Privacy Policy
Last updated: February 2026
🔒 Privacy Highlights
- ✓We do NOT store your photos - Images are processed in memory and immediately discarded
- ✓Minimal data collection - Only email, usage counts, and subscription status
- ✓Your rights protected - Access, delete, or export your data anytime
- ✓GDPR compliant - Full compliance with UK and EU data protection laws
1. Data Controller
HLMT Ltd is the data controller responsible for your personal data.
Contact: support@bagportrait.com
2. What We Collect
We collect minimal data necessary to provide our service:
| Data Type | Purpose | Legal Basis |
|---|---|---|
| Email address | Account authentication, communications | Contract performance |
| Usage counts | Track generations against plan limits | Contract performance |
| Subscription status | Manage your plan and billing | Contract performance |
| Consent timestamps | Record your agreement to our policies | Legal obligation |
| Visitor analytics | Improve service, understand usage patterns | Legitimate interest |
3. What We Don't Collect
🛡️ BagPortrait is built with privacy-first principles
We explicitly do NOT collect or store:
- Uploaded photos - Your person photos and bag images are processed in memory only and immediately discarded after generation
- Generated images - We don't keep copies of the images we create for you
- Prompts or text inputs - Your custom prompts are not logged or stored
- Biometric data - We don't extract or store facial features or other biometric information
- Location data - We don't track your precise location
4. How We Use Your Data
We use your data to:
- Provide and maintain the BagPortrait service
- Process your subscription and payments
- Send important service notifications
- Respond to your support requests
- Detect and prevent fraud or abuse
- Improve our service based on usage patterns
- Comply with legal obligations
5. Third-Party Services
We use trusted third-party services to operate BagPortrait:
Stripe (Payments)
Processes subscription payments securely. We never see your full card details.
Privacy Policy →Google Gemini (AI)
Generates images. Images are processed per Google's API terms and are not retained by Google for training.
Privacy Policy →Sentry (Error Monitoring)
Tracks errors to improve service quality. Personal data is anonymized.
Privacy Policy →6. Data Retention
- Account data: Retained until you delete your account
- Images: Not retained - processed in memory and immediately discarded
- Usage logs: Aggregated statistics retained for service improvement
- Payment records: Retained as required by financial regulations (typically 7 years)
7. Your Rights (GDPR)
Under UK and EU data protection laws, you have the right to:
Access
Request a copy of your personal data
Rectification
Correct inaccurate personal data
Erasure
Delete your account and data
Portability
Export your data in a machine-readable format
Objection
Object to certain processing activities
Restriction
Limit how we use your data
To exercise these rights, contact us at support@bagportrait.com or use your account settings. We will respond within 30 days.
You also have the right to lodge a complaint with a supervisory authority (the ICO in the UK).
9. International Transfers
Some of our service providers are based outside the UK/EU (primarily in the United States). Where data is transferred internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses and adequacy decisions where applicable.
10. Children's Privacy
BagPortrait is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Significant changes will be communicated via email or prominent notice on the Service. We encourage you to review this policy periodically.
12. Contact Us
For privacy-related inquiries or to exercise your data rights:
Email: support@bagportrait.com
Data Controller: HLMT Ltd