Privacy Policy

1. What Data We Collect

• Account data: email address, name (if you give it), a hashed password, and the time you confirmed that you are 16 or older and accepted our Terms (we do not ask for your date of birth). With Google sign-in we receive your name, email and profile picture URL from Google — never your Google password.
• Photos you upload and the restored results. Photos often show identifiable people, so we treat them with care. We do not use face recognition or build biometric profiles; the image is only passed to the restoration model.
• Usage data: your restorations (time, status, size, which processing option), remaining quota and credits, referral code, an optional "needed by" date for priority orders, and technical logs (IP address, browser, errors).
• Abuse-prevention data: a one-way hash of your IP address (never the IP itself) to limit free previews and gallery likes per visitor.
• Billing data: plan, status, renewal date, amounts and payment references. Card details stay with PayPal.
• Google Drive files: only if you use Drive import or "Save to Drive". We request the narrow drive.file permission, which gives access only to files you pick or that we save for you — never to the rest of your Drive.
• Messages: what you send through the contact form or by email.

Account data is required to use the service; everything else is optional or created by your own use of it.

2. Why We Use It, and On What Legal Basis

• Creating your account, running restorations, storing and delivering results, counting quota and handling purchases — performance of our contract with you (GDPR Art. 6(1)(b)).
• Keeping invoices and payment records — legal obligation (Art. 6(1)(c)).
• Security, abuse prevention, debugging and answering support requests — legitimate interest in a safe, working service (Art. 6(1)(f)). You can object at any time.
• Analytics cookies, the newsletter and showing your before/after anonymously in the public gallery — your consent (Art. 6(1)(a)), which you can withdraw at any time.

We do not make decisions about you that have legal or similarly significant effects by automated means, and we do not sell or rent your personal data.

3. Where Your Photos Are Stored

Uploaded photos and results are stored in Supabase Storage on Amazon Web Services in Ireland (EU, region eu-west-1), in a private bucket. They can be opened only from your signed-in account, through per-user access rules and links that expire after a short time.

4. Who Processes Your Data

We use the following service providers. Each receives only what it needs for the role described:

Our database, storage and servers are in the EU. Some providers above are in the United States or operate globally; for those transfers we rely on the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework, as offered by each provider. We will name any new provider here before it receives your data.

5. AI Processing and Model Training

To restore a photo we send it over an encrypted connection to MuAPI or Replicate, only when you start a restoration or a free preview. The result is copied back into your account.

We do not use your photos or results to train, fine-tune or evaluate AI models, we do not build datasets from them, and we have not opted into any provider programme that would allow that. Providers may keep short-lived copies for operating and abuse monitoring under their own terms.

6. The Public Gallery

After a restoration you may choose "Yes, you may show it" to let us show that before/after pair anonymously on our website and social channels. Nothing is shown without that choice, and we review every image by hand before it appears. Your name and email are never shown. To withdraw, write to support@nncvision.com and we remove the image, usually within two business days. Please only allow sharing if the people in the photo (or their families) would not object.

7. How Long We Keep Data

• Original uploads: deleted automatically 30 days after a successful restoration; files of failed restorations are deleted within a day.
• Restored results: kept while your account exists so you can download them again. You can delete any photo at any time.
• Free previews: only a small watermarked copy is kept; the full-size preview is not stored.
• Account data: until you delete your account. Deleting the account removes your profile, restoration history and all your files; residual copies in provider backups are overwritten within their normal backup cycle.
• Technical logs: up to 90 days.
• Billing records: as long as tax and accounting law requires (in Serbia generally up to 10 years).

8. Cookies

We use strictly necessary cookies to keep you signed in and to protect the sign-in flow. These do not require consent; clearing them simply signs you out.

With your permission we also use Google Analytics to see which pages are useful. Analytics cookies stay off until you choose "Accept" in the cookie banner; if you decline, none are set. IP addresses are anonymised and Google signals are disabled. You can change your choice at any time with "Cookie settings" in the footer. We do not use advertising cookies.

9. Emails

We send a welcome email and service emails (sign-in links, receipts, important changes). Newsletters and offers are sent only if you subscribe, and every one has an unsubscribe link.

10. Your Rights

Under the GDPR, the Serbian Law on Personal Data Protection and comparable laws (for example in the UK and California), you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have your data deleted — you can delete your whole account yourself from the dashboard;
• receive your data in a portable, machine-readable format;
• object to processing based on legitimate interest, or ask us to restrict it;
• withdraw consent at any time, without affecting earlier processing.

Write to support@nncvision.com from your account’s email address. We answer within 30 days and may ask you to confirm your identity. You may also complain to a supervisory authority: in Serbia the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs), or the data protection authority in the EU country where you live or work.

11. Security

All traffic uses HTTPS. Data is encrypted at rest by our providers, files sit in a private bucket behind per-user access rules, server access requires cryptographic keys, and administrative access is limited to what is needed to run the service. If a breach affects your data and is likely to put you at risk, we will tell you and the competent authority without undue delay. No system is perfectly secure, so please keep your own copy of every original photograph.

12. Children

NNC Restore is not intended for children. You must be at least 16 years old, or the minimum age for consent to online services in your country if that is higher. If we learn that we hold data from a younger child, we delete it.

13. Changes to This Policy

We update this policy when the service or the law changes. The date at the top always shows the current version, and we email registered users before any material change takes effect.

14. Contact

Data controller: Petar Milivojević, trading as NNC Vision, Belgrade, Republic of Serbia. Email: support@nncvision.com. See also our Terms of Service and Refund Policy.