Privacy Policy

1. Who We Are and Scope

This Privacy Policy explains how Optimagio collects, uses, stores, shares, and deletes personal data when you use our websites, dashboards, APIs, image optimization services, Site Audit, browser-side tools, cloud storage, share links, reports, billing surfaces, and support channels (collectively, the "Service").

Optimagio is the controller for account, product, analytics, support, security, and service-operation data we process for our own service. For paid checkout, Paddle acts as merchant of record and independently controls payment-method, tax, receipt, refund, and chargeback processing. For content you process for your own clients, users, or audit targets, you are the controller (or equivalent role under applicable law) and you are solely responsible for the lawful basis, notices, consents, retention choices, and responses to data-subject requests for that content. Optimagio acts only on your instructions for such content as needed to provide the Service and as further set out in a written data-processing addendum, where one is in place.

2. Data We Process

We keep processing limited to the categories needed to provide the Service, secure accounts, enforce quotas, process payments, answer support requests, and improve reliability. Full IP addresses are minimized where possible; usage records use truncated network data for security and abuse prevention, contact submissions store only a truncated network, and analytics raw-IP storage is off by default.

3. How We Use Data

We use personal data to provide requested optimization, account, API, storage, reporting, Site Audit, billing, and support services; enforce quotas and security controls; prevent fraud and abuse; maintain audit and payment records; debug reliability issues; comply with law; and communicate about service, security, billing, and product updates you request.

We do not use submitted image content to train general AI models. We do not intentionally collect special-category, health, biometric, payment-card, government-identifier, children's, or other highly regulated data. Do not upload such data unless a written agreement expressly permits that processing; uploading it in violation of these Terms is at your sole risk and Optimagio disclaims all liability for any consequence of such submission to the maximum extent permitted by law.

4. Legal Bases

For EU, UK, and similar privacy-law purposes, we rely on contract where we process data to provide the service you request; legitimate interests for security, abuse prevention, service diagnostics, audit logs, and non-intrusive product reliability analytics; consent for optional analytics and marketing where required; legal obligations for tax, payment, accounting, dispute, and compliance records; and vital or public-interest grounds only if a specific law requires them.

You can withdraw consent for optional analytics through the cookie controls and can opt out of optional marketing from Profile or from any unsubscribe mechanism we provide. Withdrawal does not affect processing that already occurred or processing needed for contract, security, legal, or dispute purposes.

5. Browser-Only and Cloud Boundaries

Private Browser Mode keeps supported source files and outputs in the browser and does not upload those bytes to Optimagio. Cloud, API, Site Audit, storage, saved-report, verified-report, checkout, account, and support flows do send data to Optimagio or configured providers as needed to provide those flows. You are responsible for choosing the processing mode appropriate to your data and use case; selecting a cloud workflow constitutes your authorization to transmit and process the related content as described in these notices and the Terms.

6. Service Providers, Sub-processors, and Payment Data

We use service providers for hosting, object storage, CDN or edge delivery, database/cache infrastructure, analytics storage, email delivery, authentication, security, observability, and support operations. Depending on deployment configuration, these may include S3-compatible storage providers, Bunny storage or CDN, Cloudflare edge components, Postgres, Redis, ClickHouse, Google OAuth, Google Analytics, and an email provider such as Purelymail. The current sub-processor list is available on request from [email protected] and may be updated from time to time; continued use after such an update is your acceptance of the updated list.

Paid subscriptions are processed by Paddle.com Market Ltd as our merchant of record. When you complete checkout, we share your account email and internal user identifier with Paddle to link your subscription. Paddle handles payment-method capture, billing, tax determination, receipt delivery, refund processing, and chargeback handling independently; we never see or store your card details. Paddle's privacy notice is available at paddle.com/legal/privacy.

From Paddle we receive customer identifiers, subscription identifiers, transaction status, totals including tax breakdown, invoice URLs, and webhook notifications. This data powers the Billing tab, entitlement reconciliation, support, tax-record retention, and dispute evidence.

7. International Transfers

Optimagio and its providers may process data in countries other than your own, including outside the European Economic Area, the United Kingdom, and other jurisdictions. Where privacy law requires transfer safeguards, we rely on adequacy decisions, standard contractual clauses, the UK addendum, the Swiss addendum, data-processing terms, provider security commitments, and data minimization, as applicable. By using the Service, and to the extent permitted by law, you accept the resulting international transfers as necessary to provide the Service to you. Region or residency preferences apply only where the relevant product feature and storage backend are configured to enforce them, and we make no guarantee of single-region storage unless expressly agreed in writing.

8. Retention and Deletion

Your files stay in your account as long as your subscription is active, plus 60 days after cancellation. Free accounts unused for 12 months are reminded twice and then archived. Optimized image files, originals retained by request, thumbnails, reports, share records, and usage counters are removed or archived by lifecycle cleanup, tier limits, deletion controls, and account deletion flows.

Account, API-key, quota, billing, security, support, and audit records are kept only as long as needed for service operation, legal obligations, tax/payment records, fraud prevention, dispute handling, backup recovery, and security. Explicit account erasure remains a separate privacy control and overrides normal lifecycle grace where no mandatory retention exception applies. You remain solely responsible for maintaining independent copies of any content you wish to preserve; the Service is not a backup, archival, or system-of-record service, and Optimagio is not liable for loss, corruption, or unavailability of your content beyond what mandatory law requires.

9. Your Privacy Rights

Depending on your location, you may request access, confirmation, correction, deletion, portability, restriction, objection, consent withdrawal, information about recipients and transfers, or a copy of data you provided. You may also have the right to complain to a data-protection authority or appeal a denied privacy request.

California residents may have rights to know, delete, correct, opt out of sale or sharing, limit use and disclosure of sensitive personal information, and receive non-discriminatory treatment for exercising privacy rights. Optimagio does not sell personal information or share personal information for cross-context behavioral advertising. We also do not knowingly sell or share personal information of minors.

Authenticated users can export profile, API-key, usage, contact, and analytics data from the account export endpoint, and can request account erasure through the account deletion flow. You can reject or reset optional analytics choices from the cookie controls. For other requests, email [email protected] from the account email. We may need to verify your identity, account ownership, jurisdiction, or authority before acting, may charge a reasonable fee for manifestly unfounded or excessive requests where permitted by law, and may refuse or restrict requests that conflict with mandatory retention duties or the rights or freedoms of others.

If you submit a privacy request on behalf of a data subject whose content you have processed through the Service, you must direct that request to the controller of that content (which is normally you, not Optimagio). Optimagio will support such requests as instructed under a written data-processing addendum but is not the controller for content you submit on behalf of your own users or audit targets.

10. Automated Abuse Controls

We use automated and rule-based controls to detect spam, quota abuse, credential abuse, payment risk, malicious requests, and automated signup patterns. These controls may block or challenge requests, require account review, limit access, or preserve evidence. We do not use solely automated processing to make legal or similarly significant decisions unrelated to service security, fraud prevention, or entitlement enforcement.

11. Security and No Guarantee

We use technical and organizational safeguards such as HTTPS, access controls, authentication, CSRF and origin checks, rate limits, action intents, logging, secret separation, object-key isolation, token hashing where applicable, and least-privilege operational controls. No internet service is perfectly secure, and you should keep API keys, sessions, share links, and passwords confidential. Optimagio does not warrant that its security measures will prevent every loss, unauthorized access, or incident, and disclaims liability to the maximum extent permitted by law for any breach not caused by Optimagio's gross negligence or willful misconduct.

If we identify a data incident requiring notice, we will investigate, contain, remediate, preserve evidence, and notify affected users or authorities as required by applicable law. We have no obligation to notify in the absence of such a legal requirement.

12. Children

Optimagio is a business and developer service and is not directed to children. Do not create an account or submit personal data if you are under the age at which you can lawfully consent to online services in your jurisdiction. If you believe a child submitted data to Optimagio, contact [email protected] and we will delete the data and the related account as required by law.

13. Business Customers and DPA Requests

If you use Optimagio as a processor for personal data in your own content, websites, reports, or client workflows, you remain solely responsible for your own instructions, notices, lawful basis, retention choices, and responses to your data subjects. Contact [email protected] before production use if you need a data processing addendum, subprocessor list, security questionnaire, regional storage commitment, or custom retention terms. In the absence of a signed data-processing addendum, no special processor commitments, regional guarantees, or regulated-data approvals apply.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the effective date above and, where required by law, by a more prominent notice. Continued use of the Service after the effective date of an update is your acceptance of the updated Policy.

15. Contact

For privacy requests, email [email protected]. For billing or refund support, use the Paddle receipt, Paddle customer portal, or Billing tab, and include your Paddle transaction ID when contacting Optimagio support.