Privacy Policy

Last Updated: August 6, 2026

1. Data Controller

ResizeFlow is operated as a sole proprietorship based in Bulgaria, European Union. For the purposes of applicable data protection laws (including the EU General Data Protection Regulation), ResizeFlow is the data controller responsible for your personal data.

2. Data We Collect

We collect minimal data necessary to provide the Service. The categories of data we process include:

  • Account Data: Your email address and authentication method (Google or email/password) when you create an account. This is processed on the lawful basis of contractual necessity.
  • Payment Data: Billing information is collected and processed directly by Stripe. We store only your Stripe Customer ID and subscription status — we never receive or store your credit card details.
  • Usage Data: We track service usage (downloads, upscales, mockup exports, SEO copywriting runs) through a usage ledger keyed by a salted hash of your email address. This is processed on the lawful basis of legitimate interest (preventing abuse and managing quotas).
  • Content Data: Images you upload for processing are stored temporarily and deleted automatically after processing.
  • Cookie Data: Your cookie consent preference is stored locally in your browser via localStorage.

3. Image Processing

Your images are processed in the cloud using secure servers. We do not use your images for training AI models or for any purpose other than resizing them for your download. Images are automatically deleted after processing is complete.

4. Third-Party Services

We share data with the following third-party service providers, each of whom operates under their own privacy policy:

  • Stripe — payment processing (receives billing information)
  • Firebase (Google Cloud) — authentication, database, and file storage
  • Replicate — AI image upscaling (receives images you choose to upscale)
  • Google Gemini API — SEO copywriting (receives text prompts, not images or personal data)
  • Mockupanda — mockup generation (receives artwork for rendering onto product mockups)
  • Brevo — transactional email delivery (receives your email address for welcome and verification emails)
  • Google Cloud Error Reporting — error monitoring and service reliability

These services may process data in locations outside the European Union. Where data is transferred outside the EU/EEA, appropriate safeguards are in place, including Standard Contractual Clauses and the EU-U.S. Data Privacy Framework where applicable.

5. Cookies

We use essential cookies to maintain your login session and provide security features. We do not use tracking cookies for advertising. Before any non-essential cookies are activated, we obtain your explicit consent through our cookie consent banner. You can change your cookie preferences at any time.

6. Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/SSL) and secure cloud infrastructure. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your data for the following periods:

  • Uploaded images: Deleted automatically within hours after processing is complete.
  • Account data: Retained while your account is active. Deleted when you delete your account through the application settings.
  • Usage ledger data: Retained indefinitely in hashed, non-personally-identifiable form to prevent service abuse through re-registration. This data cannot be used to identify you.
  • Payment records: Retained as required by applicable tax and financial regulations (typically up to 7 years).
  • Cookie consent preferences: Stored in your browser's localStorage and cleared when you clear your browser data.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

  • Right to Access: You can request a copy of the personal data we hold about you.
  • Right to Rectification: You can request correction of inaccurate personal data.
  • Right to Erasure: You can delete your account and associated data through the application settings.
  • Right to Data Portability: You can request your data in a structured, commonly used format.
  • Right to Restrict Processing: You can request that we limit how we use your data.
  • Right to Object: You can object to processing based on legitimate interests.
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority, including the Commission for Personal Data Protection of the Republic of Bulgaria (CPDP) or the supervisory authority in your country of residence.

To exercise any of these rights, please contact us at hello@resizeflow.com. We will respond to your request within 30 days.

9. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

  • Right to Know: You may request details about the categories and specific pieces of personal information we have collected.
  • Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
  • Right to Opt-Out of Sale/Sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a verifiable consumer request, please contact us at hello@resizeflow.com.

10. AI Processing and Image Upscaling

To provide our AI Upscale feature, images you choose to upscale are processed by Replicate using the Real-ESRGAN model. These images are used solely to enhance resolution and are not used to train AI models. We do not store your images beyond what is necessary to provide the upscaling service.

Additionally, text data submitted to the Listing Copywriter tool (such as product topics, keywords, and audiences) is securely processed by Google's Generative Language API (Gemini) to generate listing metadata. No personally identifiable information or image files are shared with Google.

11. Mockups Integration

To provide the Mockups Editor, artwork is uploaded and rendered onto product mockup templates through our integration partner, Mockupanda. Image files and placement configurations are processed to generate your mockup exports.

12. Children's Privacy

ResizeFlow is not directed to children under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly.

13. International Data Transfers

ResizeFlow is operated from within the European Union (Bulgaria). However, some of our third-party service providers process data in the United States and other countries. Where personal data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place in accordance with GDPR requirements, including Standard Contractual Clauses.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the "Last Updated" date at the top of this page and, where appropriate, through an in-app notification or email. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

15. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, you can reach us at:

Email: hello@resizeflow.com

You may also contact us directly through the application: