Privacy Policy

1. What Data We Collect

• Account data: your email address and an encrypted form of your password. If you sign in with Google, we receive your email address, your name and your profile picture URL as provided by Google. We never receive your Google password.
• Photos you upload: the original image files you submit for restoration. Photographs can contain sensitive information, including images of identifiable people, so we treat them with care.
• Restored results: the output images produced by the AI model, stored in your account.
• Usage data: records of your restorations (timestamps, job status, file size and format), your remaining monthly quota, and basic technical logs such as IP address, browser type and error messages needed to operate and secure the service.
• Billing data: your subscription plan, its status and renewal date. Payment card details are handled by PayPal — we never see or store your full card number.
• Support messages: anything you write to us by email.

2. Why We Use It, and On What Legal Basis

• To create your account, authenticate you and keep your session — necessary to perform our contract with you.
• To run the restoration you request, store the result and let you download it — necessary to perform our contract with you.
• To count restorations against your monthly plan quota and manage your subscription — contract and legal obligation (accounting, tax).
• To keep the service secure, prevent abuse, debug failures and improve reliability — our legitimate interest in running a safe, working service.
• To answer your support requests — contract and our legitimate interest in supporting customers.
• To send you service emails such as password resets, billing notices and important changes — contract and legal obligation. We do not send marketing email without your consent.

3. Where Your Photos Are Stored

Your uploaded photos and restored results are stored in Supabase Storage, hosted on Amazon Web Services infrastructure in the eu-west-1 region, which is located inside the European Union. Files are held in a private bucket and are accessible only through your authenticated account, using per-user access rules and time-limited signed links.

4. Processors and Sub-processors

We keep the number of third parties as small as possible. Each of the following processes data on our behalf, under a contract, and only for the purpose described:

• Supabase — database, authentication and file storage. Processes your email address, account records, restoration metadata, uploaded photos and results.
• MuAPI — the AI image-to-image processing provider that performs the actual restoration. Receives the photo you submit and returns the restored result.
• Vercel — hosting and delivery of the web application. Processes connection and request logs, including IP addresses.
• PayPal — payment processing. Processes your billing name, email and payment details. We receive only the subscription status, the amount charged and a reference number.

Some of these providers may process data outside the European Economic Area. Where that happens, transfers are covered by the safeguards those providers offer, such as the European Commission Standard Contractual Clauses. We do not sell your personal data and we do not share it with advertisers or data brokers.

5. Sending Your Photos to the AI Provider

To restore an image we must transmit it to MuAPI, which runs the AI model. This transfer happens over an encrypted connection and only when you start a restoration. MuAPI returns a temporary link to the restored image, which we copy into your Supabase Storage.

Results held on MuAPI infrastructure expire after 30 days. After that the temporary copy at the provider is no longer available, and your permanent copy lives only in your NNC Restore account.

6. We Do Not Train Models on Your Photos

NNC Vision does not use your photographs or restored results to train, fine-tune or evaluate any AI model. Your images are processed to produce your result and for nothing else. We do not build datasets from customer uploads, and we do not publish your images or use them in marketing without your separate, explicit written permission.

7. How Long We Keep Data

• Photos and results: kept in your account for as long as your account exists, so you can download them again. You can delete any individual photo at any time.
• Account data: kept while your account is active. Deleting your account deletes your uploaded photos and restored results from our storage, together with your profile and restoration history. Residual copies may persist in encrypted backups for a short period before being overwritten.
• Technical logs: typically kept up to 90 days for security and debugging.
• Billing records: kept as long as tax and accounting law requires, which is normally several years. Payment records are held by PayPal.

8. Cookies

We use strictly necessary cookies only. They hold your Supabase authentication session so you stay logged in between page loads, and they support basic security functions such as protecting the sign-in flow. We do not use advertising cookies, cross-site trackers or third-party analytics profiling. Because these cookies are essential to provide a service you asked for, they do not require consent — but clearing them will simply sign you out.

9. Your Rights Under GDPR

If you are in the European Economic Area, and in most other regions with comparable law, you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted, including your photos and your account.
• Portability — receive your data in a common, machine-readable format, or have it sent to another provider where technically feasible.
• Objection and restriction — object to processing based on our legitimate interests, or ask us to limit processing while a dispute is resolved.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting past processing.

To exercise any of these rights, write to support@nncvision.com from the email address associated with your account. We will respond within 30 days. We may ask you to confirm your identity before acting on a request. You also have the right to lodge a complaint with your local data protection authority.

10. Security

Data is transmitted over HTTPS and stored encrypted at rest by our providers. Access to your files is restricted to your authenticated account through per-user access rules, and administrative access is limited to what is needed to operate the service. No system can be guaranteed completely secure, so please also keep a personal backup of your original photographs.

11. Children

NNC Restore is not intended for children. You must be at least 16 years old, or the minimum age required in your country, to create an account. If we learn that we hold data from a child below that age, we will delete it.

12. Changes to This Policy

We may update this policy as the service or the law changes. The date at the top of this page always shows the current version, and we will notify registered users by email before any material change takes effect.

13. Contact

NNC Vision, Republic of Serbia — data controller for NNC Restore. For any privacy question or request, contact support@nncvision.com. See also our Terms of Service.