Last Updated: October 26, 2026

Privacy Policy

Thank you for using ImageBoss! ImageBoss processes images at scale in real time, caches them, and delivers them to your users. This Privacy Policy ("Policy") explains how we collect, use and share personal data when you visit our website, create an account, or otherwise interact with us. This Policy incorporates and is incorporated into our Terms of Service.

Who We Are

ImageBoss is a product of GoCode Technologies OÜ, a company registered in Estonia (registry code 16044413), with its registered address at Sepapaja tn 6, 15551 Tallinn, Estonia ("ImageBoss", "we", "us"). For the personal data described in this Policy, we are the controller. You can contact us about any privacy matter at [email protected].

Scope: Images We Deliver for Our Customers

When our customers use ImageBoss to process and deliver images to their own users, we act as a processor on behalf of that customer. This includes the content of those images and the technical data (such as IP addresses) of the devices that request them. In that role we process such data only on the customer's instructions, as set out in our Terms of Service and any data processing agreement with that customer. In particular:

• Original and processed images are cached in our storage and on our content delivery network so they can be delivered quickly.
• Our content delivery network records access logs for each image request, including the requesting device's IP address and browser information. We use these logs to calculate each customer's usage and bandwidth for billing; the usage records we keep for billing do not contain IP addresses or browser information.
• Face detection, smart cropping and background removal run on our own infrastructure; images are not sent to third-party analysis services.

If you are a user of one of our customers' websites or apps, please refer to that customer's privacy policy.

Information We Collect

• Account information: your name, email address, password (stored as a one-way hash), company details and the image sources you configure, including the credentials needed to access them.
• Billing information: billing name and address, tax ID and invoice history. Card details are entered directly into, and stored by, our payment processor Stripe; we never receive or store your full card number.
• Usage information: aggregated data about your use of the Services, such as the number of images processed, bandwidth and cache performance, which we use for billing and to operate the Services.
• Log and device information: when you visit our website or dashboard, we and our providers receive your IP address, browser type, operating system, pages requested and access times. Errors that occur in your browser or on our servers are reported to our error-monitoring provider together with this technical information.
• Communications: messages you send us by email or through the chat widget on our website.

How We Use Information and Our Legal Bases

• To provide the Services (create and manage your account, process and deliver images, bill you, send service and security notices): performance of our contract with you (Art. 6(1)(b) GDPR).
• To comply with legal obligations, such as keeping accounting records and responding to lawful requests from authorities: legal obligation (Art. 6(1)(c) GDPR).
• To keep the Services secure and reliable, including preventing fraud and abuse (for example with reCAPTCHA on sign-up) and diagnosing errors: our legitimate interests in operating a secure service (Art. 6(1)(f) GDPR).
• To answer your questions and provide support: performance of our contract or our legitimate interest in responding to enquiries.
• To send you product announcements about ImageBoss: our legitimate interest in informing existing customers about similar services, or your consent where required. You can opt out at any time.
• To measure the effectiveness of our advertising (for example, whether a sign-up came from a Google Ads campaign): your consent (Art. 6(1)(a) GDPR).

Cookies and Similar Technologies

We use the following categories of cookies and similar technologies on our website and dashboard:

• Strictly necessary: cookies that keep you signed in, remember your session and protect forms against forgery. These are required for the Services to work.
• Security: Google reCAPTCHA on our sign-up form, to protect against automated abuse.
• Support chat: the Drift chat widget, which lets you talk to us. When you are signed in, we share your name and email address with Drift so we can identify you in the conversation. This loads only if you choose Accept.
• Analytics and advertising: Google Tag Manager, which loads Google Analytics and Google Ads conversion measurement. This loads only if you choose Accept.

Necessary cookies are set because the Services do not work without them. Google reCAPTCHA runs only on the sign-up form you submit. You can reject advertising and chat cookies on the banner, and you can change that choice at any time from Cookie settings. If you reject strictly necessary cookies in your browser, parts of the Services may not work.

Sharing of Information

We do not sell your personal data. We share it only with the service providers (sub-processors) we use to run ImageBoss, each bound by data processing terms:

• Amazon Web Services, Inc. (United States): hosting and image processing, content delivery (Amazon CloudFront), storage, databases, queues and transactional email (Amazon SES).
• MongoDB, Inc. (United States): database hosting (MongoDB Atlas).
• Stripe, Inc. and its affiliates: payment processing and invoicing.
• Bugsnag (SmartBear Software, Inc.) (United States): error monitoring.
• Drift (Salesloft, Inc.) (United States): website chat.
• Google LLC / Google Ireland Limited: reCAPTCHA, Google Tag Manager, Google Analytics and Google Ads conversion measurement.
• jsDelivr and cdnjs: public content delivery networks that serve some of the scripts on our website, and which therefore receive your IP address when your browser loads them.

We may also disclose information where required by law or legal process, to protect the rights, property and safety of ImageBoss or others, or in connection with a merger, acquisition or sale of all or part of our business, in which case we will require the recipient to honour this Policy.

International Transfers

Some of our service providers are located in, or process data in, the United States and other countries outside the European Economic Area. Where this happens, we rely on an adequacy decision of the European Commission (such as the EU–U.S. Data Privacy Framework, where the provider is certified) or on the European Commission's Standard Contractual Clauses included in the provider's data processing terms.

How Long We Keep Information

• Account information is kept while your account is active and deleted when you close your account, except where we must keep it longer by law.
• Billing records and invoices are kept for seven years, as required by Estonian accounting law.
• Application logs are kept for 7 days.
• Content delivery network access logs, which contain IP addresses, are kept for 90 days.
• Cached images are deleted automatically from our storage after 90 days and may remain on our content delivery network for up to 1 year, as described in our Terms of Service. Customers can purge cached images at any time. When an account is deleted, its account data is removed within 30 days, and any remaining cached images expire as described above.

Security

We take appropriate technical and organisational measures to protect personal data against loss, theft, misuse and unauthorised access, disclosure, alteration and destruction. These include encryption of data in transit, hashing of passwords, restricted access to production systems, and optional signed URLs for image delivery.

Your Rights

Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where we process data based on your consent, you can withdraw that consent at any time without affecting processing that took place before. You can update most account information in your dashboard, close your account from the billing page, or email us at [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

Promotional Communications

You may opt out of receiving product announcements from ImageBoss by following the instructions in those emails or by contacting us. If you opt out, we may still send you messages about your account, billing and our ongoing service relationship.

Changes to This Policy

We may change this Policy from time to time. If we make changes, we will update the date at the top of this Policy and, for material changes, notify you by email or through the Services.

Contact Us

If you have any questions about this Privacy Policy, please contact us at [email protected].