States). Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and supplementary measures, or UK International Data Transfer Agreement equivalents.

You may request more information about transfers and safeguards by contacting [email protected].

6. Retention

Account data: for the lifetime of your account and up to 3 years after deletion, unless a longer period is required by law.

Billing and tax records: as required by applicable commercial and tax law (typically 5–7 years depending on jurisdiction).

Usage logs: up to 24 months for billing reconciliation, security, and support.

Rate-limit and security logs: up to 90 days unless needed for an incident investigation.

Marketing consent records: until withdrawal of consent plus applicable limitation period.

Improvement Program files: deleted within 1 hour; related metadata may be kept up to 12 months.

Images from standard processing: not retained on disk after the HTTP response.

7. Security

We implement technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), access controls, hashed passwords, API key hashing, and separation of processing infrastructure.

8. Automated decision-making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects within the meaning of GDPR Art. 22.

9. Your rights

If GDPR applies to you, you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21), including objection to processing based on legitimate interests.

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise your rights, email [email protected]. We respond within one month as required by GDPR Art. 12(3), extendable by two further months where necessary.

You have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or place of the alleged infringement. A list of EU authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

10. Children

The service is not directed at children under 16. We do not knowingly collect personal data from children. Contact us to request deletion if you believe a child provided data.

11. Changes

We may update this policy. Material changes will be indicated by updating the “Last updated” date. Where required by law, we will provide additional notice.