Privacy Policy (GDPR)#

Last updated: 1 October 2026

Controller (for website/account/billing): withoutBG API – Einzelunternehmen (Inhaber: Imran Kocabiyik), Dudenstr. 24, 10965 Berlin,

Contact email address

Processor vs. Controller

  • For image data you send for background removal through the API or the web app, we act as your processor.
  • For account, website analytics, fraud/security, email delivery, and billing, we are the controller.

1. What we collect & why#

A) Website & Account (Controller)#

  • Email address (magic-link login, third-party sign-in via Google/GitHub, & transactional email): to create/manage your account and communicate about the Service. Email is sent via AWS Simple Email Service (SES) operated in our own AWS account (no separate email vendor). Legal basis: Contract (Art. 6(1)(b) GDPR).
  • Third-party sign-in (Google, GitHub): If you choose to sign in with Google or GitHub, the provider sends us your verified email address and an opaque user identifier (the OAuth subject ID, e.g. Google's sub or GitHub's user ID). We use the email as the account identifier and store the subject ID alongside your account record so we can recognise you on future logins. We request only the minimum scopes needed for sign-in: openid email profile (Google) and read:user user:email (GitHub). The profile scope is requested by Google for consent screen display only; we do not store your name or profile picture. We do not store OAuth access tokens or refresh tokens after the sign-in flow completes, and we do not access any other resource on your Google or GitHub account (no repositories, contacts, calendars, etc.). Short-lived OAuth state tokens (random value, no personal data, 10-minute TTL) are stored temporarily to prevent CSRF and are deleted automatically. If a user with the same verified email already exists, the provider is linked to that account rather than creating a duplicate. Legal basis: Contract (Art. 6(1)(b) GDPR). Google and GitHub act as independent controllers for the data they process about you in connection with the sign-in flow; see their respective privacy policies linked in Section 3.
  • Analytics (Ahrefs Web Analytics): We use Ahrefs Web Analytics to measure site usage. It runs without cookies or persistent identifiers and does not store IP addresses. Unique visitor counts are derived via a daily salted hash of IP address and user agent; salts are rotated every 24 hours, preventing cross-day or cross-site tracking. Location is limited to city/country. Controller: us; Processor: Ahrefs.
    Legal basis: Legitimate interests (Art. 6(1)(f)) in understanding and improving service usage.
    Right to object (Art. 21): If you object to analytics, we will stop collecting analytics for your visits. How to opt out: add the ?no-analytics=1 URL parameter to our pages (we’ll honor it for that visit), or email us and we’ll exclude your visits going forward.
  • Email measurement: We keep a log of the emails we send you (which email, when, and whether it was delivered or bounced). Links in our emails carry a random message ID. If you start a checkout from such a link, we store that ID with the purchase; if you unsubscribe from an email, we note which email it was. We use this only to learn which emails are useful and to stop sending ones that are not. We do not use tracking pixels or open tracking, links point directly to our site (no redirect service), and nothing is stored on your device: the ID is dropped when you reload the page. Legal basis: Legitimate interests (Art. 6(1)(f)) in sending relevant, non-excessive email. Right to object (Art. 21): email us and we will stop linking your purchases to emails. Retention: 400 days.
  • Signup source: when you create an account, we store where you came from with your account record: the ref or utm_source value of the link you followed, or the referring website's host name (otherwise “direct”). Until signup it is kept only in your browser's session storage (see Section 9). We use it to attribute affiliate referrals and to understand which channels bring customers. Legal basis: Contract (Art. 6(1)(b)) for affiliate payouts and Legitimate interests (Art. 6(1)(f)) otherwise. Right to object (Art. 21): email us and we will remove it. Retention: until you delete your account.
  • Website demo quota: anonymous visitors can try the demos a few times a day. To enforce that limit, we store a keyed hash (HMAC) of your IP address together with a daily counter; we never store the IP address itself in this record. Signed-in users pay with credits instead and are not counted. Legal basis: Legitimate interests (Art. 6(1)(f)) in preventing abuse of free GPU processing. Right to object (Art. 21): you can sign in instead; we will otherwise assess whether we have compelling legitimate grounds. Retention: deleted automatically about 1 day after the day it counts.
  • Security/Fraud logs: IPs, timestamps, auth and abuse signals. Legal basis: Legitimate interests (security, abuse prevention). Right to object (Art. 21): If you object to security/fraud logs, we will assess whether we have compelling legitimate grounds that override your interests. Retention: 90 days (or the shortest period operationally feasible) unless needed longer to investigate incidents or comply with law.

B) Payments (Stripe)#

Automated decisions & profiling (payments). We use Stripe to process payments. Stripe acts as an independent controller and may use automated decision-making and profiling (e.g., fraud screening via Stripe Radar, 3-D Secure risk evaluation) to prevent fraud and comply with payment regulations. This may affect whether a payment is approved or requires additional verification. Under GDPR Art. 22, you have the right to obtain human review, to express your point of view, and to contest the decision. For details on Stripe’s processing and how to exercise your rights with Stripe, see Stripe’s Privacy Policy and Stripe’s Privacy Center.

We do not use automated decision-making producing legal or similarly significant effects outside Stripe’s payment screening.

We use Stripe to process payments. Stripe is a separate, specialized payment service provider. For most payment processing, Stripe acts as an independent controller of personal data needed to provide its services (e.g., fraud prevention, compliance with financial regulations). We remain the controller for our own records and billing.

What data is processed

  • You provide directly to Stripe in checkout: card details (PAN, CVC) or alternative method details (e.g., SEPA IBAN, Apple Pay/Google Pay payment tokens), cardholder name, billing address, and device/fraud signals (e.g., 3-D Secure/SCA). We do not receive or store full card or bank details.
  • We receive from Stripe (via API/webhooks) and store in our billing records: your Stripe customer ID, payment method type, last 4 digits, card brand, expiration month/year, billing name, billing address (where provided), payment intent IDs, charge IDs, invoice and subscription metadata, payment status (success/failure), refunds, and dispute/chargeback events (including the fact of a dispute and our submitted evidence).
  • Tax data: where applicable, country, VAT ID/company details you provide for invoicing; tax rate and jurisdiction applied.

Purposes & legal bases

  • To take and manage payments, subscriptions, refunds, and credits — Contract (Art. 6(1)(b)).
  • Accounting, bookkeeping, and tax compliance — Legal obligation.
  • Fraud prevention, security, and dispute handling — Legitimate interests and, for Stripe, its own legal obligations as a regulated payment institution.
  • Storing a payment method for future renewals (via Stripe vaulting, e.g., cards, SEPA mandates): Contract and our legitimate interests in providing a seamless subscription experience. You can delete stored payment methods in your dashboard or by contacting us.

Who sees what

  • We can see the limited billing details listed above (never full card or bank numbers).
  • Stripe receives/creates additional data needed to operate a secure payments network (e.g., fraud signals, bank identifiers) and uses it under its own privacy notice and regulatory obligations.
  • For SCA/3-D Secure, your bank/issuer may receive authentication data.

Security & compliance

  • Card and bank details are entered on Stripe’s infrastructure and are never sent to or stored on our servers.
  • Stripe is certified to PCI DSS. We use Stripe features such as Tokenization, 3-D Secure (SCA/PSD2), and Radar fraud screening.
  • Our systems store only tokenized identifiers (e.g., Stripe customer, payment method, and charge IDs) and limited card metadata (brand, last 4, expiry) for receipts, refunds, dispute handling, and subscription renewals.

Retention

  • Invoices, payments, and related billing records: retained for 10 years under German tax law.
  • Dispute/chargeback records: retained as long as needed to resolve the dispute and comply with regulatory/financial recordkeeping.
  • Stored payment methods (at Stripe): retained until you remove them, your subscription ends and settlement completes, or we instruct Stripe to delete them.

International transfers

Stripe may process data in the EEA, UK, and the US (and other locations where necessary to provide payment services). Where data is transferred outside the EEA/UK, Stripe applies an adequacy decision (where available) or Standard Contractual Clauses (SCCs)/UK IDTA, plus supplementary safeguards. We also rely on SCCs in our contract with Stripe.

Your choices

  • You can update or remove a stored payment method in the dashboard, switch payment method, or ask us to initiate deletion.
  • If you object to Stripe’s processing as an independent controller, please contact Stripe directly in addition to contacting us; we’ll still help facilitate requests that relate to the data we control.

C) Image Processing: API and Web App (Processor)#

Image processing & temporary storage nuance

How image data is handled. Processing is designed to be in-memory only. We disable application-level disk writes in the image processing path; container filesystems are read-only, swap is disabled, and temporary working directories use memory-backed storage. Where the cloud platform may create ephemeral storage or network-level buffers outside our direct control, we configure them to auto-purge and we do not persist your content beyond completion of the request. We do not write input images or results to long-term storage unless you explicitly ask us to.

Verification. We enforce these controls via automated tests in CI, periodic runtime checks (verifying no file I/O in the processing path), infrastructure policies (read-only root, no swap), and log sampling to confirm no object-store writes for processing requests. We review these controls at least quarterly and after material infrastructure changes.

  • Images you submit are processed in RAM only and discarded immediately after inference.
  • Web app (withoutbg.com/app): your browser sends only a reduced copy of each image (at most 1024 px on the long side), which is processed in the same RAM-only way and discarded after inference. The full-resolution result is created in your browser and kept only in your browser's local storage on your device for up to 7 days (you can clear it at any time); we never receive or store it. The original image is not saved anywhere.
  • API logs (non-content): timestamp, file size, inference time, status codes, error logs—for operations, abuse detection, and reliability. Legal basis (controller for logs): Legitimate interests. Right to object (Art. 21): If you object to API logs, we will assess whether we have compelling legitimate grounds that override your interests.

We do not#

  • Store passwords (magic-link or third-party sign-in only).
  • Store OAuth access tokens or refresh tokens after the sign-in flow completes.
  • Read or write any Google or GitHub resource on your behalf (no repositories, emails, contacts, calendars, etc.) beyond the basic identity needed to sign you in.
  • Use your images or results to train, fine-tune, validate, or evaluate models, or to build datasets. There is no opt-in for this.
  • Use marketing pixels or re-identification cookies.
  • Store full card or bank details on our systems.

2. Retention#

Minimal retention for abuse-prevention#

After account deletion, we retain a salted SHA-256 hash of your account email and API key identifier solely to prevent fraud/abuse and honor suppressions. These hashes are non-reversible, not used for profiling or marketing, and are retained for up to 12 months before automatic deletion.

  • Account email: retained until you delete your account.
  • OAuth subject identifier (Google/GitHub link): retained alongside your account record until you delete your account or unlink the provider.
  • OAuth state tokens (CSRF protection): 10 minutes TTL, then auto-deleted; contain no personal data.
  • Invoices & tax records: 10 years (German law).
  • API logs: 90 days.
  • Email log (sent emails, delivery, purchases and unsubscribes linked to them): 400 days.
  • Website demo quota (HMAC of IP + daily counter): about 1 day after the day it counts.
  • Signup source: until you delete your account.
  • Web app results: never on our systems; kept only in your browser for up to 7 days (see Section 9).
  • Website security/fraud logs: 90 days (or the shortest period operationally feasible) unless needed longer to investigate incidents or comply with law.
  • After account deletion: we delete all account data (including any OAuth subject identifier) except (i) invoices (legal retention), (ii) a hash of your email to prevent abuse of free credits, and (iii) your API key identifier for audit/abuse prevention.

3. Subprocessors & Recipients#

  • Stripe (payments; acts as an independent controller for much of payment processing and as our processor where it follows our documented instructions—e.g., invoicing and payment collection).
  • Ahrefs Web Analytics (privacy-friendly website analytics).
  • Amazon Web Services (AWS) – Frankfurt (eu-central-1) (infrastructure, including AWS Simple Email Service (SES) for transactional email operated in our AWS account).
  • Google LLC – identity provider for “Continue with Google”. If you choose this sign-in method, Google receives your sign-in request and returns your verified email address and an opaque subject identifier to us. Google acts as an independent controller for the data it processes about you. See Google's Privacy Policy.
  • GitHub, Inc. (a Microsoft subsidiary) – identity provider for “Continue with GitHub”. If you choose this sign-in method, GitHub receives your sign-in request and returns your primary verified email address and an opaque user identifier to us. GitHub acts as an independent controller for the data it processes about you. See GitHub's Privacy Statement.

We do not share data with advertisers and do not sell personal data.

4. International Transfers#

Our servers run in AWS Frankfurt (eu-central-1). If a subprocessor or recipient transfers data outside the EEA/UK, they must use an adequate mechanism (e.g., SCCs/UK IDTA or an adequacy decision) and implement appropriate safeguards. Where you choose to sign in with Google or GitHub, those providers may process your sign-in data outside the EEA/UK (including in the United States) under their own SCCs and supplementary safeguards described in their respective privacy notices.

5. Security#

TLS in transit; processing in memory; no persistent storage of images; web app results are stored only on your own device; role-based access; monitoring and protective rate limiting. No caching, queueing, or backups for image content. Payment data security relies on Stripe’s PCI-DSS-certified infrastructure; our systems never handle raw card or bank details.

6. Your Rights (GDPR)#

You can access, rectify, erase, restrict, port, or object to processing where applicable. You may withdraw consent (if we ever rely on it) at any time.

Where we rely on legitimate interests, you may object at any time (Art. 21). If you object to analytics, we will stop collecting analytics for your visits (see Analytics for opt-out methods). If you object to security/fraud or API logs, we will assess whether we have compelling legitimate grounds that override your interests.

We respond to rights requests within one month (extendable by two months for complexity). You may lodge a complaint with the Berliner Beauftragte für Datenschutz und Informationsfreiheit (contact details on their official site).

For payment data that Stripe controls, you may also contact Stripe to exercise your rights.

Contact us:Contact email address

7. Children#

Not directed to children; we do not knowingly process data of individuals under 16.

8. Communications#

We email you about security, service and billing (for example low or expiring credits, a failing integration or a failed payment), and about changes to terms (effective after 30 days). These emails are part of the service. Offers and tips are sent only if you opted in, or, if you have bought from us, about our own similar services. Product updates (API updates and/or open-weights model updates, you choose) are sent only if you opted in: at signup, in your account settings, or on our product updates page. You do not need an account for product updates; without one, you confirm your address with a link we email you (valid 48 hours), and nothing is stored until you click it. For each opt-in we keep your email address, the topics, when and where you opted in, and when you opted out. Legal basis: Consent (Art. 6(1)(a) GDPR). You can opt out of any of these emails at any time in your account settings or with the unsubscribe link in each of them, and an opt-out applies even if you are a customer. If you delete your account, your product update opt-in is deleted with it; without an account, email us to have it deleted.

9. Cookies & Browser Storage#

We set no cookies and use privacy-friendly, cookie-less analytics. If you use Stripe Checkout or embedded Stripe components, Stripe may set cookies or similar technologies on its domains for security and fraud prevention; these are strictly necessary for payment functionality and do not require consent under ePrivacy where they are essential. If this changes, we will show a consent banner.

Our website stores the following in your browser's local storage, session storage, or IndexedDB (§ 25(2) no. 2 TDDDG). None of it is used for advertising or tracking across sites, and apart from the signup source (sent once when you create an account, see Section 1A), none of it is sent to us. You can delete it at any time in your browser settings.

  • auth-storage (local storage): your sign-in session, until you log out. Needed to keep you signed in.
  • wbg-return-to (local storage): the page to return to after logging in, for up to 1 hour.
  • referrer_source (session storage): where you came from, until you close the tab; sent with your signup (see Signup source).
  • pro-demo-quota, car-demo-quota (local storage): how many free demo uses you have left today, so the page can show it.
  • car-playground-options (local storage): the options you chose in the car playground.
  • app-export-settings (local storage): your web app background and format choice.
  • withoutbg-app (IndexedDB): your web app results (full-resolution cutouts and thumbnails, never the original images), so you can download them again. Kept for up to 7 days, removed earlier with Clear all in the web app; never sent to us.

Analytics opt-out reminder: add ?no-analytics=1 to our URLs, or email us to exclude your visits.

10. Deletion & Data Management#

Self-serve deletion in the dashboard or emailContact email address

On deletion we remove your account data per Section 2 above; billing records are retained as required by law.

11. Contact & DPO#

We do not meet the thresholds for appointing a DPO. For privacy questions, contact:Contact email address

12. Changes to this Policy#

We may update this policy; we will post the new version here and, for material changes, email you in advance.

Data Processing Agreement (DPA) summary for image processing via API and web app (Processor role)#

  • Role: You = Controller; withoutBG = Processor.
  • Subject matter: transient processing of images to remove background, through the API or the web app.
  • Duration: for the duration of each request; logs retained 90 days. Web app results are created and stored on your device, outside our processing.
  • Nature/Purpose: automated processing in memory; output returned to you.
  • Types of data: images and derived non-content logs.
  • Data subjects: individuals depicted in images (if any).
  • Security: TLS, in-memory processing, no persistent storage, access controls.
  • Subprocessors: AWS Frankfurt (including SES for email, operated in our account).
  • Instructions: Only process per your API calls or web app requests; never used for training.
  • Deletion: images discarded after inference; logs per retention.

Payments addendum (Stripe)#

  • Parties & roles: withoutBG (merchant), Stripe (payment service provider). Stripe is generally an independent controller for payment processing, fraud prevention, and compliance; it may act as our processor where it processes data strictly on our documented instructions (e.g., issuing invoices).
  • Standards & safeguards: PCI DSS, tokenization, SCA/3-D Secure, Radar.
  • Data minimization: we store only tokenized IDs and limited card metadata; never full PAN/CVC/IBAN.
  • Transfers: SCCs/UK IDTA and supplementary measures where required.
  • Data subject rights: contact us and/or Stripe for rights requests relating to the respective controller.
  • Removal of stored methods: you can remove saved methods at any time; removal does not affect data retained for legal obligations (e.g., invoices).