CrispPNG

Privacy Policy

Effective date: December 15, 2025

Last updated: December 15, 2025

This Privacy Policy explains how EI David Konefal ("CrispPNG," "we," "us") collects, uses, discloses, and protects personal data when you use the CrispPNG Service.

1. Data Controller

For the purposes of the EU General Data Protection Regulation ("GDPR"), EI David Konefal is the data controller for the personal data described in this Privacy Policy.

Controller contact: hello@crisppng.com

Address:
CCI Aveyron, Cité de l'Entreprise et de la Formation, DAET
5 rue de Bruxelles
12033 RODEZ
FRANCE

2. What data we collect

2.1 Account data (provided by you)

  • Name
  • Email address
  • Password (stored in hashed form)

2.2 Service content and usage data

  • The text prompts you submit
  • Your generated images and associated metadata (e.g., style, timestamps)
  • Basic usage information needed to operate quotas and access controls

2.3 Logs and security data

We collect server and security logs that may include IP address, user agent, timestamps, and event/security information. Retention: 1 year.

2.4 Analytics (Plausible)

We use Plausible Analytics, self-hosted in France, configured to be cookie-less. We use it to understand aggregate usage of the website and improve performance.

3. Why we process data (purposes)

We process personal data to:

  • Create and manage your account and authenticate you
  • Provide the core Service functionality (generation, storage, library, downloads)
  • Enforce plan limits, quotas, and Service rules
  • Maintain security, prevent abuse, and debug issues (internal logs)
  • Respond to your support, privacy, or legal requests

We do not send marketing emails and do not use your data for third-party advertising.

4. Legal bases (GDPR)

Depending on the context, we rely on:

  • Contract: to provide the Service you request (account, generation, storage, support)
  • Legitimate interests: to secure the Service, prevent abuse, and improve reliability
  • Legal obligation: where retention is required by law (where applicable)
  • Consent: where we ask for it (if introduced later; not used for cookie-less analytics)

5. Where data is stored (France hosting)

  • The Service is hosted on OVH Cloud servers located in France.
  • Plausible analytics is self-hosted on servers located in France.
  • Transactional email services are hosted with OVH in France.

6. Who we share data with (recipients)

We share personal data only with:

6.1 Payment and invoicing (Lemon Squeezy)

Lemon Squeezy acts as merchant of record to process payments and issue invoices. We receive subscription status information needed to grant access to the Service.

6.2 Hosting provider (OVHcloud)

Our hosting provider is OVH SAS, 2 rue Kellermann, 59100 Roubaix, France. (OVHcloud)
(OVH is used for hosting infrastructure and may process data as part of providing hosting services.)

6.3 Analytics (Plausible)

We run Plausible ourselves (self-hosted). We do not provide personal data to a third-party analytics vendor.

We do not sell your personal data.

7. International transfers

We store and process data in France. We do not transfer your personal data outside France as part of the Service as described in this Privacy Policy.

8. Data retention

We keep personal data only as long as necessary for the purposes described above.

  • Account, prompts, and generated images: stored until you delete them or until your subscription ends; if your account is deleted, we delete associated data as described below.
  • Trial end: when the trial ends, your account is blocked; if you do not subscribe, your account and data are scheduled for deletion.
  • Deleted accounts and backups: we delete personal data within 7 days after account deletion, including from backups, unless retention is required by law.
  • Server/security logs: retained for 1 year.

9. Your rights (GDPR)

If you are in the EU/EEA (and in many other jurisdictions), you may have rights including:

  • Access to your personal data
  • Rectification (correction)
  • Erasure (deletion)
  • Restriction of processing
  • Objection to processing
  • Data portability
  • Lodge a complaint with your local data protection authority

To exercise your rights, contact hello@crisppng.com. We may ask for information to verify your identity.

10. Security

We use reasonable technical and organizational measures to protect personal data. No system is 100% secure, and you are responsible for keeping your password confidential.

11. Children's privacy

The Service is intended for adults. You must be 18+ to use CrispPNG, and we do not knowingly collect personal data from minors.

12. Cookies and similar technologies

We use strictly necessary technologies (such as session mechanisms) to operate login and core functionality. Plausible analytics is configured to be cookie-less, and we do not use advertising or tracking cookies.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top. If changes are material, we will take reasonable steps to notify you.

14. Contact

For privacy questions or requests: hello@crisppng.com
General contact form: https://crisppng.com/contact