The short version
- We collect what we need to run your account, your AI runs and your payments. We don't sell personal data or use it for advertising.
- The images you upload and the results we produce are stored in our Cloudflare R2 storage so you can download them again. They sit at unlisted links: anyone who has the exact link can open the file.
- To run the AI models, your image and any prompt you type are sent to fal.ai. Payments go through Stripe — we never see your full card number.
- Our analytics (Plausible) use no cookies and build no profiles.
- Email support@images2layers.com to get a copy of your data or to have your account, uploads and results deleted.
Who we are
Images2Layers ("we", "us") runs the website images2layers.com and the tools on it. This policy explains what personal data we process when you visit the site, create an account, use the AI tools or buy credits, and what choices you have. For any privacy question, write to support@images2layers.com.
What we collect
Account data
When you sign up we store your email address, the name you give us and your password as a salted hash (we can't read it). If you sign in with Google, where that option is offered, Google shares your name, email address and profile picture with us.
Images, prompts and results
When you use an AI tool we store the image you upload, any text you type (an eraser instruction, an edit instruction, a generation prompt or an optional description of your image) and the results: layer images, edited images and generated images. We also keep a record of each run — the tool and model, its status, timestamps, and the credits held, charged and refunded.
The free browser tools (PNG to PSD, PSD viewer and PSD to PNG) work differently: your files are processed inside your browser and are never uploaded to us.
Payment data
Checkout is handled by Stripe, which collects your card or other payment details. We never receive or store full card numbers. From Stripe we receive what we need to deliver and account for a purchase: the product, amount, currency, payment status, your billing email address and the Stripe customer and subscription identifiers.
Support messages
If you email us or open a ticket, we keep the conversation and anything you attach so we can help you and refer back to it later.
Technical and usage data
- IP address and browser. We record your IP address when you sign up and with each signed-in session, and your browser's user-agent string with the session. We use them to keep accounts secure and to prevent abuse.
- How you found us. On your first visit we set three first-party cookies that remember the language you browsed in, the
utm_sourcetag of the link you arrived from (if it had one) and the host name of the referring website — for examplegoogle.com, never the full address. If you create an account, these values are saved with it. Details are in the cookie policy. - Aggregate analytics. We use Plausible Analytics, which sets no cookies and collects no personal data. It counts page views, referrers, countries and device types in aggregate.
- Request logs. Our hosting provider processes request data, such as IP addresses and the pages requested, to deliver the site and protect it from attacks.
How we use it
- To provide the service: run your images through the models, show you the results and let you download them, and keep your credit balance and history.
- To take payments, add credits, manage subscriptions and keep financial records.
- To keep the service secure: detect fraud, abuse and breaches of our terms of service, and limit request rates.
- To answer support requests and send service messages, such as a password-reset link or notice of a change to our policies.
- To understand, in aggregate, which pages and tools people use, so we can improve them.
We don't sell your personal data, we don't use it for advertising, and we don't use your uploads or results to train AI models.
Legal bases (EEA and UK)
Where the GDPR or the UK GDPR applies, we rely on: the performance of our contract with you (your account, runs, purchases and support); our legitimate interests in keeping the service secure, preventing fraud, understanding how the site is used and knowing which channels bring new users, balanced against your rights; legal obligations, such as keeping tax and accounting records; and your consent where the law requires it.
Who processes data for us
We use a small number of service providers. Each one receives only what it needs to do its job for us and processes it under its own terms and privacy policy.
| Provider | What it does for us | Data involved |
|---|---|---|
| Cloudflare | Hosts the website and app (Workers), our database (D1) and our file storage (R2); delivers pages and blocks attacks | Everything the service stores; request data such as IP addresses |
| fal.ai | Runs the AI models: Seedream 5.0 Pro Layerize, Qwen Image Layered, object removal and Nano Banana | The image you submit (as a link to our storage) and your prompt |
| Stripe | Checkout, payments, subscriptions and receipts | Payment details, billing email, purchase details |
| Plausible Analytics | Cookieless, aggregate website statistics | Page, referrer, browser, device type and country — no personal profile |
| Resend | Delivers account emails, such as password resets | Your email address and the message |
| Google (optional) | Google sign-in, only if it is offered and you choose it | The sign-in exchange; Google shares your name, email and picture with us |
We may also disclose data when the law requires it, to protect the rights and safety of our users or the public, or as part of a sale or reorganisation of the service, in which case we'll tell you before your data becomes subject to a different privacy policy.
Where your images are stored, and who can see them
Uploads and results are saved in our Cloudflare R2 bucket so that you can preview and download them again later. Each file sits at a long, unlisted address. We don't publish these addresses, list them anywhere or link to them from public pages — but anyone who has the exact link can open the file, so treat a result link like a private share link and only pass it to people you trust.
How long we keep data
- Account data: for as long as your account exists.
- Uploads, prompts and results: until you ask us to delete them or close your account. We don't currently delete them automatically after a fixed period.
- Payment and order records: as long as tax and accounting law requires, which can be after your account is closed.
- Support conversations: as long as we need them to handle your request and refer back to it.
When we delete data, residual copies can remain in our providers' automatic recovery snapshots for a short time before they are overwritten.
Your rights and choices
Depending on where you live, you can ask to access, correct, export or delete your personal data, object to or restrict certain processing, and withdraw any consent you gave. To make a request, email support@images2layers.com from the address on your account, or open a ticket while signed in at Settings → Tickets — that's how we confirm the request comes from you. We answer within one month. You can also complain to your local data protection authority.
Deleting your account removes your profile, your uploads and results and your run history. We keep the order records the law requires us to keep. Unused credits are lost when an account is deleted.
International transfers
Our providers operate worldwide and process data in the United States and other countries. Where personal data leaves the EEA or the UK, we rely on the safeguards those providers offer, such as the European Commission's Standard Contractual Clauses.
Security
All traffic to the site uses HTTPS, passwords are stored as salted hashes, and access to production data is limited to the people who run the service. No system is perfectly secure. If we learn of a breach that affects your personal data, we'll notify you and the authorities as the law requires.
Children
Images2Layers isn't intended for children under 16, and we don't knowingly collect their personal data. If you believe a child has given us personal data, contact us and we'll delete it.
Changes to this policy
When we change this policy we update the date at the top of the page. If a change materially affects how we use your data, we'll also tell account holders by email or in the app before it takes effect.
Contact
Questions and requests: support@images2layers.com. See also the terms of service, the refund policy and the cookie policy.