Privacy Policy

Last updated: October 25, 2026

1. Introduction & Data Controller

This Privacy Policy applies to fotox.io ("Service", "we", "our", "us"), operated by FotoX ("Data Controller").

It explains how we collect, use, and safeguard your information when you use our AI image processing service. For GDPR / CCPA purposes, the entity above is the Data Controller responsible for your personal data.

2. Information We Collect

  • Account Information: Email address or Telegram ID when you register
  • Usage Data: Pages visited, features used, and interaction data
  • Payment Information: Transaction records (we do not store full payment details)

3. Image Processing & Data Retention

🔒 Your Privacy is Protected

  • All uploaded images are processed in real-time and automatically deleted within 24 hours
  • We do NOT store, save, or archive any user-uploaded images beyond this window
  • Generated results are stored temporarily and automatically deleted within 24 hours — they will no longer be accessible from your account or any direct URL after this period
  • We do NOT use your images for AI training or any other purpose
  • If you need to keep an image, download it within 24 hours of generation

4. How We Use Your Information

  • To provide and maintain our service
  • To process your transactions
  • To communicate with you about your account
  • To improve our service and user experience
  • To send you marketing emails about new effects, features and offers (see section 4a)

4a. Marketing Emails

If your account has a real email address (for example, if you signed up with email, Google or Discord), we may email you about new effects and features, reminders about your account (such as unused credits or an expired VIP plan) and site-wide offers. These emails contain no explicit images, and the sender name and subject lines are discreet.

Legal basis by region

  • EU/EEA, United Kingdom and Switzerland: only with your consent, which you give by ticking the box at sign-up (it is never pre-ticked) or by switching marketing emails on in your account settings. You can withdraw it at any time.
  • Brazil: if you have purchased from us, our legitimate interest in telling customers about similar services, which we have assessed against your rights and expectations; otherwise only with your consent. You can object at any time.
  • Mexico: marketing is a secondary purpose that is not necessary for your account. You can refuse it at sign-up, in your account settings or with the unsubscribe link in any email, and refusing does not affect your account. If you did not see this choice when you signed up, we wait at least five business days after this notice was published, or after you signed up if that was later, before sending you any marketing email, so that you have time to refuse.
  • United States: we may email account holders, and you can opt out at any time.
  • Canada: if you have purchased from us in the last two years, or with your consent.
  • Other countries: only with your consent, unless local law allows us to email existing customers.

Every marketing email has a one-click unsubscribe link that works without signing in, and you can switch marketing emails off in your account settings at any time. Unsubscribing does not stop login codes or other messages we must send about your account.

Our emails contain no tracking pixels, so we do not know whether you open them. Links to our site carry a campaign tag so that we can count visits that come from an email.

We keep a record of each consent or refusal (date and time, IP address, the wording shown and where it was given) as proof of your choice. If you unsubscribe, or an email to you bounces or is marked as spam, we keep your email address on a do-not-email list so that we never email you again by mistake.

5. Data Security

We implement industry-standard security measures to protect your data, including:

  • SSL/TLS encryption for all data transmission
  • Secure server infrastructure
  • Regular security audits

6. Cookies

We use essential cookies to maintain your session and preferences. We do not use tracking cookies for advertising purposes.

7. Third-Party Services

We may use third-party services for payment processing (PayPal, Telegram Stars, cryptocurrency, regional bank transfer). These services have their own privacy policies.

Email providers: Amazon Web Services (Amazon SES, in the United States) delivers our login codes and marketing emails, and AgentMail hosts our support mailbox. They process your email address only to send and receive our messages.

8. Your Rights (GDPR / CCPA)

You have the right to:

  • Access your personal data
  • Request deletion of your account and personal data
  • Request correction of inaccurate data
  • Object to processing of your data
  • Data portability — receive your data in a portable format
  • Opt-out of marketing communications

To exercise these rights, contact our Data Protection Officer at [email protected] .

9. Contact Us