Last updated: 30 May 2026
This Privacy Policy explains how the personal data of users of the PhotoID24 service (the "Service") โ an online service for preparing photos for documents for any country โ is processed. We process data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable data protection law.
1. Data controller
The data controller is FOP Shelekhan O.N. (RNOKPP / individual tax number 2853810181), address: Ukraine, Kharkiv, vul. Berestova 11, apt. 1, the operator of the PhotoID24 service. For any data protection matters you can contact us at [email protected].
Because the Service is offered to individuals located in the European Union, the processing falls within the scope of the GDPR pursuant to Art. 3(2) of the Regulation, as well as other applicable data protection legislation.
2. What data we process and for what purpose
2.1. The photo uploaded for processing
The uploaded image is processed solely for the purpose of providing the service. We analyse the photo for compliance with technical requirements (face detection for cropping, image quality, background uniformity) and generate an output file in the required format.
We do not create biometric templates intended for the unique identification of a person within the meaning of Art. 4(14) and Art. 9 GDPR. Automatic face detection is used only for cropping and compliance checking, not to establish or confirm identity. Photos are not used to train artificial intelligence models or for any purpose other than providing the ordered service.
For technical processing, the image is transferred to third-party processors โ cloud artificial intelligence providers (see section 5) โ only to the extent necessary to provide the service.
The original uploaded photo is deleted immediately after the image has been processed. If processing ends with an error, the original is kept for no longer than 24 hours and is then automatically deleted. The watermarked image (preview) is kept for up to 24 hours.
2.2. The finished result
The processed result file is made available to you via a link after payment. After the first download the file is deleted (only a short technical window remains in case of a repeated download). In any case, the file is automatically deleted no later than 72 hours after payment.
2.3. Email address
Provided voluntarily โ to send the download link for the result and service notifications about the order.
2.4. Technical data
IP address, browser type, language, request timestamp and order identifier. Used to keep the Service running, prevent abuse (rate limiting) and diagnose problems.
2.5. Transaction data
Order identifier, amount, payment status. We do not store payment card numbers โ all payment details are processed by the payment provider.
2.6. Name (optional)
If you choose a plan that includes a personal guide, you may additionally provide a name โ solely to personalise the wording in the guide. The field is optional: without it, the guide is provided in a neutral form. The name is stored together with the order data and is deleted upon your deletion request. Your progress through the guide steps (checklist marks) is stored only locally in your browser and is not transmitted to our servers.
3. Legal bases for processing
Art. 6(1)(b) GDPR โ performance of a contract: processing the photo, taking payment, sending the result file;
Art. 6(1)(a) GDPR โ consent: by uploading a photo you give explicit consent to its processing for the provision of the service (confirmed by a separate checkbox before upload); consent can be withdrawn at any time;
Art. 6(1)(c) GDPR โ compliance with a legal obligation, in particular accounting and tax obligations;
Art. 6(1)(f) GDPR โ the controller's legitimate interest: security of the Service and protection against abuse (technical logs, rate limiting), as well as the establishment, exercise or defence of legal claims.
4. Data retention periods
Original photo โ deleted immediately after processing (in case of a processing error โ no later than 24 hours);
Preview (watermarked) โ up to 24 hours;
Finished result file โ deleted after the first download; in any case no later than 72 hours after payment;
Technical processing record (anonymised) โ up to 30 days;
Transaction data for accounting (identifier, amount, date) โ for the period required by applicable tax and accounting legislation;
Name (if provided) โ stored together with the order record and deleted upon your data deletion request;
Technical logs โ up to 30 days.
5. Data recipients
Data may be transferred to the processors listed below (Art. 28 GDPR) only to the extent necessary to provide the service:
cloud image-processing provider โ a third-party cloud artificial intelligence service: automatic processing of the uploaded photo. Processing may take place on servers outside the EU (see section 6);
Payment provider โ processing of payments;
Hosting provider โ storage of data and files.
6. Transfers to third countries
Some processors (in particular the cloud image-processing provider) may process data outside the European Economic Area. In such cases, the transfer is carried out on the basis of appropriate safeguards provided for in Chapter V of the GDPR โ in particular the Standard Contractual Clauses (SCC) approved by the European Commission.
7. Your rights
Under the GDPR you have the right to:
access your data (Art. 15 GDPR);
rectification of data (Art. 16 GDPR);
erasure of data (Art. 17 GDPR);
restriction of processing (Art. 18 GDPR);
data portability (Art. 20 GDPR);
object to processing (Art. 21 GDPR);
withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal (Art. 7 GDPR).
To exercise these rights, contact [email protected] โ we will respond within 30 days. A data deletion request can also be submitted via the data deletion form.
You also have the right to lodge a complaint with a supervisory authority โ in particular with the data protection authority in your country of residence in the EU.
8. Cookies and local storage
The site uses only necessary cookies and local storage (localStorage) data โ to remember the selected interface language and the current order identifier. We do not use cookies for marketing or analytics purposes without your consent.
9. Automated processing and profiling
The photo is processed automatically (artificial intelligence algorithms check compliance with the requirements and generate the result). This is not a decision producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22 GDPR โ the result of processing is only an image file provided to you. We do not carry out profiling.
10. Security
We take appropriate technical and organisational measures to protect data: transmission over a secure connection (HTTPS), removal of EXIF metadata from uploaded images, data minimisation and automatic deletion of files in accordance with the periods specified in section 4.
11. Changes to this Privacy Policy
We reserve the right to amend this Policy. The current version is always available at this address; the date of the last update is shown at the top of the page.