Privacy policy

This policy explains how we process your personal data when you use the website avpad.com, the free image tools or the AvPad studio (together "AvPad" or "the service").

1. Controller

Intermac systems
Sendnicher Str. 58a
56072 Koblenz, Germany
Email: hello@avpad.com
Phone: +49 151 2755 5942

For privacy questions, contact hello@avpad.com. We have not appointed a data protection officer because the legal thresholds do not apply.

2. What AvPad is

AvPad generates and edits images with AI models. You enter text descriptions (prompts) and can optionally upload your own images as input or reference. The images are produced by external AI providers (OpenAI, Google). We also offer free tools such as resizing, format conversion and compression that run on our own servers without AI.

3. Data we process

3.1 Account and sign-in

You sign in with your Google account. Google provides us with your name, email address, profile picture and a Google identifier. We store these together with your chosen language, sign-in time and credit balance. You can change your display name in your profile; later sign-ins do not overwrite it.

Purpose: providing your account. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

While the service runs in invite mode, we also store your email address on the waitlist and the status of your invitation. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual steps).

3.2 Prompts, uploaded images and results

When you generate or edit images, we process:

• your text input (prompts, titles, style settings)
• images you upload (input image, reference images, sketches, masks)
• the generated result images
• generation metadata: model, format, time, credits used, cost, error messages
• for 3D models, the files the provider delivers (GLB, OBJ, FBX, USDZ, STL or Blend, depending on the model) and the versions with fewer faces or smaller textures that we make from them on our own server

This content is stored in your account (history) so you can reuse, edit and download results. You can delete individual images at any time.

Note on images of people: if you upload photos showing people, we process personal data of those people. You may only upload such photos if you are entitled to, for example because you are the person shown or you have that person's consent. We do not analyse faces biometrically and do not build a face database.

Purpose: providing the service. Legal basis: Art. 6 (1) (b) GDPR.

3.3 Free image tools

In the free tools (resize, crop, convert, compress, HEIC conversion) your files are held in server memory only for the duration of processing and discarded immediately after the response. We store neither the files nor their content. We only count usage per tool and day, and to limit use without an account we store your IP address for 24 hours.

Legal basis: Art. 6 (1) (b) GDPR for processing, Art. 6 (1) (f) GDPR for the usage limit (abuse prevention).

3.4 Payments

You buy credits through Stripe. We do not store full payment details ourselves, only the Stripe customer ID, the package purchased, amount, time, invoice number and payment status. Card data is processed exclusively by Stripe.

Legal basis: Art. 6 (1) (b) GDPR; for retention of invoice data Art. 6 (1) (c) GDPR in conjunction with Section 147 of the German Fiscal Code.

3.5 Emails

We send transactional emails: invitation, purchase confirmation and receipt, low balance notice, refund notice and, when you trigger them yourself, the link to your data export and the confirmation of a deletion request. The purchase receipt is necessary to operate the service and cannot be turned off while your account exists. You can turn off the low balance notice and the refund notices at any time in your profile under "Emails"; the low balance notice also carries an unsubscribe link. We send marketing emails only with your consent.

If you write to us, we store your message and our reply to handle the request.

Legal basis: Art. 6 (1) (b) GDPR; for marketing Art. 6 (1) (a) GDPR.

3.6 Automatically collected data

On every request our servers process the IP address, date and time, page requested, browser and operating system, and referrer URL. These are kept in server logs for 30 days; IP addresses are anonymised after 14 days.

For administrators we keep an audit log of administrative actions (such as invitations and refunds) containing the acting person, the action, the time and the affected account.

Purpose: operation, troubleshooting, IT security, accountability. Legal basis: Art. 6 (1) (f) GDPR.

3.7 Profile, data export and account deletion

In your profile you can change your display name, see how many images and credits you used this month, and adjust your email settings. The usage overview is calculated from your stored generations and credit bookings; no further data is created.

Data export (Art. 15 and 20 GDPR). Under "Export data" you have a link sent to the email address of your account. The link leads to a JSON file with your account details, the details of your generations (prompts, settings, times), your references, your credit bookings and purchases, and the emails we sent you. Image files are not included. The file is created only when you open the link; we do not store it. The link is signed, works for 24 hours and only for that request: a new request makes the old link invalid and is possible after an hour at the earliest. For this we store the time of your last request until your account is deleted. Legal basis: Art. 6 (1) (c) GDPR (meeting your data subject rights).

Account deletion (Art. 17 GDPR). Under "Delete account" you request the deletion of your account after typing your email address to confirm. We confirm the request by email. Seven days after the request we delete the account; until then you can call the deletion off in your profile and use AvPad as usual. With the deletion we remove:

• all your generations with their result images and 3D models
• all images you uploaded (source images, reference images, sketches, masks) on both of our storage zones at BunnyCDN, the private and the public one
• your references from the library
• your credit bookings; credits you have left are lost
• the emails to you from our sending log, and any entry on the waitlist and your invitation
• your name, email address, profile picture, Google identifier and settings from the account record

Usage and cost statistics that we use to account for the operation of the service remain, without any link to you.

The records of your purchases (time, package, amount, VAT rate, Stripe identifiers and the note on the waiver of the right of withdrawal) and the bookings that belong to them are kept. They stay attached to a placeholder record that holds the Stripe customer number but neither a name nor an email address. Retention period: see Section 5. Legal basis: Art. 6 (1) (c) GDPR in conjunction with Section 147 Fiscal Code. Your customer record at Stripe remains; Stripe processes it under its own responsibility. Deleted data may remain in backups for up to 30 days.

4. Recipients

4.1 AI providers

To generate images we transmit your prompts and uploaded images to the provider of the model you selected:

All providers process the data solely to generate your image. Under the terms that apply to API use, your inputs are not used to train the models. OpenAI and Google retain inputs for abuse monitoring for up to 30 days and then delete them. We have data processing agreements under Art. 28 GDPR with all of them. For processing in the USA we rely on the providers' certification under the EU-US Data Privacy Framework (European Commission adequacy decision) and, in addition, the EU standard contractual clauses (Art. 46 (2) (c) GDPR).

We use Replicate, Inc. (San Francisco, USA) as a further AI provider for upscaling, restoring and colouring images and for removing backgrounds and objects; the Seedream 5 Pro model also runs there. Processing takes place in the USA on the basis of the EU-US Data Privacy Framework and the EU standard contractual clauses. Under Replicate's API terms your inputs are deleted after processing. These tools are also available without an account; in that case we do not store the result, we only return it to your browser.

The Qwen Image 3 model comes from Alibaba Cloud and is reached through Replicate: your prompt and images go to Replicate, which passes them on to Alibaba Cloud to generate the image. The same data processing agreement with Replicate and the same transfer basis apply as above, the EU-US Data Privacy Framework and the EU standard contractual clauses.

For the "Image to 3D" tool we use fal.ai (Features & Labels, Inc., USA). Your uploaded image (up to four views with Meshy) and the settings you choose go to fal.ai, which passes them on to generate the 3D model to the vendor of the model you chose, where the vendor runs that model itself: Meshy (Meshy 7.1), Tripo (Tripo P2) or Tencent (Hunyuan 3D 3.1 Pro and Rapid). We download the finished 3D model from there and store it with us (BunnyCDN); we only ever serve our own copy, never a provider's link. Processing takes place in the USA, depending on the model also at the vendor in a further third country. The transfer is based on the EU standard contractual clauses (Art. 46 (2) (c) GDPR). A data processing agreement under Art. 28 GDPR applies. Jobs in this tool take a few minutes: fal.ai reports the end back to our server, and we check each call against fal.ai's signature.

When you use the prompt helper in Create, we send what you type into it, the conversation so far and the studio's settings (selected model, shape, resolution, template and the number of attached images, not the images themselves) to Anthropic, which writes a prompt from them with a Claude model. We store neither your text nor the answer; we only record when you used the helper and how many tokens it took, to limit its use and to account for its costs. Under the terms that apply to API use, your inputs are not used to train the models. Processing takes place in the USA on the basis of the EU standard contractual clauses (Art. 46 (2) (c) GDPR). A data processing agreement under Art. 28 GDPR applies.

All providers apply automated content filters. Prompts or images that violate their usage policies are rejected. In that case we receive only the error message, not the detailed reason.

4.2 Other service providers

We have data processing agreements under Art. 28 GDPR with all providers. Where data reaches the USA (Google, Stripe), this is based on the EU-US Data Privacy Framework and the EU standard contractual clauses.

4.3 Other recipients

We disclose data to authorities and courts only where legally required. In the event of a sale of the business, data may pass to the acquirer; we will inform you in that case.

5. Retention

When you request the deletion of your account, account data, prompts, images and references are deleted after seven days (Section 3.7). They may remain in backups for up to 30 days. Invoice data is retained for tax reasons.

6. Cookies and local storage

We use only technically necessary cookies and local storage:

We use no analytics, tracking or advertising cookies and no services such as Google Analytics or social media pixels. Legal basis: Section 25 (2) no. 2 TDDDG, Art. 6 (1) (f) GDPR.

7. Security

All connections are encrypted with TLS. Servers are located in Germany and protected by a firewall, regular security updates and daily encrypted backups. Administrative access is limited to a few people, secured with two-factor authentication and logged. Your images are only reachable through your account; image URLs are not publicly discoverable unless you share an image yourself.

8. No automated decisions

The AI models generate images on your instruction. There is no automated decision-making with legal effect within the meaning of Art. 22 GDPR. We do not build user profiles for advertising.

9. Minors

AvPad is intended for people aged 18 and over. We do not knowingly collect data from minors.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You may withdraw any consent at any time with effect for the future.

To exercise your rights, write to hello@avpad.com. We respond within one month. You can download and delete your images and prompts yourself at any time. In your profile you ask for a copy of your data under "Export data" and request the deletion of your account under "Delete account".

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz, Germany.

11. Changes

We update this policy when the service or the law changes. The current version is always available at avpad.com/privacy. We will notify you by email of material changes.