Privacy Notice

Last updated: 14 October 2026

Who we are and how to contact us

BestImage.com is operated by Andrejus Sevcovas, individual-activity certificate 480837, Algirdo 22–21, 03218 Vilnius, Lithuania. We are the controller for account administration, billing, support and our service operations. Contact contact@bestimage.com, our Contact page, or the postal address above. Mark privacy enquiries “Privacy request.” Never send passwords, API keys, complete payment-card numbers or security codes.

This notice covers the current early-access AI product-image studio, its website and Insights articles. Public registration, Customer generation, one-time credit purchases and monthly subscriptions are available subject to account, payment, safety and service limits.

What we collect and why

Name, username, email, password hash, account/profile and authentication records
Purpose: Account access, administration and security
GDPR basis where applicable: Contract or pre-contract steps; legitimate interests in account security
Product uploads, project names, creative instructions, brand preferences, generated images, previews, reviews and job records
Purpose: Perform and deliver the creative operation requested, save projects and resolve failures
GDPR basis where applicable: Contract for the requested service; legitimate interests in proportionate support/security
Billing name/address, company or telephone details when supplied, orders, PayPal transaction/subscription identifiers, receipts, wallet and refund/dispute records
Purpose: Payment, entitlements, reconciliation and accounting
GDPR basis where applicable: Contract, legal obligations and legitimate interests in fraud prevention/dispute handling
Contact details and support messages
Purpose: Answer enquiries and resolve complaints
GDPR basis where applicable: Pre-contract steps or contract; legitimate interests in handling other correspondence; legal obligations where applicable
IP addresses, browser/device/request information, session identifiers and infrastructure security records
Purpose: Deliver pages, authenticate sessions, prevent abuse and investigate faults
GDPR basis where applicable: Legitimate interests in secure operation; essential communications functionality
Optional cookie-based analytics and first-party Studio interaction counts
Purpose: Understand service use and improve the interface
GDPR basis where applicable: Consent where required for optional analytics; consent for the optional Studio counter

Information necessary for account access, checkout or a requested generation must be supplied for that operation to work. Optional analytics are not a condition of buying or using the Studio. We do not use the image service to decide eligibility for employment, credit or insurance.

Use product photographs with the necessary permissions. Remove unnecessary personal information. Do not upload identity documents, credentials, sensitive personal data or unlawful images. If you intend to process other people's personal data for a business, contact us about the required processing arrangements before doing so; this notice does not replace a processor contract.

AI, hosting, payments and other recipients

Render: hosts the worker that retrieves the image and instructions needed for generation, local background processing, previews and delivery recovery.
OpenAI API: receives the source/reference image and creative instructions needed for requested AI operations, including relevant brand preferences. Text-only creative assistance sends its text brief; local preview preparation does not itself call OpenAI.
PayPal: processes checkout/subscription payments, payment authorisation, fraud prevention and transaction administration. BestImage stores billing records and provider identifiers, not raw card numbers or CVVs. PayPal's own privacy terms govern processing it performs as an independent controller.
Cloudflare Turnstile: checks technical signals for sign-in, registration, recovery and Contact form security. The returned token is verified by our server. Cloudflare describes processor and independent-controller functions in its Turnstile privacy notice.
Hosting/email providers and authorised administrators: host WordPress and private files, deliver transactional/support messages and maintain the service.
Google tag integration: the website contains a Google tag. Its configured destinations, consent blocking and retention are being verified. Google integrations may process device/network, page and interaction information; do not assume that a cookie-category label describes every transmission.
Legal/professional recipients: information may be provided where necessary for legal duties, accounting, protecting rights or resolving disputes.

OpenAI's published policy states API content is not used for training by default unless a customer opts in. Standard abuse-monitoring logs may retain content for up to 30 days, with safety/legal exceptions. We have not verified a BestImage-specific zero-data-retention approval. See OpenAI data controls.

Private projects are not a public gallery. We do not obtain a general marketing licence to your uploads; public use of private work requires separate permission.

Authentication, security, consent preferences and shopping sessions use cookies or similar browser storage. Necessary cookies may contain personal session identifiers; “necessary” does not mean anonymous. Open the site's Cookie preferences/Re-consent control to review choices, or contact us if it is unavailable. Browser controls can delete cookies, but blocking essential cookies may prevent sign-in or checkout. Payment providers may use their own technologies when you interact with their checkout.

Optional non-essential tracking requires the applicable consent and disclosure. The Google consent integration is still under verification; this notice is not proof that blocking is correctly configured.

The separate Usage preferences → Help improve Studio option starts unchecked. If selected, it contributes allowlisted upload, render-wait, download-click and credit-prompt events to first-party aggregate hourly counts. These counters do not contain an account identity, image or per-person browsing trail. This preference is visit-scoped; uncheck it to stop sending new counts. Normal server security processing still applies to the requests. Support enquiries and service emails do not automatically subscribe you to marketing.

Retention and deletion

Account data is kept while the account is used and as needed to administer its closure, resolve disputes and meet applicable duties. Original references and results do not currently undergo automatic age-based expiry. They remain until project deletion, confirmed erasure or justified service administration. Keeping files in History is not a permanent storage guarantee; download copies you need.

Project deletion and privacy erasure can wait for an active job to finish or expire safely. Financial and credit-reconciliation records may be retained for accounting, disputes, fraud prevention or other legal duties. Cancelling a subscription and requesting personal-data erasure are separate actions; contact us to reconcile both before account closure.

Optional aggregate usage buckets target a 48-hour window. Minimal application diagnostic logs are bounded to two small files and idle logs target seven-day expiry. Worker measurement records target 30-day pruning on writes and are also bounded by record count. Scheduling/write-dependent cleanup is not an exact deletion-time guarantee. Worker recovery records can persist while delivery or reconciliation remains unresolved.

Support correspondence is retained as necessary to resolve/document the enquiry and related claims. The operator's detailed financial/support schedule and hosting/email/backup cycles are being verified. Website deletion does not immediately remove independent backups or records held by providers. We do not promise a fixed backup-erasure period or immediate deletion everywhere; request information about your particular records and any applicable legal restriction.

International processing

OpenAI, Render, Google, Cloudflare, PayPal and hosting infrastructure can involve processing outside the EEA, including the United States. A European worker region is not an EEA-only guarantee. The account-specific contracts, transfer bases and available safeguards are being verified; we do not represent that specific Standard Contractual Clauses are already confirmed for every recipient. Contact us for the applicable arrangements before uploading personal or confidential material. This disclosure does not itself establish a lawful international-transfer mechanism.

Your rights

Where GDPR applies, request access, correction, erasure, restriction, portability or an objection to legitimate-interest processing. Withdraw consent for optional processing without affecting earlier lawful processing. Contact us from your account email and describe the request; we use proportionate identity checks and do not ask for your password. We normally respond within one month; any lawful extension is explained. Rights can be limited by legal duties and the rights of others. Copies of saved images can be downloaded in Studio; broader data exports and erasure are handled through the verified privacy process.

California residents may also request information, correction, deletion and, where CCPA applies, opt-out of sale/sharing, limitation of qualifying sensitive information use and non-discrimination. An authorised agent may submit a request with appropriate authority. CCPA applicability depends on its statutory criteria; we do not claim that every small business is automatically covered. Where it applies, we follow its verification and response requirements, generally 45 days for access/deletion/correction requests with permitted extensions. Contact us about privacy controls or requests rather than supplying payment credentials.

You may complain to Lithuania's State Data Protection Inspectorate or another competent supervisory authority. We will update this notice and notify affected users of material changes where required.