Skip to content
Fottory
Start free
Menu

Writing

What happens to the photos you upload

Handing photographs of your face to a company you found on the internet is a reasonable thing to hesitate over, and the answer should be available in plain language before you upload anything. So here it is, in the order people actually ask. The authoritative document is our privacy policy. Where the two differ, the policy is what governs, and nothing below goes beyond it.

One thing worth stating at the top: none of this changes if you pay. The policy draws no distinction between a paying customer and somebody who only ever uses the free tools. The distinction it does draw is between being signed in and being signed out, and that affects one thing, which is how long the photo check keeps your images.

What you upload

Three different kinds of thing, used for three different purposes.

Alongside those we hold the images we generate for you, the findings the check produced, your email address and basic settings, a record from our payment provider that you paid (not your full card number), your country as detected from your IP address so that prices appear in the right currency, and basic analytics and device data.

What it is used for

Your photos are processed to produce the result you asked for and nothing else: a new image, or a finding about a picture you already had.

Under the GDPR every use needs a legal basis, and the policy states them one at a time. Photos of your face may count as special category biometric data, so both generating and checking rely on your explicit consent, given at the point where you upload. That covers the check as well as generation, on the reasoning that a photograph of your face is the same kind of data whether we generate from it or only look at it. We record which version of the consent wording you were shown. You can withdraw consent at any time.

Running your account and taking payment rely on performing our contract with you, and so does the writing help. Keeping the service secure and improving it, and showing you a price in a currency you can read, rely on legitimate interests.

Who can see it

We do not sell your data, and we never share your photos with other users. There is no part of the product that shows your pictures to another person using it.

A small number of providers process data on our behalf, under contracts that require them to protect it: a cloud hosting and content delivery provider, which is Cloudflare and which also helps detect your country for currency, a payment provider, and an analytics provider. They act as our processors and may only use the data to provide their service to us.

Your data may be processed inside or outside the European Economic Area. Where it leaves the EEA, we rely on legal safeguards such as the European Commission's standard contractual clauses.

How long it is kept

This is the part with the most moving pieces, so it is worth being exact about each one.

Photos on an account. Uploaded and generated photos are kept while your account is active, so that you can come back to them. There is no automatic expiry on an active account. That is worth stating rather than leaving implied: the images stay until you remove them or close the account.

The photo check, signed out. The photos are deleted within 24 hours. You never gave us an account, so we do not keep the images beyond the run itself.

The photo check, signed in. The set and its findings are kept so the page opens on them when you come back, and they stay until you delete your photos or your account.

The photo check, past the daily limit. Signed out, you can send one more photo. It is checked now, and a free account shows you the result. That is worth knowing before you upload it: the photo is on our servers and the finding already exists, whether or not you ever sign up. If you do not, it is deleted after 24 hours like every other signed-out upload.

The record of the run outlasts the images in both cases. It holds when you agreed, which wording you were shown, and what we found. It contains no photograph. It is what we would rely on if anyone later asked whether consent had been given, which is exactly why it cannot be tied to the lifetime of the pictures.

Because the check works without an account, we need some way to count usage against somebody in order to apply the daily limit. We store two one-way hashes for that: one of an opaque cookie set in your browser, and one of your IP address. Neither can be turned back into the original value, and they are used only to apply that limit.

What happens when you delete

If you ask us to delete your account or your photos, we remove them within 30 days. The exception is limited records we are required to keep for legal or accounting reasons, which is the exception every business has and which does not extend to your photos.

Deletion is one of six rights the GDPR gives you here. The others are a copy of what we hold about you, correction of anything that is wrong, restricting or objecting to a use, receiving your data in a portable format, and withdrawing your consent at any time. All of them go to the same place, which is info@fottory.ai. You can also complain to your local data protection authority, and you do not need to go through us first.

What it is never used for

We do not train on your photos. Not the ones you upload, not the ones we generate for you, and not to train, fine-tune or improve any AI model. They are used to create your own results, and that is where it ends.

This is worth stating flatly, because it is the thing people most reasonably suspect. Giving photographs of your face to a company that runs image models is an obvious route to becoming training data, and a policy that is quiet on the point is telling you something. Ours is not quiet on it. It has its own section.

We also do not sell your data, and we do not share your photos with other people. There is no marketing use, no resale, and no third party receiving your images for their own purposes.

Where to check this rather than take our word for it

Everything above is a plain restatement and not a substitute. The privacy policy is the document that binds us, it carries the date it was last changed, and it is where to look if you want the exact wording or you are deciding whether to upload anything at all. Fottory is a company registered in the Netherlands and is the data controller for all of this. Anything not answered there goes to info@fottory.ai.

If you are here because you are weighing up whether to hand over pictures of your face, that is the right instinct, and it is worth pointing at the output as well as the input. What actually has to be true of a generated image before it is worth using is in will my date notice, and the free check itself is at photo check, which needs no account and keeps nothing past 24 hours if you stay signed out.

Written by Fottory, which generates dating photos from photos of your own face. The first two are free, and none of the advice above depends on using it.