Privacy Policy

1. Data Controller

Arné Consulting ("we", "our", or "us"), operating as UpgradeMe, is the data controller responsible for your personal data.

2. Data Protection Contact

You can contact us for any privacy-related inquiries:

4. Purposes and Legal Basis for Processing

5. Information We Collect

Account Information

When you create an account, we collect your email address and authentication credentials. If you sign in with Google, we receive your email and basic profile information from Google.

Photos

When you use our service, you upload photos for transformation. We process these photos as follows:

• Original photos: Deleted immediately after processing
• Generated photos: Stored for 30 days, then automatically deleted

Payment Information

Payment processing is handled by Stripe. We do not store your credit card details. We only receive confirmation of successful payments and transaction IDs.

6. Data Recipients and Processors

We share your data with the following categories of recipients:

All processors have signed Data Processing Agreements (DPAs) with appropriate safeguards.

7. International Data Transfers

Some of our processors are located outside the European Economic Area (EEA). For transfers to the USA, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Supplementary measures including encryption and access controls

You can request a copy of the relevant safeguards by contacting our DPO.

8. Data Retention

• Account data: Retained until you delete your account
• Original photos: Deleted immediately after processing (within seconds)
• Generated photos: Automatically deleted after 30 days
• Transaction records: Retained for 7 years (legal/tax requirements)
• Consent records: Retained for the duration of consent plus 3 years

9. Your Rights

Under GDPR, you have the following rights:

• Access (Art. 15): Request a copy of your personal data
• Rectification (Art. 16): Request correction of inaccurate data
• Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Restriction (Art. 18): Request limitation of processing
• Portability (Art. 20): Receive your data in a machine-readable format
• Object (Art. 21): Object to processing based on legitimate interests
• Withdraw consent (Art. 7): Withdraw consent at any time without affecting prior processing

To exercise any of these rights, contact us at contact@upgrademe.art or use the consent management features in your dashboard. We will respond within 30 days.

10. Right to Lodge a Complaint

If you believe we have violated your data protection rights, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is:

11. Necessity of Providing Data

Providing your email address is required to create an account and use our service (contractual requirement). Providing explicit consent for biometric data processing is required to use the photo transformation feature. Without this consent, you cannot use the core service functionality.

12. Automated Decision-Making

Our service uses AI to transform your photos. This constitutes automated processing but does not involve automated decision-making that produces legal or similarly significant effects on you. The AI only transforms the visual appearance of photos as requested by you.

13. Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (HTTPS/TLS)
• Secure authentication with password hashing
• Automatic deletion of original photos after processing
• Regular security reviews and updates
• Limited access to personal data on need-to-know basis

14. Cookies

We use only essential cookies for authentication and session management. We do not use advertising or tracking cookies.

• Session cookie: Required for login functionality (expires on browser close)
• Authentication token: Securely stores your login state (7-day expiry)

15. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes affecting your rights, we will notify you by email at least 30 days before the changes take effect. The updated policy will be posted on this page with a new "Last updated" date.

16. Contact Us

For any questions about this Privacy Policy or our data practices: