Privacy policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

StartklarWeb, owner Hasan Mohsen

Brucknerstraße 12, 46325 Borken (Münsterland), Germany

E-mail: info@bildplattform.de

We have not appointed a data protection officer because there is no legal obligation to do so.

Bildplattform is a hosted access point to a tool for AI-assisted image editing, in particular for real estate photos. We process personal data only to the extent necessary to provide the website, your account and to answer your enquiries.

With regard to the photos you upload as a customer, we act as a processor on your behalf. You are the controller for that content. The basis for this is our data processing agreement (DPA) at /en/legal/data-processing. For your own account data (for example registration and billing) we are the controller; this privacy policy applies to that.

The application and its database are operated with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server location is in Finland (Helsinki) and therefore within the European Union.

The provider processes technical access data on our behalf. A data processing agreement under Article 28 GDPR is in place with Hetzner.

The legal basis is our legitimate interest in providing the application securely and reliably under Article 6 (1) (f) GDPR.

When the application is accessed, information transmitted by your browser is recorded automatically and is technically necessary for delivery and security. This includes in particular:

We use technically necessary cookies or comparable storage mechanisms required to operate the service, in particular a session cookie that keeps you signed in and the storage of your language setting. These are based on Section 25 (2) TDDDG in conjunction with Article 6 (1) (f) GDPR and do not require consent.

We only use non-essential services, in particular reach measurement with Google Analytics (see clause 11), if you have consented via our cookie banner. You can change or withdraw your choice at any time with effect for the future.

To buy and manage your licence you create an account. In doing so we process the details you provide, usually name, e-mail address, company name and your access credentials, as well as information about your licence and the users you set up.

We store passwords exclusively as a cryptographic hash (argon2) and never in plain text.

The purpose is to provide the account, manage your licence and users and communicate with you. The legal basis is Article 6 (1) (b) GDPR (performance of a contract).

To edit them, you upload photos into the application. These photos can contain personal data, for example depicted persons or details contained in the metadata.

With regard to the uploaded photos, you as the customer are the controller under data protection law and we are the processor. We process this content solely on your instructions and for the purpose of enabling you to edit it. Details, in particular on the technical and organisational measures and on deletion, are set out in our data processing agreement (DPA) at /en/legal/data-processing.

You are responsible for ensuring that you are entitled to process the persons depicted in the photos and for observing any labelling obligations for AI-edited images.

Bildplattform works on a bring-your-own-key basis. In the application you store your own access key (API key) for an AI provider of your choice.

We store this key in encrypted form so that the application can trigger the AI editing in your name and at your expense. The key is used solely for this purpose and is not passed on to third parties. The legal basis is Article 6 (1) (b) GDPR (performance of a contract).

To purchase the licence we offer payment by invoice and bank transfer as well as payment via the payment service provider Stripe.

For payment by invoice we process the data required for invoicing (for example name, company name, address, e-mail address and order details). For payment via Stripe, the payment data is processed directly by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe's privacy information applies in addition. Where data is transferred to the USA, we base this on the EU standard contractual clauses or a valid adequacy instrument.

The legal basis is Article 6 (1) (b) GDPR (performance of a contract); for the statutory retention of invoice records additionally Article 6 (1) (c) GDPR.

To send system and account e-mails (for example confirmations, password resets, invitations and licence information) we use the Resend service provided by Resend, Inc., USA. Resend processes the data required for sending (in particular your e-mail address and the content of the message) as a processor on our behalf.

Where data is transferred to the USA, we base this on the EU standard contractual clauses or a valid adequacy instrument. The legal basis is Article 6 (1) (b) GDPR (performance of a contract) and our legitimate interest in reliable e-mail delivery under Article 6 (1) (f) GDPR.

For reach measurement we use Google Analytics, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies to analyse the use of the website.

This is used exclusively on the basis of your consent under Article 6 (1) (a) GDPR, which you give via our cookie banner. You can withdraw your consent at any time with effect for the future; the lawfulness of the processing carried out until the withdrawal remains unaffected.

When using Google Analytics, data may be transferred to Google LLC in the USA. Access to this data by US authorities cannot be entirely ruled out. We base the transfer on the EU standard contractual clauses or a valid adequacy instrument.

The actual AI image editing is carried out by an AI provider you choose, for example OpenAI or Black Forest Labs, which you connect with your own API key and pay for yourself.

When you trigger an edit, the image and the editing instructions are transmitted, via your own API key, to the AI provider you chose. That provider's privacy and contractual terms apply to this processing. Please review them before uploading personal or confidential content. The provider you chose, or you yourself as its contractual partner, is responsible for that processing.

We only pass on personal data to the extent necessary. Recipients are in particular:

Under the GDPR you have in particular the following rights in relation to us:

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2 to 4, 40213 Düsseldorf.

We process and store personal data only for as long as necessary for the respective purposes or as required by statutory retention periods. Invoice and accounting records are retained for the statutory periods. After that the data is deleted. The rules of the DPA apply to the deletion of the photos you upload.

There is no decision based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.

We update this privacy policy whenever changes to our processing or to the legal situation make it necessary. The version published on this page applies in each case.