Superphoto
Privacy Policy
Effective: 5 August 2026
This policy explains how Superphoto handles personal data when you use our website, AI photo-enhancement application, payment features and shared galleries.
1. Who is responsible for your data
The data controller is APPTO INNOVATIONS IDIOTIKI KEFALAIOUCHIKI ETAIRIA, registered at Trygaiou 26, Marousi, Attica 15123, Greece. Registration number: G.E.MI. 124121201000 ยท EUID ELGEMI.124121201000. VAT ID: EL800467530.
Privacy enquiries and rights requests: hello@superphotobnb.com.
2. Data we collect
- Account data: name, email address, authentication identifiers and basic profile details provided through Firebase Authentication.
- Content: photos you upload or import, listing/project names, room classifications, enhancement instructions, generated images and gallery-sharing settings.
- Usage and technical data: feature activity, coin transactions, timestamps, IP address, browser/device information, diagnostics and security events.
- Payment and billing data: purchases, currency, payment status, Stripe references, billing details and tax information. Complete card details are handled by Stripe and are not stored by Superphoto.
- Support data: contact details, messages, case history and files or information you choose to send us.
3. Why we use data
| Purpose | Legal basis |
|---|---|
| Create your account, process photos, provide coins, galleries and downloads | Performance of our contract |
| Process payments, receipts, tax records and refunds | Contract and legal obligations |
| Secure the service, prevent fraud and improve reliability | Legitimate interests in operating a safe service |
| Answer support requests and service communications | Contract and legitimate interests |
| Optional marketing or non-essential analytics | Consent, where required; you may withdraw it at any time |
| Comply with law and establish or defend legal claims | Legal obligation or legitimate interests |
We do not sell personal data. We do not use private customer photos to train public or third-party AI models unless we first obtain a separate, clear permission.
4. AI processing and service providers
To deliver enhancements, selected photos and instructions may be sent to configured AI providers, such as OpenAI or Google Gemini. We use providers under service terms and data-protection arrangements appropriate to their role. Results can contain errors or visual changes, so you should review every image before publishing it.
We also use vendors that may process data for us, including Google Firebase for authentication, database and storage services; Stripe for payments, billing and fraud prevention; infrastructure, email, monitoring and customer-support providers. We disclose only what is reasonably needed for the relevant service.
5. Imports and shared galleries
If you import content from a third-party listing URL, you confirm that you are authorised to access and process it. The third-party site remains governed by its own privacy policy and terms. A gallery you choose to share may be accessible to anyone with its link. Do not share a link containing content you want to keep private, and revoke it when it is no longer needed.
6. International transfers
Some providers may process data outside the European Economic Area. Where required, we rely on an adequacy decision, Standard Contractual Clauses or another lawful safeguard. You may ask us for information about the applicable safeguard.
7. Retention
We keep account, project and photo data while your account is active. Account deletion removes active project records, stored photos, enhancement history and shared links. Imported Airbnb source files are temporary and expire within 24 hours. Revoked gallery links stop working when they are removed.
Support requests are retained for up to 730 days. Payment, invoice and tax records may be retained for the period required by law and are restricted after account deletion. Deleted data may remain temporarily in infrastructure-provider backups until the applicable backup cycle expires.
8. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, and to receive portable data. Where processing relies on consent, you may withdraw it. You may also complain to your local data-protection authority. These rights can be limited where the law permits or requires us to retain information.
Use Support or contact the privacy email above. We may need to verify your identity before completing a request.
9. Security, children and changes
We use organisational and technical safeguards designed to protect data, but no online system is completely secure. Superphoto is a business service and is not directed to children under 16. We may update this policy as the service or law changes; material changes will be communicated through the service or by email where appropriate.