Privacy and information processing policy

For applicable privacy law, the operator of personal data is the owner of Exif Expert (“we”). This document covers the site, dashboard, upload forms, and related flows (including payments if enabled).

If you disagree with the processing terms, do not register and do not send files or other data through the site.

Account: email, password hash, optional name, session identifiers, sign-in times, and records needed to operate the account.

Files and metadata: uploaded image contents and embedded metadata to the extent required by the feature you choose.

Payments: when enabled, payment identifiers, amounts, and statuses; card or wallet details may be processed directly by payment providers while we receive limited accounting data they pass to us.

Technical logs: IP address, User-Agent, request time, URL, response codes, and error details for security, debugging, and abuse prevention.

Cookies and local storage: session IDs, UI preferences, and policy consent flags as needed for the site to function.

Provide site features (sign-in, uploads, EXIF processing, delivering results).

Maintain user and payment records and perform contractual duties.

Ensure security and prevent fraud or abuse.

Improve stability using aggregated analytics if enabled (without identifying individuals where feasible).

We use cookies and similar storage for sign-in sessions, CSRF protection where applicable, essential preferences, analytics and attribution, service improvement, security, and fraud or abuse prevention.

Google Tag Manager, Meta Pixel, and our first-party usage analytics operate when you visit or use the site. Depending on the event, these systems may process URLs and referrers, timestamps, IP address, User-Agent or browser and device attributes, approximate location, cookie or local-storage identifiers including ee_analytics_vid, and page-view, tool-use, registration, lead, or conversion events. Google and Meta handle data they receive under their own terms.

Our first-party page and tool analytics records the event, time, IP address, referrer, anonymous visitor identifier and, when signed in, user identifier. Account, order, donation or payment, and processing records are stored separately as described in this policy. Browser controls or content blockers can limit client-side trackers; records created by server-side account, order, payment, and processing operations are not controlled by analytics settings.

Processing relies on performing the site agreement with you, consent where required (e.g., optional cookies or newsletters if introduced), legitimate interests for security and analytics balanced against your rights, and legal obligations where applicable.

Retention: account data while active and a reasonable period after deletion; payment records per tax and accounting rules; logs for a limited period sufficient for investigations and monitoring unless law requires otherwise.

We may use hosting, payment, email, and other processors who handle data on our instructions.

For cross-border transfers we follow applicable law (contracts, standard clauses, etc.).

Selling personal data as a product is not our goal.