Privacy & Cookies
Last updated: 31 October 2026
In short: the photos you work on never reach us — they stay in your browser. We collect only what we need to run your account: your email address and your subscription status. Payments are handled by Stripe's Link as merchant of record, so we never see your card details. We use no advertising or tracking cookies; visits are counted by a cookie-free analytics service.
1. Who is responsible for your data
The data controller is APEX VISION SRL, a company registered in Romania, Trade Register no. J202518587002, tax identification code (CUI) 51454508, with its registered office at Str. Mihai Eminescu nr. 77, Zalău, Romania. Contact: contact@shapesshifter.com.
2. Your photos
When you load a photo into ShapesShifter, it is processed entirely inside your browser on your own device. It is not uploaded to our servers, we cannot see it, and we do not store it. The image you export is saved directly to your device. If you then upload that image to a third-party generator, that company processes it under its own privacy policy.
3. What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address and password (stored only as a secure hash) | Creating and securing your account, signing in, service emails (e.g. password reset, renewal notices) | Contract — Art. 6(1)(b) |
| Subscription status and plan | Giving you access to what you paid for | Contract — Art. 6(1)(b) |
| Limited payment information we receive from Stripe: name, email, country, subscription and payment status, amounts. Never card details. | Managing your subscription, refunds, our own accounting | Contract and legal obligation — Art. 6(1)(b) and (c) |
| Messages you send us | Answering you, handling refunds and complaints | Contract and legitimate interest — Art. 6(1)(b) and (f) |
| Feedback you send from the app (your message, linked to your account email) | Deciding which features to build next and, if needed, asking you about your idea | Legitimate interest — Art. 6(1)(f) |
| Technical logs (IP address, browser type, time of request) | Keeping the site secure and working, preventing abuse | Legitimate interest — Art. 6(1)(f) |
| Visit statistics: pages viewed, the site or link that brought you here, country, device and browser type, and clicks on the main buttons (for example Sign up or Subscribe). Collected without cookies and without storing your IP address; we see only totals, never individual people. | Understanding which pages and channels bring visitors, and improving the site | Legitimate interest — Art. 6(1)(f) |
We do not sell your data, use it for advertising, or use your photos or data to train AI models.
4. Who we share it with
We use a small number of service providers who process data on our behalf, under contracts that oblige them to protect it:
- ROMARG (Romania) — website hosting and server logs.
- Supabase (servers in Frankfurt, Germany) — account sign-in and the database that stores your email, subscription status and feedback.
- Stripe and Link — Link, a Stripe service, is the merchant of record for your purchase: it processes your payment, calculates and collects taxes, and sends your receipts and invoices. For these purposes Stripe and Link act as independent controllers of your payment data under their own privacy policies (stripe.com/privacy and link.com/privacy). Stripe also processes subscription data for us as our processor.
- Umami Cloud — cookie-free website analytics that produces the visit statistics described above.
- Our email delivery provider — sending service emails such as password resets.
- Our accountant — bookkeeping and legally required accounting records.
Some providers may process data outside the European Economic Area. Where they do, the transfer is protected by the safeguards required by the GDPR, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
5. How long we keep it
- Account data: while your account exists. If you delete your account, we delete it within 30 days.
- Payment and accounting records: for as long as Romanian accounting and tax law requires.
- Messages: up to 2 years after the conversation ends, unless needed for a legal claim.
- Feedback: up to 3 years, or until you delete your account.
- Server logs: up to 90 days.
6. Your rights
You have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. To exercise any of these rights, write to contact@shapesshifter.com. We will answer within one month.
You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority in the EU country where you live.
7. Cookies and local storage
We use only what is strictly necessary for the Service to work, so no consent banner is needed:
- Sign-in session — keeps you logged in.
- Preferences — remembers your light or dark theme, stored in your browser's local storage.
We use no tracking or advertising cookies. Our visit statistics (Umami) work without cookies and store nothing on your device. When you pay, the Stripe / Link checkout page sets its own cookies for security and fraud prevention. If we ever add optional cookies, we will ask for your consent first and update this page.
8. Age
The Service is for adults (18+). We do not knowingly collect data from anyone younger.
9. Changes
We will update this page if the way we handle data changes, and tell you by email if the change is significant.