رازداری کی پالیسی

Last updated: 8 November 2026

This policy explains how MAD PROTOCOL LTD (“we”) handles personal data when you use Pickframe, the image studio at this website. We are the controller of that data under the UK GDPR, the EU GDPR where it applies, and the Data Protection Act 2018.

What we collect

• Account details: your email address and sign-in information (a password stored only as a secure hash by our authentication provider, or your Google sign-in, through which Google shares your name, email address and profile picture with us), and the settings of your account.
• Trials without an account: if you try a comparison before signing up, we create an anonymous account with no email address to hold it. If you then create an account, the trial becomes that account and keeps what you made.
• What you create: the briefs (prompts) you write, images and logos you upload, the images models generate for you, your projects, edits and saved recipes.
• Credits and payments: your credit balance and its history, the plans and packs you buy, and payment records such as amounts, tax and Stripe references. Card details go straight to Stripe; we never see or store them.
• Messages: feedback you send from the studio and emails you send us.
• Video waitlist: if you join it on the video page, the email address you enter and the language you were using. You do not need an account to join. We email you a link to confirm the address is yours, and it is on the list only once you do.
• Technical data: counts of requests and errors, and error reports from the server and your browser. Error reports contain the page and the technical error; we remove email addresses, links and identifiers before storing them. Our hosting keeps short-lived server logs.
• Steps you have used: our own record that your account has reached a step only your browser sees, such as downloading an image, kept at most once a day for each step. It holds the step and the day, never the image, its name or what it shows.
• How you found us: when you create an account, the website or campaign link that brought you to Pickframe (the site’s name only, never the page address) and the first Pickframe page you saw. Your browser holds this in memory until you sign up; nothing is stored on your device.
• Visit counts: Cloudflare Web Analytics counts page views, the sites visitors come from, countries, devices and page speed for us. It uses no cookies or storage on your device, does not fingerprint you or follow you across other websites, and shows us totals only.
• Steps to an account: we count, for each day, how many visits see the homepage, follow a link into the studio, see the sign-up form and send it. Your browser sends only the step reached; we keep only each day’s totals, and nothing is stored on your device.
• Shared links and votes: when you share images for votes, anyone with the link can see them, and the model names if you choose to show them. When you vote on someone’s link we keep your vote and, if you add them, your name and comment; only the person who shared the link sees names and comments. We do not need an account or email address to vote.

We do not use advertising tools or trackers, and we do not sell or share your personal data for advertising.

Why we use it and our legal bases

• To provide Pickframe: your account, generating and storing images, credits and plans, and the links you share for votes (performance of our contract with you).
• To record votes and comments on a shared link and pass them to the person who shared it (our legitimate interests in running the voting you take part in).
• To take payments, keep accounting and tax records and handle refunds and disputes (contract and legal obligation).
• To keep Pickframe secure and working: preventing abuse and fraud, rate limits, fixing errors and answering your messages (our legitimate interests in running a safe, reliable service).
• To see how people find Pickframe, how far new accounts get and where people get stuck, by counting visits, where sign-ups came from and the steps above together with the comparisons and payments we already keep (our legitimate interests in improving Pickframe). We look at totals, not at what you make.
• To send service emails such as sign-in links, password resets and receipts (contract). We only send marketing if you have agreed to it, and you can opt out at any time.
• To email you once when video comparison opens, if you joined the video waitlist (your consent). You can withdraw it at any time by asking us to remove your address.

We do not use your briefs or images to train AI models. The model providers below receive them only to generate your results, under their own terms for API customers.

Who processes your data

We use these service providers, under contracts that require them to protect your data and use it only on our instructions (or, for Stripe and Link acting as merchant of record, as an independent controller):

• Supabase: sign-in, our database and private image storage.
• fal.ai and the developers of the image models and tools you choose (shown in the studio): they receive your brief or edit instruction, and any of your images you choose to edit or use as a reference, to generate results, and hold results briefly until we copy them to our private storage.
• OpenRouter and Google (Gemini), reached through fal.ai: when you ask the studio to check your images, they read each finished image to say what it shows of your brief and, when your brief puts words in quotation marks, whether those words are spelled as you wrote them. They receive a reduced copy of the image and your brief with its quoted words left out; the words themselves are compared on our servers. You can turn the checks off for any run.
• Stripe: payments, subscriptions, invoices and fraud prevention. Purchases are sold through Link, operated by Stripe, as merchant of record: Stripe receives your billing details, handles sales tax and may contact you about your purchase.
• Cloudflare: delivering the website securely, protecting it from attacks and counting visits (Web Analytics). When you create an account, start a trial without one, sign in with a password or ask for a recovery email, Cloudflare Turnstile checks that a person rather than an automated script is sending the form. It reads technical signals from your browser to do so, and is not used for advertising.
• DigitalOcean: hosting the application.
• Resend: delivering sign-in and account emails, and video waitlist confirmations.

Pickframe is run from the United Kingdom and used around the world, so your data is processed in the UK and by providers in the United States and other countries. Transfers from the European Economic Area to the UK rely on the EU’s adequacy decision for the UK. Transfers to other countries rely on adequacy regulations (including the UK–US data bridge and the EU–US Data Privacy Framework for certified providers) or on safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. You can ask us for a copy of these safeguards by emailing [email protected]. We may also disclose data where the law requires it, or to protect people from harm.

How long we keep it

• Account details, briefs, images and projects: while your account exists. Images you delete are removed from storage straight away.
• A trial that never becomes an account: its brief and images are kept in the same way. Write to us and we delete them.
• Payment, credit and tax records: six years after the end of the financial year they relate to, as UK tax law requires, even if you close your account.
• Error reports: up to 90 days after they last occurred.
• Steps you have used, and how you found us: while your account exists; they are deleted when you close it.
• Shared links, and the votes, names and comments on them: until the person who shared the link stops sharing it or closes their account.
• Feedback and emails: up to two years.
• Video waitlist: until we send the launch email, then deleted, or sooner if you ask us to remove it. An address that is not confirmed within 7 days is deleted.

Cookies and storage on your device

We only use cookies that Pickframe needs to work, so we do not ask for cookie consent: sign-in cookies that keep you signed in securely, a cookie that remembers the language you choose, and, when you vote on a shared link, a cookie that remembers your vote so you vote only once and can change it. Your browser also keeps drafts, recent results and editing history on your device so the studio stays fast; you can clear them in your browser settings. Signing out clears cached pages from your browser. Visit counting and how you found us use no cookies or storage on your device.

Your rights

Wherever you live, you can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format, and you can withdraw any consent you have given. To close your account and delete your data, email [email protected] from the address you sign in with. We reply within one month (or sooner where your local law requires) and may need to confirm it is you. We keep only what the law requires, such as payment records. We will not treat you differently for using these rights.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or the data protection authority where you live or work.

United States

If you live in a US state with a consumer privacy law, such as California, you have the rights above to know, access, correct and delete your personal information. We do not sell your personal information or share it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. You or an authorised agent can make a request by emailing [email protected]; if we decline it, you can appeal by replying to our answer.

Security

Images are stored privately and only served to your account; data is encrypted in transit; access to our systems is limited and protected by two-step verification. No service is perfectly secure: if a breach affects your data we will tell you and the regulator as the law requires.

Children

Pickframe is for adults. You must be 18 or older to create an account, and we do not knowingly collect data from children. If you believe a child has given us personal data, email [email protected] and we will delete it.

Changes to this policy

We will update this page when our practices change, and tell you by email or in the studio before a significant change takes effect.

Contact

Pickframe is a trading name of MAD PROTOCOL LTD, a company registered in England and Wales, company number 11232367. Registered office: Apollo House, Hallam Way, Whitehills Business Park, Blackpool, England, FY4 5FS. VAT number: GB289854724.
Email: [email protected]