Privacy Policy

1. Controller

Kay Maik Fotografie
Kay Maikowske
Tönisberger Str. 33, 47509 Rheurdt
E-Mail: info@kaymaikfotografie.de
Telefon: +49 176 42939687

2. Collected Data

When using NeuroShot, we collect the following data:

• Account Data: Email address, first and last name, company name (voluntary). We do not ask for a postal address at sign-up; you may add one voluntarily in your profile settings. Billing and payment details are collected by Stripe during checkout.
• Usage Data: Generated images, uploaded reference images (including photos of people and faces), prompts and studio settings. See section 4 for details.
• Technical Data: IP address, browser type and access times via the hosting provider. We also log technical errors in the application (error message, program flow, page visited, browser identifier and — for signed-in users — your user ID) in order to fix faults. The legal basis is our legitimate interest in a functioning service (Art. 6(1)(f) GDPR); these logs are deleted automatically after 30 days.
• Payment Data: Processed directly by Stripe, we do not store credit card data
• Communication & moderation data: The content of your support requests. To help us reproduce faults, we also transmit your browser identifier, operating system, screen resolution, language setting as well as your current plan and credit balance. Where illegal content is reported, we additionally process the report data including a copy (snapshot) of the reported content (Art. 6(1)(c) and (f) GDPR in conjunction with Art. 16/17 DSA).
• Community content: If you actively share an image to the community, the image, its prompt, title and description as well as the display name you choose become visible to every visitor of the community gallery — including visitors who are not signed in. Sharing is voluntary; the legal basis is your consent given by publishing (Art. 6(1)(a) GDPR). You can delete a post again at any time.

3. Purpose of Processing

• Provision and improvement of the service (Art. 6 Para. 1 lit. b GDPR)
• Account management and authentication
• Billing of credits and payments
• Technical security and fraud prevention
• Reporting and moderation of illegal content (Art. 6(1)(c) GDPR in conjunction with the DSA)

4. AI processing of the images you upload

The core of the service is generating new images from your source material. Because photos of people may be involved, we explain this step separately.

• What is processed: Your prompt and the uploaded images are transmitted to Google Vertex AI and processed there to generate the resulting image. The call is made exclusively via our server; your images are not used to train AI models. We store the resulting images so that you can access them in your gallery.
• Photos of people and faces: In the model studio you can upload a photo of a face or a person as a template. We process these images solely for visual composition — not in order to uniquely identify a person. In our assessment there is therefore no processing of biometric data within the meaning of Art. 9(1) in conjunction with Art. 4(14) GDPR; we use neither facial recognition nor biometric matching. The legal basis is performance of the user agreement (Art. 6(1)(b) GDPR).
• Photos of other people: If you upload a photo of another person, you are the controller for that processing under data protection law and must hold the required consent of the person depicted. In that respect we act as your processor; we provide a data processing agreement under Art. 28 GDPR on request. Images of identifiable people without their consent, and depictions of minors, are prohibited under our terms of use.
• No automated decision-making: There is no automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 13(2)(f), Art. 22 GDPR). The only automated step is the safety check of content, which may reject individual generations.
• Labelling: Every generated image carries a machine-readable marking in its metadata identifying it as AI-generated content (IPTC “DigitalSourceType: trainedAlgorithmicMedia”) in accordance with Art. 50(2) of the EU AI Act. You can check this marking yourself at any time at neuroshot.de/en/ai-image-check; the check runs in your browser and the image is not transmitted.

5. Third-party services & processors

We use the following services to provide our services:

• Supabase (EU): Database, Authentication – Server location: EU
• Cloudflare R2: Image storage (Cloudflare) – stored exclusively in EU data centers.
• Google Cloud / Vertex AI: AI image generation. Processing takes place in the EU region europe-west4 (Netherlands). Prompts and uploaded reference images are processed to generate the result; they are not used for training. Should we in future use models that are only available outside the EU, we will state this here and in the sub-processor overview in advance.
• Firebase Hosting: Web hosting – Google LLC, USA (third country; safeguarded by the EU-US Data Privacy Framework).
• Brevo (email delivery): Sending support, cancellation and system notifications via Brevo, an email delivery service based in France. Your email address, your name and the content of the respective message are transmitted. Processing takes place in EU data centres. Legal basis: performance of a contract, or a legal obligation in the case of cancellation confirmations (Art. 6(1)(b) and (c) GDPR).
• Stripe (payment processing): Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Your email address and user ID are transmitted; payment and billing data are collected by Stripe directly from you — we neither receive nor store full card details. Transfer to Stripe, Inc. (USA) is possible and is safeguarded by standard contractual clauses and the EU-US Data Privacy Framework. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Signing in with a Google account: If you choose “Sign in with Google”, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) provides the sign-in. Your IP address, browser identifier and the account data you release (email address, name) are transmitted to Google; we receive your email address and name from there in order to create your account. Processing in the USA is possible and is safeguarded by the EU-US Data Privacy Framework. Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR). This sign-in method is optional — registration with email and password is available on equal terms.

6. Storage, cookies & consent

We store technically necessary data on your device without consent (§ 25(2) no. 2 TDDDG). Everything beyond that — statistics and marketing — is only used after you have consented. You can withdraw that consent at any time via “Cookie settings” in the footer and in the profile menu; withdrawal takes effect for the future. We store your decision with a timestamp so that it can be evidenced, and ask again after twelve months at the latest. The following overview lists the entries used:

7. Google Analytics

This website uses Google Analytics, a web analysis service of Google Ireland Limited. The legal basis is your consent (Art. 6 Para. 1 lit. a GDPR).

• Data Transfer: Google also processes data for website usage in the USA.
• IP Anonymization: Your IP address is truncated by Google within the EU/EEA before transmission.
• Revocation: You can prevent collection by Google Analytics by disabling cookies in your browser or installing the browser add-on to disable Google Analytics.

8. Meta Pixel (Facebook)

This website uses the Meta Pixel, an analysis tool of Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland). The legal basis is your consent (Art. 6 Para. 1 lit. a GDPR).

• Purpose: Analysis of the effectiveness of advertising measures and optimization of the user experience.
• Collected Data: Page views, interactions (e.g., registrations, purchases), device information.
• Data Transfer: Data may also be processed in the USA. Meta has joined the EU-US Data Privacy Framework.
• Revocation: You can revoke your consent at any time via the cookie banner or your Facebook Ad Settings.

More information: Meta Privacy Policy

9. Retention period

In line with the principle of storage limitation (Art. 5(1)(e) GDPR), we store your data only as long as necessary. As long as you actively use your account, your data and generated images are retained. If an account remains inactive for 12 months (no login and no image generation; for customers with prior purchases: 24 months), we announce the deletion at least 30 days in advance by email and then irrevocably delete the account including all generated images, unless you become active again within this period. Active, ongoing subscriptions are exempt from automatic deletion. Before any deletion you can export your data (Art. 15/20 GDPR). Upon account deletion – whether by you or due to inactivity – all personal data including images is irrevocably removed. To prevent abuse (e.g. repeatedly claiming free starter credits), afterwards we retain only a non-reversible cryptographic hash of your email address; your plaintext data cannot be reconstructed from it (Art. 6(1)(f) GDPR, legitimate interest in fraud prevention).

Reports of illegal content, including the content snapshot, are retained for three years after the case is closed. This is necessary in order to evidence our moderation decisions towards reporters, affected users and authorities (Art. 6(1)(c) and (f) GDPR in conjunction with Art. 16, 17 DSA); they are deleted automatically thereafter.

10. Minors

Our service is intended exclusively for adults. When registering you confirm that you are at least 18 years old. We do not knowingly collect data from children or adolescents. If we learn that an account has been created by a minor contrary to our terms of use, we will delete it and the associated data without delay. Please contact us at the address below in such a case.

11. Your rights (GDPR)

You have the following rights:

• Access (Art. 15): What data we store about you
• Rectification (Art. 16): Correction of incorrect data
• Deletion (Art. 17): Complete account deletion via profile settings
• Restriction (Art. 18): Restriction of processing
• Data Portability (Art. 20): Export of your data
• Objection (Art. 21): Objection to specific processing
• Complaint: With the competent supervisory authority – for us: State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.
• Withdrawal of consent (Art. 7(3)): Where you have consented to processing — for example to statistics or marketing cookies — you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out until then remains unaffected.
• Whether provision is required (Art. 13(2)(e)): We need your email address, name and password to conclude and perform the user agreement; without them we cannot provide an account. All other details — such as company name and address — are voluntary, and not providing them puts you at no disadvantage.

12. Contact for data protection enquiries

Kay Maikowske
E-Mail: info@kaymaikfotografie.de

We are not legally required to appoint a data protection officer and have not done so. Please address data protection enquiries directly to the controller named above.