Privacy Policy

1. Introduction

Picanha L.L.C-FZ ("we," "our," or "us"), registered in the United Arab Emirates (Registration No. 2203851.01), operates the AI Passport Photo service at aipassportphoto.co. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our service, in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and applicable data protection regulations.

2. Data We Collect

We collect the following categories of personal data:

• Photographs: Images you upload for passport photo processing. These are temporarily stored for the purpose of generating your passport photo and delivering the final result.
• Email address: Provided at checkout to deliver your download links and order confirmation.
• Payment information: Payment transactions are processed by Stripe, Inc. We do not store your credit card details on our servers. See Stripe's privacy policy at stripe.com/privacy.
• Technical data: IP address, browser type, device information, and usage analytics collected through Vercel Analytics for service improvement.

3. How We Use Your Data

We use your personal data for the following purposes:

• To process your uploaded photograph and generate a government-compliant passport photo using AI technology.
• To deliver your completed passport photo via email and secure download links.
• To process payments for our services.
• To respond to customer support inquiries.
• To improve our service and ensure quality and security.

4. Legal Basis for Processing

We process your personal data based on: (a) the performance of a contract when you use our service and make a purchase; (b) your consent when you upload a photograph; and (c) our legitimate interests in improving and securing our service. Under the UAE PDPL, we ensure that data processing is proportionate to the purposes stated and that adequate safeguards are in place.

5. Data Storage and Retention

• Photographs: Uploaded and generated images are stored on Vercel Blob Storage. Download links expire after 7 days. We retain processed images for up to 30 days to handle customer support requests, after which they are permanently deleted.
• Email addresses: Retained for transactional records and customer support. You may request deletion at any time.
• Payment records: Maintained by Stripe in accordance with financial regulation requirements.

6. Third-Party Service Providers

We share data with the following third-party processors, each of which maintains appropriate data protection standards:

• fal.ai: AI image processing to generate passport photos from your uploaded image.
• Stripe: Secure payment processing.
• Resend: Transactional email delivery for download links and confirmations.
• Vercel: Web hosting, serverless functions, blob storage, and analytics.

7. International Data Transfers

Our service providers may process data outside the UAE. Where personal data is transferred internationally, we ensure that appropriate safeguards are in place as required by the UAE PDPL, including contractual obligations on our service providers to maintain equivalent levels of data protection.

8. Your Rights

Under the UAE PDPL and applicable regulations, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate personal data.
• Request deletion of your personal data.
• Object to or restrict the processing of your personal data.
• Withdraw consent at any time (without affecting the lawfulness of processing carried out prior to withdrawal).
• Lodge a complaint with the UAE Data Office if you believe your rights have been violated.

To exercise any of these rights, please contact us at support@aipassportphoto.co.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. All data transmissions are encrypted via HTTPS/TLS. Download links are protected by HMAC-SHA256 token verification. Payment processing is handled by PCI DSS-compliant processors.

10. Cookies and Analytics

We use Vercel Analytics, a privacy-focused analytics service that does not use cookies for tracking. No personal advertising cookies are placed on your device. Essential cookies may be used for site functionality only.

11. Children's Privacy

Our service may be used to create passport photos for minors. In such cases, the parent or legal guardian is responsible for uploading the photograph and providing consent. We do not knowingly collect personal data from children without parental consent.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of our service after changes constitutes acceptance of the revised policy.

13. Contact

For privacy-related inquiries or to exercise your data protection rights, contact us at: