Privacy Policy
- Data Controller
The entity responsible for the processing of personal data on this website in accordance with the General Data Protection Regulation (GDPR / Regulation (EU) 2016/679) and applicable German data protection laws is: www.eraseandmend.com
Contact Email: help@eraseandmend.com
- Collection and Processing of Personal Data
We collect and process personal data only when necessary to provide online image restoration and editing services, fulfill service contracts, manage user accounts, and maintain operations.
The categories of data processed include:
Account Information: Email address and login information provided during account creation.
Uploaded Content: Digital image files submitted directly by the user for processing.
Transaction & Billing Data: Purchase history, service plan details, and invoice records.
Technical Logs: IP address, browser type, operating system version, and standard access timestamps collected automatically during site visits.
Legal Basis: Data processing is conducted pursuant to Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate business operations).
- Payment Processing
Payment execution on www.eraseandmend.com is managed via an integrated third-party payment infrastructure.
Payment Service Provider: Payment transactions, card data transmission, and financial verification are processed by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland).
Data Transmission: When placing an order, relevant transactional information (such as purchase amount, billing email, and payment card details) is directly transmitted to Stripe via encrypted channels.
Data Handling: Eraseandmend does not store, retain, or handle full payment card numbers or sensitive verification details on local servers. All payment handling is subject to Stripe’s privacy guidelines and PCI-DSS data compliance architectures under Art. 6(1)(b) GDPR.
- Data Storage and Retention Period
In accordance with GDPR data minimisation standards and statutory German retention mandates, personal data is kept only for as long as required for its specific operational purpose:
Uploaded User Images: Files uploaded for image processing are retained temporarily on servers only to execute the processing request and facilitate user downloading. User files are automatically purged from system active storage within 24 to 72 hours.
Account & Profile Data: Maintained for the duration of the active account relationship. Upon account termination, personal identifiers are erased unless legal storage requirements apply.
Commercial & Tax Records: Transaction invoices, billing documentation, and related correspondence are retained for up to 10 years in compliance with German commercial and fiscal obligations under Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).
Technical Access Logs: Web server access records are retained for a maximum of 7 to 14 days for security monitoring and system performance review before being routinely deleted.
- Third-Party Data Transfer and Hosting
Personal data is processed primarily within the European Union and European Economic Area (EEA). Where services involve infrastructure providers outside the EEA, appropriate safeguards—such as EU Standard Contractual Clauses (SCCs)—are maintained to protect data transfers in accordance with Art. 46 GDPR.
We do not sell, lease, or trade user data to third parties for independent commercial marketing purposes.
- Rights of Data Subjects
Under Chapter III of the GDPR, users residing in Germany and the European Union hold specific statutory rights regarding their personal data:
Right of Access (Art. 15 GDPR): The right to request confirmation regarding the processing of your personal data.
Right to Rectification (Art. 16 GDPR): The right to request correction of inaccurate personal details.
Right to Erasure (Art. 17 GDPR): The right to request deletion of personal records where legal conditions are met.
Right to Restrict Processing (Art. 18 GDPR): The right to limit data processing under specific statutory criteria.
Right to Data Portability (Art. 20 GDPR): The right to receive personal data in a structured, standard format.
Right to Object (Art. 21 GDPR): The right to object to processing based on legitimate business interests.
To exercise any of these rights, please contact our data management team at help@eraseandmend.com. You also retain the right to lodge a complaint with a competent German supervisory authority for data protection (Datenschutzbehörde).
- Data Security Measures
Eraseandmend implements industry-standard administrative, physical, and technical measures to protect user data against unauthorized access, loss, or alteration. Data transmissions are encrypted using standard SSL/TLS protocols.
While rigorous measures are maintained to preserve data integrity, internet transmission methods and storage architectures inherently involve baseline security parameters, and absolute security cannot be guaranteed.