Privacy Policy

Last updated: June 29, 2026

Data controller

VintageRestorer is operated by Andrii Bondar, sole trader based in Denmark. The data controller for all information you provide through this service is Andrii Bondar. Registered address: Rolighedsvej 16, 7182 Nørup, Denmark. Contact for any privacy question: hello@vintagerestorer.app.

What we collect

• Photos you upload for restoration
• Email address (if you provide one for delivery and receipts)
• Payment data — handled by Lemon Squeezy as Merchant of Record; we never see card details
• Anonymous usage analytics via Google Analytics 4, loaded only after explicit cookie consent

Why we collect it (legal basis)

• Contract (GDPR Art. 6(1)(b)): processing your photo and delivering the restored result is the service you bought.
• Legal obligation (GDPR Art. 6(1)(c)): order/invoice records are kept as required by Danish bookkeeping law.
• Consent (GDPR Art. 6(1)(a)): Google Analytics fires only after you click Accept on the cookie banner. You can withdraw consent at any time by clearing browser storage or rejecting on a subsequent visit.

Retention

Original photos and restored versions are auto-deleted after 30 days unless you request earlier deletion. Order and invoice records are kept for at least 5 years as required by Danish bookkeeping rules. Email addresses tied to orders are kept for the same period; unrelated marketing email is not stored because we do not run a marketing list.

Subprocessors and international transfers

We use the following processors to operate the service. Transfers outside the EEA happen under EU Standard Contractual Clauses (SCCs) as published by the processor.

• Supabase (Ireland, EEA) — Postgres database and private storage for original and restored photos. Region: eu-west-1 (Ireland). No transfer outside the EEA.
• Replicate, Inc. (USA) — AI inference (face restoration, colorization, upscaling). Your photo is sent for the duration of processing only; Replicate does not retain it after completion. Transfer basis: SCCs and Art. 49(1)(b) contract performance.
• Lemon Squeezy (USA) — Merchant of Record. Handles checkout, VAT, and invoicing. Receives your email, billing country, and payment data. Transfer basis: SCCs.
• Resend (USA) — transactional email (HD download link, order confirmation). Receives only your email address. Transfer basis: SCCs.
• ForwardEmail.net (USA) — receives email sent to hello@vintagerestorer.appand forwards it to the founder's inbox. Used for support replies. Transfer basis: SCCs.
• Google Analytics 4 (USA) — anonymous usage analytics. Loads only after cookie consent. Google Consent Mode v2 is configured to deny analytics_storage by default. Transfer basis: SCCs and EU-US Data Privacy Framework.
• Hetzner Cloud (Germany, EEA) — hosting infrastructure. No transfer outside the EEA.

We do not sell or share your data with advertisers and do not run any ad networks.

Your rights (EU/EEA)

Under the GDPR you have the right to access, rectify, erase, restrict, port, or object to processing of your personal data, and to withdraw consent at any time. To exercise any of these rights, email hello@vintagerestorer.app. We respond within 30 days.

You also have the right to lodge a complaint with the Danish data protection authority — Datatilsynet — datatilsynet.dk.

Cookies

We use one analytics cookie (Google Analytics 4). It loads only after you click Accept on the cookie banner. We do not use advertising cookies, retargeting pixels, or cross-site trackers. You can withdraw consent by clearing site data in your browser.

Children

This service is not directed at children under 16. If you are under 16, do not use this service without a parent or guardian.

Changes

We may update this policy as the service evolves (new processors, new features). Material changes will be highlighted on this page with a new “Last updated” date.

Contact

Questions: hello@vintagerestorer.app