1. Introduction
BackTo2D ("we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this policy carefully.
2. Information We Collect
2.1 Information You Provide
- Account Information: Email address, name, and profile image (managed by our authentication provider, Clerk).
- Uploaded Photos: Photographs you upload to generate 2D avatars.
- Payment Information: Credit card and billing details are processed directly by Stripe. We do not store your full card number on our servers.
2.2 Information Collected Automatically
- Usage Data: Pages visited, features used, generation history, and timestamps.
- Device Data: Browser type, operating system, IP address (collected by our hosting provider, Vercel).
- Cookies: Session cookies for authentication and preference storage.
2.3 Information We Do NOT Collect
- We do NOT permanently store your uploaded photos on our servers.
- We do NOT collect biometric data or facial recognition data.
- We do NOT store your full credit card number or CVV.
3. How We Use Your Information
- To provide and maintain the Service (image generation, credit management).
- To process payments and manage your credit balance.
- To communicate with you about your account, transactions, and service updates.
- To improve the Service through aggregated usage analytics.
- To prevent fraud, abuse, and unauthorized access.
- To comply with legal obligations.
4. Photo Processing & AI Services
When you upload a photo to generate an avatar, the following process occurs:
- Your photo is compressed client-side in your browser (maximum 2048px, JPEG 80% quality).
- The compressed photo is sent to our server as a base64 data URI.
- Our server forwards the photo to a third-party AI provider (GRS AI, Fal.ai, or Google AI) for processing.
- The AI provider generates the 2D avatar and returns the result.
- Your original photo is NOT stored on our servers or in our database.
- The generated avatar image is stored as a compressed data URI in our database, linked to your account.
Third-party AI providers may temporarily process your photo to generate the image. Please refer to their respective privacy policies for details on their data handling practices.
5. Data Storage & Retention
| Data Type | Storage | Retention |
|---|
| Uploaded photos | Not stored | In-memory only during processing |
| Generated images | Database (Supabase) | Until user deletes or account termination |
| Account info | Clerk + Database | Until account deletion |
| Payment records | Stripe + Database | As required by financial regulations |
| Credit transactions | Database (Supabase) | Until account deletion |
6. Third-Party Services
We use the following third-party services that may have access to your data:
- Clerk — Authentication and user management (email, name, profile image).
- Stripe — Payment processing (credit card data handled solely by Stripe).
- Supabase — Database hosting (generated images, credit transactions, account data).
- Vercel — Application hosting (server logs, IP addresses).
- AI Providers (GRS AI / Fal.ai / Google AI) — Image generation processing (photos processed temporarily).
Each third-party provider operates under their own privacy policy. We encourage you to review their policies.
7. Data Security
- All data in transit is encrypted using HTTPS/TLS.
- Database access requires authentication and is restricted to authorized personnel.
- Payment data is handled exclusively by Stripe, which is PCI DSS Level 1 certified.
- Uploaded photos are processed in-memory and never written to disk.
- While we implement robust security measures, no method of transmission over the Internet is 100% secure.
8. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access — Request a copy of your personal data.
- Rectification — Request correction of inaccurate data.
- Erasure — Request deletion of your personal data and account.
- Portability — Request your data in a machine-readable format.
- Objection — Object to processing of your data for specific purposes.
To exercise any of these rights, please contact us at support@backto2d.com.
9. Children's Privacy
The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we discover that a child under 13 has provided us with personal data, we will delete such information promptly.
10. International Users
The Service is hosted in the United States. If you access the Service from outside the US, please be aware that your data may be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer.
11. Policy Changes
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.