Privacy Policy

1. Scope and Contact

This Privacy Policy explains how Ediroo ("Ediroo", "we", "our", or "us") collects, uses, stores, transfers, and protects personal information when you access our website at https://ediroo.com, create an account, upload photos, utilize our AI photo editing and cleanup tools, purchase subscriptions or credit packs, or contact customer support.

This policy applies to all visitors, registered users, and paying customers of the service.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, contact our privacy and support team at:

• Email: support@ediroo.com
• Account Support: Registered users may also submit inquiries through the in-app Support Tickets dashboard.

2. Information We Collect

We collect information directly from you, automatically through your use of the service, and from trusted service providers. We collect only what is necessary to operate our online photo editing tools, process transactions, and maintain account security.

A. Account and Identification Data

• Registration details: Your email address, account password (stored securely as a cryptographic hash), unique user identifier, and account creation timestamp.
• Profile information: Name or username and avatar image if provided or retrieved when signing in via an authorized third-party authentication provider.

B. Photos, Prompts, and Processing Inputs

• Uploaded images: Image files you upload to the workspace (supporting JPEG/JPG, PNG, and WebP formats, up to 30 MB per file, and up to 3 reference images for multi-image tasks).
• Edit instructions: Text prompts, chosen editing modes (such as background replacement, object removal, or face cleanups), aspect ratio selections, brush or lasso coordinates, and target removal categories.
• Generated results and creations: High-resolution edited output images and task status records stored in your account's My Creations workspace.
• Photo metadata: Digital images frequently carry Exchangeable Image File Format (EXIF) metadata, including camera settings, timestamp, and potentially geographic coordinates (GPS). For standard AI generation tasks, only orientation and color-space parameters are retained to properly align and render the image; sensitive embedded metadata is stripped. We also provide a dedicated Photo Metadata Removal tool to clean EXIF and device tags.

C. Billing and Payment Records

• Order information: Selected plan or credit package, order identifiers, transaction amounts, billing currency, subscription terms, payment status, and renewal dates.
• Payment card handling: All cardholder data, credit card numbers, expiration dates, and security codes (CVV) are captured and processed directly by our third-party payment gateways (such as Stripe, PayPal, or Creem) under industry-standard encryption. We do not store or process complete payment card numbers on our servers.

D. Technical and Usage Data

• Device and connection logs: IP address, browser type and version, language settings, operating system, network provider, referral URLs, requested endpoints, access timestamps, and HTTP response codes.
• Error and operational diagnostics: Crash reports, API execution latencies, failed generation logs, and security event indicators used to prevent abuse and ensure platform stability.

E. Analytics and Attribution Data

• Campaign identifiers: Referral sources, campaign parameters, and acquisition identifiers associated with inbound links. We deploy an acquisition_visitor cookie (configured with a standard lifetime of 90 days) to associate incoming visits with registration and conversion metrics.

F. Customer Communications

• Support records: Inquiries, feedback, task references, error screenshots, and email exchanges submitted to support@ediroo.com or via help tickets.

3. How Photos Are Processed and Shared

Understanding how your visual assets travel through our platform is central to your privacy:

A. Upload and Storage

When you upload an image for editing, the file is securely transmitted from your browser to our object storage infrastructure (such as Cloudflare R2 or Amazon S3 compatible cloud storage). Selecting or dropping a file initiates the secure upload so that your workspace can display the source image and prepare generation coordinates.

B. Dispatch to AI Processing Providers

To perform AI-powered object removal, background substitution, or prompt-guided image synthesis, your image URLs, prompt instructions, and target parameters are transmitted via authenticated API to external AI inference infrastructure providers (including the KIE API platform and its integrated image processing models, such as Nano Banana, Seedream, and GPT Image).

C. Confidentiality and Model Training

• We do not train proprietary foundational AI models: Ediroo does not use your uploaded photos, private prompts, or generated outputs to train, refine, or evaluate our own generative artificial intelligence models.
• Third-party processing: While our third-party inference providers process requests solely to deliver the requested image generations, transmission across their networks is governed by their operational APIs and privacy boundaries. Because processing requires external computational clusters, we do not claim that processing occurs entirely locally on your device or that your files never leave our perimeter.
• Private by default: Your uploaded photos and edited outputs are kept strictly in your private account workspace. We do not publish your images to a public gallery or make them indexable by web search engines. Direct download and sharing links should be treated with care; anyone possessing an active sharing URL may access that specific image.

4. Purposes and Legal Bases for Processing

We process personal information under the following purposes and legal grounds (where applicable under the GDPR, UK Data Protection Act, or similar legislation):

| Processing Purpose | Categories of Data | Legal Basis | | :--- | :--- | :--- | | Delivering AI image editing (processing requests, rendering results, maintaining My Creations) | Uploaded photos, edit prompts, task records, output images | Performance of a Contract: Essential to provide the services requested under our Terms of Service. | | Account management and authentication | Email, password hash, OAuth identifiers, user profile | Performance of a Contract: Required to create, verify, and maintain your account credentials. | | Billing and subscription management | Order records, transaction references, purchased credits, subscription status | Performance of a Contract & Legal Obligation: Necessary to fulfill orders and comply with mandatory tax, accounting, and consumer laws. | | Customer support and dispute resolution | Support tickets, email correspondence, task logs, transaction references | Performance of a Contract & Legitimate Interests: Resolving technical faults, processing eligible refunds, and assisting users. | | Service security and fraud prevention | IP addresses, rate-limiting logs, API activity, failed generation diagnostics | Legitimate Interests: Protecting the platform against unauthorized access, payment fraud, bot attacks, and resource abuse. | | Attribution and platform performance analytics | Referrals, page views, acquisition_visitor cookie, aggregate metrics | Legitimate Interests or Consent: Understanding user acquisition channels and improving site performance. |

5. Third-Party Service Providers

We disclose necessary information to trusted third-party infrastructure and service providers operating under applicable commercial agreements and data protection standards:

• Cloud Infrastructure and Storage: Cloudflare (including R2 storage and edge routing) and compatible object storage services for hosting and delivering images.
• AI Inference and Processing: KIE API and associated vision generation providers to execute image editing, element removal, and generative synthesis.
• Payment Processors: Third-party gateways including Stripe, PayPal, and Creem to securely handle checkouts, process recurring subscriptions, and manage refunds.
• Email Delivery: Transactional email services (such as Resend) to send account verification, receipt notices, and support replies.
• Legal Compliance and Business Transfers: We may disclose data if required by a valid legal process, subpoena, or applicable regulation, or in connection with a corporate merger, reorganization, or asset sale.

We do not sell your personal information or visual assets to third parties.

6. Cookies and Browser Storage

We use cookies, local browser storage, and related web technologies to maintain essential functionality and monitor site performance:

• Strictly Necessary Cookies: Essential session tokens that keep you signed in, authenticate API requests, and safeguard form submissions. Disabling these cookies in your browser prevents you from using an account or uploading images.
• Functional Storage: Browser localStorage used to retain interface preferences, theme settings, and active tool layouts.
• Attribution and Analytics: We utilize an acquisition_visitor cookie with a 90-day retention lifespan to record inbound campaign sources and evaluate product registrations.
• Managing Cookies: You can adjust cookie settings or clear stored cookies directly through your web browser preferences. Note that clearing cookies does not automatically erase account data or stored images on our servers; to request account deletion, follow the procedure below.

7. Data Retention and Deletion

We adhere to clear and practical retention standards:

• User Photos and Results: Uploaded original images and generated results are stored in your account's My Creations workspace indefinitely so you can revisit, inspect, and download your work at any time. We do not impose an automatic 24-hour or temporary deletion window.
• Account Records: Your account profile, authentication credentials, and credit balances remain active until you request account closure.
• Financial and Legal Records: Transaction details, invoices, and payment histories are retained for the statutory periods mandated by commercial, tax, and accounting regulations (typically 5 to 7 years depending on jurisdiction).
• Server and Security Logs: Operational server logs, security event trails, and rate-limiting metrics are rotated and retained for security monitoring before being overwritten.

Requesting Deletion

You may request the deletion of your account, uploaded images, and associated personal information at any time by sending an email from your registered account address to support@ediroo.com. Upon confirming your identity, we will permanently delete or anonymize your files and personal records from active production databases without undue delay and within a reasonable timeframe, subject to legally mandated financial and transaction record retention. Residual data in encrypted system backups will be permanently purged in accordance with standard backup cycle overwrites.

8. International Data Transfers and Security

Ediroo serves users globally. Because our hosting infrastructure, payment partners, and AI inference nodes operate across multiple jurisdictions (including the United States and the European Union), your information may be transferred to and processed in countries other than your own.

Where international data protection frameworks require specific safeguards for cross-border data flows, our vendors implement standard contractual clauses or equivalent legal mechanisms recognized under applicable data protection laws.

We implement administrative, technical, and organizational measures—including HTTPS/TLS encryption in transit and restricted storage access—to protect your assets against unauthorized access, loss, or alteration. However, no internet transmission or digital storage platform can be guaranteed to be 100% invulnerable. We encourage you to maintain backup copies of all original photographs.

9. Your Privacy Rights

Depending on your country or state of residence (including the European Economic Area, the United Kingdom, California, and other jurisdictions), you may have specific statutory privacy rights:

• Access and Portability: The right to request confirmation of whether we process your personal data and to receive a copy of your information in a structured, commonly used format.
• Correction: The right to request the rectification of inaccurate or incomplete personal details.
• Erasure ("Right to be Forgotten"): The right to request the deletion of your personal information and uploaded media, subject to legal retention exemptions.
• Restriction and Objection: The right to request that we restrict processing or to object to processing based on legitimate interests.
• Withdrawal of Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting prior lawful processing.
• Non-Discrimination: You will not receive discriminatory treatment or diminished service quality for exercising any applicable privacy rights.

To exercise any of these rights, email support@ediroo.com. To safeguard your security, we may require verification of your identity before fulfilling the request. You also retain the right to lodge a complaint with your local data protection supervisory authority.

10. Children’s Privacy

Ediroo is intended for individuals who have reached the age of majority in their jurisdiction or who use the service under the supervision and authorization of a parent or legal guardian. We do not knowingly collect personal information directly from children under the minimum digital consent age required by applicable law (such as under 13 in the United States or under 16 in certain European jurisdictions). If you believe that a minor under the applicable age has submitted personal data without required parental consent, contact support@ediroo.com so we can promptly investigate and remove the information.

11. Policy Changes

We may update this Privacy Policy from time to time to reflect changes in our photo editing features, provider integrations, or legal obligations. When changes are made, we will update the Last Updated date at the top of this page. Material revisions will be accompanied by prominent notice on our website or through direct email notification where required by applicable law.