Privacy Policy
Last updated:
1. Data controller
This Privacy Policy explains how Liu Wu (the legal owner and operator of RevivaPhoto, revivaphoto.com), acting as a sole proprietor, collects and processes personal data. For privacy requests contact support@revivaphoto.com. A Data Protection Officer is not appointed (Not applicable).
Registered address: Jinyudasha No. 1301, Xijinxilu Road, Qilihe District, Lanzhou, Gansu, China, Postal Code 730000
2. Personal data we collect
We collect only what we need to run the Service:
- Account information (if you sign in with Google): your name, email address, and profile picture, as provided by Google. We never receive your Google password.
- Payment information: the amount and status of any purchase. Full card numbers are not stored by us — card data is processed by our payment processor (see Section 5).
- Communications: messages you send us (e.g. support or refund requests) and, if you subscribe, your email address.
- Device and network data: an anonymous device identifier, IP address (used only at the edge for rate limiting and then discarded; we do not store plaintext IP), browser and device type, and language.
- Usage and log data: which features you use, request timestamps, and error logs, used to operate and improve the Service.
We do not collect special-category data, and we do not collect the photos you upload except transiently to perform colorization (see Section 3).
3. How we use your data & legal basis
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Deliver colorization (incl. transient photo processing) | Uploaded photo (in memory), account info | Art. 6(1)(b) performance of contract |
| Billing and order fulfillment | Payment amount/status, account info | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation |
| Customer support | Communications, account info | Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interest |
| Service notifications (e.g. quota, delivery) | Account info | Art. 6(1)(b) contract |
| Security, fraud prevention, rate limiting | Device id, IP (edge), logs | Art. 6(1)(f) legitimate interest |
| Analytics to improve the Service | Usage and log data, anonymized | Art. 6(1)(f) legitimate interest |
| Compliance with law | As required | Art. 6(1)(c) legal obligation |
| Marketing emails (only if subscribed) | Email address | Art. 6(1)(a) consent |
Aggregated or anonymized data that can no longer identify you may be used for any purpose without restriction.
4. Photos you upload
When you upload a photo for colorization, the image is sent to our AI model (provided by Google's Gemini image models and operated by us), processed into colorized candidates, and the original upload is discarded from memory once the response is returned. We do not persist uploaded images to long-term storage. The colorized result is returned to your browser and is not stored on our servers unless you explicitly download it. This is a core privacy guarantee of the Service.
5. Cookies & tracking
We use strictly necessary cookies and one analytics tool:
sid— keeps you signed in after Google sign-in; HTTP-only, Secure, SameSite=Lax, expires after 7 days.device_id— a random, anonymous identifier (no personal data) issued to every visitor so we can count monthly free-tier usage without storing your IP address; HTTP-only, Secure, SameSite=Lax, lasts up to 400 days.- Cloudflare Web Analytics — a privacy-preserving, cookieless analytics tool that measures aggregate traffic. Its processing is governed by Cloudflare's Privacy Policy. You can disable non-essential analytics in your browser settings; essential cookies cannot be disabled without breaking sign-in.
6. Sharing & disclosure
We do not sell your personal information (including as defined under the CCPA).
Payment card data is processed exclusively by our PCI-DSS-certified payment processor, Waffo Pancake, and is not stored on our servers. We share only the minimum data needed for them to process your payment (amount, order id, and the anonymous subject id used for credit delivery).
We also share data with service providers who process it on our behalf:
- Cloudflare — hosting, edge functions, and analytics.
- Google — sign-in (when you choose to use it), and our AI image model provider (Gemini image models) that processes uploaded photos transiently to generate colorized results.
We may disclose data to comply with law, to enforce our Terms, in connection with a business transfer (e.g. a sale of the Service), or with your consent. All processors are bound by appropriate data processing terms.
7. Data security
We protect your data with TLS in transit, hashed/encrypted storage of credentials and identifiers, access controls, and periodic review of our security posture. In the event of a personal data breach, we will notify affected users and the relevant supervisory authority within 72 hours where required by law.
8. Data retention
| Data | Retention |
|---|---|
| Uploaded photos | Not stored (discarded in memory after processing) |
| Session identifier (sid) | Up to 7 days |
| Account / OAuth record | Up to 90 days after last use, then deleted |
| Purchase / order receipt | Retained as required for tax and accounting (≥ 7 years where applicable) |
| Email subscriber list | Until you unsubscribe or request deletion |
| Security and error logs | Up to 90 days |
9. Your rights
Depending on your jurisdiction (e.g. GDPR, CCPA), you have the right to: be informed; access; rectification; erasure; restriction of processing; data portability; object to processing; and withdraw consent at any time. To exercise these rights email support@revivaphoto.com. We respond within 30 calendar days. You also have the right to lodge a complaint with a supervisory authority in your country of residence.
10. Marketing & unsubscribe
We only send marketing email if you subscribed (e.g. to launch notifications), based on your consent. Every marketing email includes an unsubscribe link, and you can withdraw consent at any time. Service-related emails (receipts, security notices) are sent regardless of marketing preferences because they are essential to the Service.
11. International transfers
Our service providers (Cloudflare, Google) may process data outside your country of residence, including outside the EU/UK. Where we transfer personal data internationally we rely on Standard Contractual Clauses and the providers' certified adequacy mechanisms.
12. Children's privacy
The Service is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact support@revivaphoto.com and we will delete it.
13. Changes to this policy
We may update this policy from time to time. For material changes we will provide at least 15 days'advance notice (for example by email or a notice on the Service) before they take effect. The "Last updated" date reflects the latest version.
14. Contact us
- Privacy: support@revivaphoto.com
- Support: support@revivaphoto.com
- Data controller: Liu Wu (sole proprietor)
- Postal address: Jinyudasha No. 1301, Xijinxilu Road, Qilihe District, Lanzhou, Gansu, China, Postal Code 730000