Privacy Policy
StockImageIQ — METAMATIC MATIC ANDOLJŠEK s.p.
Last updated: 10 July 2026
This policy explains how we process personal data when you use StockImageIQ. The data controller is METAMATIC MATIC ANDOLJŠEK s.p., Grič V/9, 1310 Ribnica, Slovenia, email info@stockimageiq.com.
1. What we process
| Category | Examples | Source |
|---|---|---|
| Account data | email address, name (if provided), authentication identifiers | you / Google OAuth |
| Payment data | transaction ID, amount, country, VAT status — we never see or store card numbers | Paddle (Merchant of Record) |
| Your uploads | photographs and videos you upload, and the AI-generated metadata (titles, descriptions, keywords) | you / generated |
| Usage & technical data | credit balance and transaction ledger, processing logs, IP address, browser/device info | automatic |
| Support communications | emails you send us | you |
Uploaded photos and videos may incidentally contain personal data (e.g. identifiable people). We process such media solely to provide the service to you; obtaining any required consents or releases from depicted persons is your responsibility as the uploader (see Terms, Section 5.4).
Sign-in with Google: if you choose to sign in with Google, we receive your name, email address, and profile picture from your Google account. We use this information solely to authenticate you and create or access your StockImageIQ account. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
2. Why we process it (legal bases, GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Providing the Service (accounts, uploads, AI metadata generation, exports, credit accounting) | Contract performance (6(1)(b)) |
| Payment processing, invoicing, tax | Contract + legal obligation (6(1)(b), (c)) — largely performed by Paddle as Merchant of Record |
| Security, abuse prevention, service diagnostics and improvement | Legitimate interests (6(1)(f)) |
| Product emails / marketing (if any) | Consent (6(1)(a)) — withdrawable anytime |
| Statutory record-keeping (accounting) | Legal obligation (6(1)(c)) |
3. AI processing of your uploads
To generate metadata, your uploaded media (or extracted frames/previews) is transmitted to third-party AI providers — OpenAI, Google (Gemini), and Anthropic— strictly for the purpose of generating your metadata. Under these providers' API terms, content submitted via their APIs is not used to train their models; providers may retain API inputs briefly (typically up to ~30 days) for abuse monitoring, per their policies. We do not sell Your Content or use it to train models of our own.
4. Processors and sub-processors
| Provider | Role | Location/notes |
|---|---|---|
| Supabase | authentication, database, file storage | EU West (Ireland) |
| Railway | application hosting | EU West |
| Paddle | Merchant of Record — payments, tax, invoicing | UK/EU/US |
| OpenAI | AI metadata generation | US |
| Google (Gemini API) | AI metadata generation | US/EU |
| Anthropic | AI metadata generation | US |
| Brevo | transactional email delivery (password reset, account emails) | EU (France) |
| Vercel | frontend hosting / CDN | US/EU (Global Edge Network) |
5. International transfers
Where providers process data outside the EU/EEA (notably US-based AI providers), transfers rely on the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses, as applicable to each provider.
6. Retention
- Account data: for the life of the account and up to 30 days after deletion.
- Uploads and generated metadata: until you delete them or your account; residual copies in backups are purged within 30 days.
- CSV export copies: when you export CSV metadata, a copy of the exported file is stored so you can re-download it later, including after the source project is deleted. Export copies are retained until you delete them from your CSV History or delete your account.
- Credit/transaction ledger and invoices: retained per statutory accounting requirements (10 years in Slovenia); invoicing records are held by Paddle as Merchant of Record.
- Logs: typically 30–90 days.
7. Your rights
You may request access, rectification, erasure, restriction, portability, and object to legitimate-interest processing, and withdraw consent at any time — email info@stockimageiq.com. We respond within one month. You may lodge a complaint with your supervisory authority; in Slovenia this is the Information Commissioner (Informacijski pooblaščenec, www.ip-rs.si).
8. Security
Data is encrypted in transit (TLS); storage and database access are restricted and credential-protected; payment card data never touches our systems (handled by Paddle); internal access follows least-privilege. No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the risk.
9. Cookies
We use only cookies strictly necessary for authentication and session management. We do not currently use analytics or advertising cookies.
10. Children
The Service is not directed at children and may not be used by anyone under 18.
11. Changes
We will announce material changes to this policy in the app or by email. The "Last updated" date reflects the current version.
12. Contact
METAMATIC MATIC ANDOLJŠEK s.p. · Grič V/9, 1310 Ribnica, Slovenia · info@stockimageiq.com