Privacy Policy

This Privacy Policy explains how Stories Restored ("we," "us," or "our") collects, uses, and shares information when you use our AI-powered photo restoration service. By using the service, you agree to the practices described here.

1. Information We Collect

• Email address — provided when you place an order or contact us, used to deliver results and support.
• Uploaded photos and documents — the images you submit for restoration.
• Payment information — processed by our payment provider, Lemon Squeezy. We receive your billing email and order metadata, but we do not store full card numbers.
• Job metadata — order IDs, timestamps, processing status, credits consumed, and technical logs needed to operate the service.
• Device and usage data — limited analytics such as IP address, browser type, and pages visited, used to improve the service and prevent abuse.

2. How We Use Your Information

• To process and restore the photos you upload.
• To deliver your results and send transactional emails.
• To process payments and manage credits.
• To respond to support requests and honor refund or reprocessing claims.
• To detect, prevent, and investigate fraud, abuse, or illegal activity.
• To comply with legal obligations.

3. Data Retention

• Uploaded and restored photos: retained for 30 days after your order completes, then permanently deleted from our storage.
• Email address and account data: retained for the lifetime of your account and for a reasonable period after closure to satisfy legal, accounting, and fraud-prevention obligations.
• Billing records: retained by Lemon Squeezy according to their policies and applicable tax law.

4. Third-Party Service Providers

We share limited data with trusted sub-processors that help us operate the service:

• Google (Gemini API) and Open AI (Open AI API) — AI image restoration. Uploaded photos are sent to Google or Open AI for processing.
• Amazon S3 — storage and delivery of originals and restored outputs.
• Supabase — database hosting for account, order, and job metadata.
• Lemon Squeezy — our Merchant of Record for payments, tax, and invoicing.
• Inngest — durable workflow execution for bulk processing jobs.
• Vercel — web hosting and serverless functions.

These providers are bound by contractual obligations to protect your data and may only use it on our instructions.

5. Your Rights (GDPR & CCPA)

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Request correction or deletion of that data.
• Request a portable copy of your data.
• Opt out of certain processing, including the "sale" or "sharing" of personal information (we do not sell your data).
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email hello@storiesrestored.com. We will respond within the timelines required by applicable law.

6. Children's Privacy

Stories Restored is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13 (COPPA). If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

7. Security

We use industry-standard safeguards — encrypted transport (TLS), access controls, and reputable sub-processors — to protect your data. No system is perfectly secure; we cannot guarantee absolute security.

8. Changes to This Policy

We may update this policy from time to time. Material changes will be posted here with a revised "Last updated" date.

9. Contact

Questions about this policy or your data? Email hello@storiesrestored.com.