Privacy policy

1. Who we are

TagDuck is operated by Pavlo Usarskyi, a sole proprietor registered in Poland, NIP 6793122131 — the data controller for the personal data described in this policy.

2. Information we collect

We collect account information (name, email), billing information (via our payment provider), usage data (how you use the Service), and the photos you upload together with the metadata we generate for them.

3. How we handle your photos

Uploaded photos are used solely to generate the metadata you request, stored only for as long as needed for that purpose, and then automatically deleted. Our AI service providers process photos only to generate the text you asked for, do not use them to train their models, and keep them for no longer than 30 days (longer only where required by law or to investigate misuse).

4. Legal basis & international transfers

We process your data to provide the Service under our contract with you, and, where applicable, based on your consent (e.g. optional analytics cookies — see below). Our servers and file storage are in the EU. Some of our service providers, including AI service providers, are located outside the EEA; where that applies, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

5. Cookies & tracking

We use cookies required to keep the Service running (authentication and payments), and, only with your consent via the cookie banner, optional analytics cookies to help us understand and improve the Service. You can withdraw that consent at any time through your browser settings.

6. Third-party services

We rely on reputable third-party providers for authentication, payments, AI-based image analysis, hosting, and email delivery, each bound by their own privacy commitments. We don't sell your personal data to anyone.

Using the WordPress plugin? See the privacy policy for the WordPress plugin.

7. Data retention & deletion

We keep your data only as long as necessary for the purposes described in this policy. You can delete your account at any time from your account settings; your data is then permanently removed within a short grace period.

Our servers keep technical access logs, including IP addresses, for security and abuse prevention for 14 days. Rate limiting uses short-lived counters.

8. Your rights

Under GDPR, you have the right to access, correct, or delete your personal data; to restrict or object to its processing; and to data portability. To exercise any of these rights, contact us at the address below. You also have the right to lodge a complaint with your local data protection authority.

9. Contact

Privacy questions or requests: contact@tagduck.io