Privacy Policy
Last updated: 14 April 2026
Who we are
ShePix (“we”, “us”, “our”) is an AI-powered photo enhancement service. We are the data controller for the personal data processed through shepix.com.
Contact: shepix.studio@gmail.com
What data we process
| Data | Stored? | Duration | Legal basis |
|---|---|---|---|
| Your photos | Temporarily in Cloudflare R2 | Max 24 hours, then auto-deleted | Explicit consent + contract performance |
| Email / name | No | — | — |
| Payment data | Stripe only (we never see card numbers) | Stripe's policy | Contract |
| IP address | Cloudflare edge logs | 24 hours | Legitimate interest (security) |
| Cookies | None (no tracking, no analytics) | — | — |
Photos and biometric data
Your portrait photos may qualify as biometric data under GDPR Article 9. We process them only for the purpose of AI enhancement that you explicitly requested. We do not:
- Store, sell, or share your photos with third parties (except the AI processing services below)
- Use your photos to train AI models
- Retain any photo beyond 24 hours after upload
Third-party processors
We share data with these processors under strict contractual terms:
- Replicate — AI model processing (your photos are sent to Replicate's API and deleted after processing)
- Cloudflare — Storage (R2) and security (DDoS, WAF, Turnstile)
- Stripe — Payment processing (PCI-DSS compliant)
- Vercel — Hosting and serverless functions
Your rights under GDPR
You have the right to:
- Access — request a copy of data we hold about you
- Erasure — request deletion of your data (photos auto-delete within 24 hours anyway)
- Withdraw consent — you may withdraw consent at any time; this does not affect processing already performed
- Lodge a complaint — with your national data protection authority
To exercise any right, email shepix.studio@gmail.com. Because we don't collect identifying information, please include your job ID (shown on the download page) so we can locate your data.
Data retention
All uploaded photos and processed results are automatically and permanently deleted from Cloudflare R2 within 24 hours of upload. This is enforced by an automated daily cleanup job.
Cookies and tracking
ShePix uses no tracking cookies, no analytics, and no advertising. The only functional items stored are strictly necessary for the service (Stripe's payment session cookie during checkout). No cookie consent banner is required.
Security
We implement industry-standard security measures: SSL/TLS encryption (Cloudflare), DDoS protection, Web Application Firewall, bot protection (Cloudflare Turnstile), and private (non-public) cloud storage with time-limited signed URLs.
Changes to this policy
We may update this policy. The “last updated” date at the top will reflect changes. Continued use of the service constitutes acceptance.