Privacy Policy

1. Introduction

This Privacy Policy explains how Ndey Social, operated by Lanzu Krose (Leystraße 104/12, 1200 Vienna, Austria), collects, uses, and protects your personal data when you use our AI-powered image upscaling service at ndey-social.com (the "Service").

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data Controller

The data controller responsible for your personal data is:

3. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Name (if provided)
• Authentication tokens
• Account preferences

Payment Information

When you purchase credits, our payment processor Stripe collects:

• Payment card details (processed securely by Stripe)
• Billing name and address
• Transaction history

Important: We do not store complete credit card numbers or CVV codes on our servers. All payment data is handled directly by Stripe, a PCI-DSS Level 1 certified provider.

Image Data

When you use our upscaling service:

• Images you upload for processing
• Upscaled output images

Retention: All uploaded and processed images are automatically deleted from our servers within 24 hours of processing, unless you explicitly choose to save them to your account.

Usage Data

We automatically collect:

• IP address
• Browser type and version
• Device information
• Pages visited and features used
• Timestamps and session duration

4. Legal Bases for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Contract Performance: To provide the image upscaling service you requested and manage your account
• Legitimate Interests: To improve our Service, prevent fraud, ensure security, and communicate with you about your account
• Consent: For marketing communications (where applicable) and optional analytics cookies
• Legal Obligation: To comply with tax, accounting, and legal requirements

5. How We Use Your Data

We use your personal data to:

• Provide, maintain, and improve the image upscaling Service
• Process payments and manage your credit balance
• Send transactional emails (receipts, account notifications)
• Respond to support requests
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations
• Analyze usage patterns to improve our Service (aggregated, anonymized data)

6. Data Sharing and Disclosure

We do not sell your personal data. We share data only with:

Service Providers

• Stripe: Payment processing (subject to Stripe's Privacy Policy)
• Cloud Hosting: Infrastructure providers for data storage and processing
• Authentication: Identity verification services
• Analytics: Anonymized usage analytics (if cookies are accepted)

All service providers are bound by data processing agreements and must protect your data in accordance with GDPR requirements.

Legal Requirements

We may disclose data when required by law or to protect our rights, users, or the public.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, who will be bound by this Privacy Policy.

7. International Data Transfers

We are based in Austria (European Union). When we transfer data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions for countries with equivalent data protection
• Binding Corporate Rules where applicable

8. Data Retention

• Account Data: Retained while your account is active, plus any period required by law
• Image Data: Deleted within 24 hours of processing (unless saved by user)
• Payment Records: Retained for 7 years as required by Austrian tax law
• Usage Logs: Retained for up to 12 months for security and analytics

9. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time (where processing is based on consent)

To exercise these rights, contact us at privacy@ndey-social.com. We may need to verify your identity before processing requests. We will respond within 30 days.

You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde) or your local supervisory authority.

10. Cookies

We use cookies to:

• Essential Cookies: Required for authentication, security, and basic functionality
• Analytics Cookies: Help us understand how users interact with our Service (optional)

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect Service functionality.

11. Security

We implement industry-standard security measures including:

• TLS/SSL encryption for data in transit
• Encrypted storage for sensitive data
• Access controls and authentication
• Regular security reviews

While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

12. Children's Privacy

Our Service is not directed to children under 16. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal data, please contact us.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "Last updated" date at the top indicates when the policy was last revised.

Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

14. Contact Us

For privacy-related questions, data requests, or concerns: