Privacy policy

The controller for the processing of personal data on this website is:

Aura UG (haftungsbeschränkt)
Ludwig-Erhard-Straße 18
20459 Hamburg
Germany
Email: [email protected]

For questions about your data you can also use the contact form. Our full company details are in the imprint.

• Your photo is processed in your browser. It is never uploaded to our server or to anyone else.
• Face detection runs on your device. The detection models are loaded from our own server, not from third parties.
• We do not use analytics or advertising tools, and we set no cookies of our own. Our network provider Cloudflare may set security cookies.
• If you buy photo files, Paddle.com handles the payment as our reseller. We only receive the transaction ID with its status and amount.
• Our server only delivers the pages and program files. Like every web server, it briefly processes your IP address to do so.
• If you use the contact form, your message is sent to our mailbox by email. It is not stored on our server.

When you take or upload a photo, your browser reads it into the memory of the open tab. Everything the tool does with it happens there, including the files you download. We never receive the photo or anything computed from it, so we cannot store or share it.

When you close or reload the tab, the photo is gone from memory, unless you bought the files (see the next paragraph). Files you download are saved by your browser on your device. Our automated tests check on every change that no image data is sent over the network while you edit a photo.

Because we do not process the photo ourselves, its content (including what it reveals about your appearance) is not personal data that we process.

If you choose to take a photo with your camera, your browser asks for permission. The video stays in the tab and is only used to show the preview with guide lines and to capture the photo. You can withdraw the permission at any time in your browser settings.

To deliver pages and to detect faults and attacks, our server processes the IP address, the time, the requested address, the status code and the browser's user agent of each request. We do not keep access logs of the website beyond what is needed to run it. Legal basis: Art. 6(1)(f) GDPR.

We set no cookies of our own. If you buy photo files, we keep your edited photo together with the purchase in your browser's storage (IndexedDB) on your device, so that you can still download the files if the page reloads. This data never leaves your device. We keep it for at most 24 hours after you start the last purchase. A website cannot delete anything while none of its pages is open: if you leave before the 24 hours are over, the data is deleted on your next visit to any page of this website after that time. While the tool stays open, it deletes the data when the 24 hours end. You can delete it earlier with "Forget" or by choosing another photo, and clearing this website's data in your browser settings removes it at any time. Your browser may cache the program files and detection models so that the tool starts faster next time; this cache contains no personal data and you can clear it in your browser settings. The Paddle checkout is loaded only when you start a purchase and may use its own cookies; see the Paddle privacy notice.

When you buy photo files, the payment is handled by Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom, our online reseller and Merchant of Record. Only when you click the button to buy, your browser loads the Paddle checkout from Paddle's servers (paddle.com). In the checkout you give Paddle your contact and payment details. Paddle processes them as an independent controller under its own privacy notice to take the payment and to meet its invoice and tax obligations.

We send Paddle the order data: the document you chose, the date of its photo rules and a random order number. We never send your photo. From Paddle we receive and store the transaction ID with its status and amount. We need them to confirm the payment before your browser creates the files, and later to handle refunds. We do not receive your card or bank details, and we do not store your name or email address from the checkout. Legal basis: Art. 6(1)(b) GDPR. We keep these records for as long as German commercial and tax law requires (up to ten years).

If you ask for a refund because the authority rejected your application, we store the details you enter in the form and, if you attach it, the image of the rejection letter. We use them to decide on the refund within 90 days of the purchase and to answer you. We delete the image of the letter as soon as we have decided. We keep the request itself until the end of the third year after the decision, in case of questions or disputes. Legal basis: Art. 6(1)(b) GDPR.

Emails to [email protected] are received by the email routing service of Cloudflare, Inc. and forwarded to our mailbox at Proton AG, Geneva, Switzerland, which stores emails on servers in Switzerland, Germany or Norway. Both process the email only to deliver and store it for us. The email routing service keeps the metadata of forwarded emails (sender, recipient, subject, message ID, time and delivery status) and shows it to us for 31 days. How long Cloudflare itself keeps this data follows its terms and data processing agreement.

If you write to us, we process your email address, your name if you give it, and your message to answer you. Legal basis: Art. 6(1)(b) GDPR if your message concerns a purchase, otherwise Art. 6(1)(f) GDPR. We delete the correspondence when it is no longer needed, unless we must keep it for legal reasons.

Cloudflare, Inc. and Resend (Plus Five Five, Inc.) are based in the USA. Both are certified under the EU-U.S. Data Privacy Framework. Transfers to them are based on the adequacy decision of the European Commission for this framework (Art. 45 GDPR, Implementing Decision (EU) 2023/1795). Their data processing agreements also contain the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR), which apply if a certification ends. You can check the certifications at dataprivacyframework.gov.

Proton AG is based in Switzerland. Transfers to Switzerland are based on the adequacy decision of the European Commission (Art. 45 GDPR; Decision 2000/518/EC of 26 July 2000). Proton stores emails on servers in Switzerland, Germany or Norway. Germany is in the EU and Norway in the European Economic Area, so storage there is not a transfer outside the EU or EEA.

Paddle.com Market Limited is based in the United Kingdom. Transfers to the United Kingdom are based on the adequacy decision of the European Commission (Art. 45 GDPR).

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15)
• have incorrect data corrected (Art. 16)
• have your data deleted (Art. 17) or its processing restricted (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on Art. 6(1)(f) GDPR for reasons arising from your particular situation (Art. 21)

To use these rights, write to [email protected] or use the contact form. You can also lodge a complaint with a data protection authority, for example the authority responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, datenschutz-hamburg.de.

The checks in the tool (for example head size or background) run only in your browser and only give you advice. We make no decisions about you based on automated processing within the meaning of Art. 22 GDPR.

We update this policy when our service changes. The date at the top shows the latest version.