Privacy Policy
This policy explains how Image to Layers at imagetolayers.online handles personal information. For privacy questions or rights requests, contact support@imagetolayers.online.
1. Information we collect
Image to Layers is operated by Peng Chai in Oregon, United States. We collect your sign-in email address and authentication records; applicable consent versions and timestamps; upload metadata and images you choose to upload; generated layer files and related job records; credit balances, reservations, settlements, and ledger entries; subscription, pack-purchase, payment, tax-location, refund, and dispute records; support correspondence; and limited security and abuse-prevention signals such as IP-derived identifiers and request frequency. Google sign-in provides information needed to identify and authenticate your account under the sign-in permissions presented to you. Stripe hosts checkout and payment collection. We process account, purchase, offer, payment-reference, amount, currency, credit quantity, tax and jurisdiction, payment-status, refund/dispute, and related timestamp records supplied for billing and reconciliation. We do not receive or store your full payment-card number or card security code. Buying a pack does not enroll you in a subscription or authorize recurring payments. A layered PSD may be assembled in your browser from authorized layer downloads. We do not receive or store that locally assembled PSD merely because you build or download it. Where available, a ZIP is generated in private storage and delivered through a short-lived, account-authorized link. Viewing public examples without uploading a file does not create an uploaded-image or generated-file record for your account.
2. How we use information
We use information to authenticate accounts, record consent, check upload eligibility, process images, provide authorized downloads, administer subscriptions and credit purchases, prevent duplicate grants and fraud, settle or return credits, process refunds and disputes, document applicable taxes, secure and troubleshoot the service, answer support and privacy requests, and comply with law. When enabled, eligible accounts created after the trial launch may use one free Low Resolution + Automatic job across the whole site. This is a non-credit trial: it does not require, grant, reserve, or deduct paid credits. Existing accounts are not automatically enrolled. The trial is subject to shared processing budgets, safety checks, and availability; it may be paused. A successful qualifying delivery consumes the trial. A confirmed failure without a qualifying delivery may restore it for an explicit manual retry, with a 60-second cooldown and at most three attempts in total. Unknown outcomes must be reconciled before retrying; content-policy refusals do not automatically restore the trial. We never automatically retry a trial as a paid job. Paid job pricing below remains unchanged.
3. Source images and generated-result availability
We store uploaded source images and generated results in private storage for processing and authorized downloads. A completed upload not used by a valid quote or job becomes unavailable one hour after the server first verifies the upload and records its completion time. A source for a failed job becomes unavailable 24 hours after the provider outcome is confirmed and the associated credit return or release is committed. A source for a successful job becomes unavailable 24 hours after results are complete, credit settlement is committed, and success is recorded. Unresolved or in-progress jobs do not start a failed-job retention clock. Valid references to other jobs may require a source to remain available; we do not treat such a source as an unused upload while those references still require it. Generated results have a separate 30-day availability period starting when the successful job is recorded. Download your own backup before that period ends. You may request earlier deletion of a source, a result, or your account through the signed-in service or at support@imagetolayers.online. At expiry or after an accepted deletion request, we block application access, new download links, and reuse of the affected content, including access through previously issued links where applicable. Physical deletion is asynchronous and retried if it fails. We do not guarantee that every underlying object is physically erased within one hour, 24 hours, 30 days, or another fixed period, including during an outage. We retain limited non-image billing, credit-ledger, security, dispute, and deletion-audit records where needed or legally required. An ordinary payment dispute does not itself extend image retention. Any legally required preservation of media is a separately authorized, limited exception, not a general indefinite hold.
4. Temporary signed-callback archive
To recover and verify processing outcomes, we may temporarily keep a separate, private copy of an authenticated provider callback body that can include image data. Its fixed 24-hour access period starts when our server first verifies the callback signature and persistently records that request ID in UTC. Duplicate callbacks, retries, reviews, and worker restarts do not restart the clock. We clear this raw copy earlier when the matter is resolved. At the deadline, we stop automated access and replay, stop archiving the same body, move unresolved matters to manual review using only non-image metadata and independently verified outcome information, and queue the raw copy for deletion. Remaining audit records exclude image content and reconstructable private image URLs. Failed deletion or confirmation leaves access blocked while deletion is retried and escalated; pending deletion is not reported as physical completion. Physical erasure within 24 hours is not guaranteed during failures. Older records without a trustworthy start time are isolated for individual review rather than assigned a fabricated time or automatically deleted. Manual review does not extend access to the raw callback; any legally required media hold needs separate authorization.
5. AI processing through fal.ai and Seedream
We send the uploaded image, processing instructions, and related technical data to fal.ai to run a third-party image-layering model, currently Seedream where enabled, and return generated layers. Under fal.ai's published Data Processing Addendum, fal.ai acts as a service provider or processor for identifiable customer personal data and processes it to provide the service. We configure fal generated media to expire after 24 hours and disable retention of request input/output JSON while copying qualifying results to private first-party storage. This supplier setting is separate from our source, result, and callback-archive periods. It is not a guarantee of immediate or complete deletion of supplier-held copies; deletion of our copy does not prove deletion of fal.ai's copies. fal.ai may use de-identified or aggregated Usage Data to improve its services and models and may retain information as its terms or legal obligations permit or require. We do not promise universal zero retention or that no provider data can ever be used for service improvement.
6. Other providers and disclosures
We use Cloudflare Workers, R2, D1, Queues, and Turnstile for application delivery, private storage, databases, queues, and abuse prevention; an email delivery provider for sign-in and service messages; Stripe for hosted payments and billing; and Google for OAuth sign-in. Providers process information for these purposes on our behalf or under their own applicable terms. We may disclose information where legally required or necessary to protect lawful rights and service security, subject to applicable law. If you accept optional analytics, we use Google Analytics 4 to measure page views on selected public pages. This choice is separate from accepting our Terms, acknowledging this Privacy Policy, or making a payment. Rejecting optional analytics does not prevent you from using the service. No optional analytics scripts are loaded before your choice. You can change or withdraw your choice through “Analytics preferences.” Our integration sends a selected public-page URL, a constant page title, cookie-based identifiers, and browser/device information. Requests also expose connection information, including your IP address, to Google; Google uses network information to derive approximate location. We limit our analytics events to page views and configure this integration to disable Google signals and advertising personalization. We do not include email addresses, account or payment identifiers, uploaded or generated files, signed download links, query strings, URL fragments, or referring-page URLs in these events. This describes our integration, not a guarantee about every setting in a Google account or complete technical isolation from the rest of the browser. We do not use this integration for advertising audiences, account association, or advertising exports. Google processes information under its applicable terms and privacy policies, including through infrastructure outside your country, which may include the United States. Learn how Google uses information from sites or apps that use its services: https://policies.google.com/technologies/partner-sites. Google's account data-sharing options and applicable terms may affect its use of information; this integration does not enable advertising personalization. Google Analytics user-level and event-level retention depends on the property settings and Google's retention rules; the same controls do not apply to standard aggregated reports. We do not promise that Google deletes all analytics information after our browser preference period. ShipSolo-hosted Plausible also measures page views on the same selected public pages only after you accept optional analytics. The script is https://plausible.shipsolo.io/js/script.js and events are sent to https://plausible.shipsolo.io/api/event for imagetolayers.online. This is a ShipSolo-hosted service obtained through https://shipsolo.io/app/sites, not the official Plausible Analytics Cloud service. Our event payload contains only the pageview event name, the cleaned public-page URL, the site domain and an empty referrer. We do not send query strings, URL fragments, referring-page URLs, account or payment identifiers, uploaded or generated files, or custom properties. The receiving service still sees connection information, including IP address and browser user-agent; we do not claim that it never receives IP information. We use this integration only for website traffic measurement, not session replay or custom conversion events. ShipSolo's general service privacy information is at https://shipsolo.io/privacy. Its dedicated visitor-data processing terms, hosting location, raw-log behavior and server retention period have not been verified; we do not promise a specific country, no server logs, a signed data-processing agreement, or deletion after our browser preference period. Data may be processed outside your country. Contact support@imagetolayers.online for applicable privacy requests; we will coordinate with the receiving service as needed. Withdrawing stops future optional analytics loading but does not recall events already sent or automatically delete information already received. After you accept the optional analytics choice, we use Microsoft Clarity for masked session recordings and interaction heatmaps on the clean public pricing page, only while signed out. This includes page layout, clicks, scrolling, browser/device and connection information (including IP address), public-page URLs and permitted clean public referrers, and cookie-based identifiers. Our integration does not load Clarity on image upload tools, generated-result pages, account, billing or authentication routes, signed-in pricing, or pricing URLs with query strings or fragments. We apply text/image masking before the SDK loads. Masking is not complete technical isolation and does not anonymize identifiers, interactions or network information. We do not send uploaded or generated media, private download URLs, account email or payment details to Clarity. Moving out of a recorded pricing document ends its recording lifecycle before a private page or sign-in flow opens. Microsoft and we act as independent controllers for Clarity data under the applicable terms, not solely as our processor. Microsoft may process personal data for its own purposes, including Microsoft Advertising and advertising-related profiles, and may use non-personal data for purposes including AI improvement. Accepting the choice covers the disclosed Clarity analytics and Microsoft processing; rejecting it leaves the service usable with no optional analytics. This integration sends analytics_Storage granted and ad_Storage denied through consentv2; denied advertising storage is not a promise that Microsoft never uses received data for advertising. We do not use Clarity to create user profiles or send custom account identifiers. Global Privacy Control prevents Clarity loading. See Microsoft’s Privacy Statement at https://privacy.microsoft.com/privacystatement and Clarity terms at https://clarity.microsoft.com/terms. Microsoft’s infrastructure and processing may be outside your country. Provider retention follows its applicable rules; our browser preference period is not a deletion promise. Contact support@imagetolayers.online for applicable access, objection or deletion requests.
7. Cookies and similar technologies
We use a secure, HttpOnly, SameSite=Lax session cookie to keep you signed in and a short-lived cookie to protect the Google OAuth flow. Cloudflare Turnstile and Stripe may use security or fraud-prevention technologies in connection with their features. Blocking necessary cookies may prevent sign-in or billing functions. To preserve your selected image and processing choices through sign-in or payment, the tool may temporarily save one image of up to 10 MiB in this browser using IndexedDB for up to 15 minutes. This local copy is not a server upload. The tool clears it after success, explicit cancellation, sign-out, or expiry on the next active check, and does not restore it into a different signed-in account. If browser storage is unavailable or full, the tool must warn you instead of claiming your file was saved. You can also clear site data through your browser. We record limited account-linked trial status, attempt counts, and continuation references to enforce the once-per-account trial and safely reconcile payments; those records do not contain the locally selected image. We remember your versioned optional-analytics choice in local storage (itl.analytics-consent.v1) in this browser for no more than 180 days before asking again. This key stores your choice, policy version and choice time; expired choices are cleared. After you accept, Google Analytics may set _ga and _ga_TPYPNPHK9H cookies for identifiers and sessions. Our integration limits these cookies to the remaining period of that original choice, without extending it on page navigation. The preference period, cookie lifetime and provider retention are different. Withdrawing through Analytics preferences stops future optional analytics loading and attempts to remove these analytics cookies in this browser; it does not recall requests already sent or automatically delete information already received by Google. The browser preference period is not a promise to delete all analytics data after 180 days. For applicable privacy requests, contact support@imagetolayers.online. On eligible pricing visits, Clarity can set _clck (visitor identifier) and _clsk (session identifier). The official project tag currently specifies a 365-day visitor-cookie expiry; this is distinct from our at-most-180-day local preference and GA-cookie limit. Expiry of our choice stops loading and removes first-party analytics cookies on the next active page check. We send ad_Storage denied and do not intentionally enable Microsoft advertising-cookie synchronization. Withdrawing while Clarity is active sends denied consent, attempts to clear these first-party cookies, and fully reloads the document so no no-consent replay continues. It does not delete data Microsoft already received, and we cannot clear cookies belonging to other domains.
8. Other retention and your choices
We keep non-image account, transaction, tax, credit-ledger, refund, dispute, consent, security, support, and deletion-audit records only as needed for their stated purposes or legally required. Media expiry or account deletion does not necessarily remove records needed for accounting, unresolved disputes, fraud prevention, or legal obligations. We review continued retention and do not treat these exceptions as permission for indefinite retention of every record. You may request access, correction, deletion, or a copy of personal information associated with you by emailing support@imagetolayers.online. We may verify your request and retain information where permitted or required by law. Depending on where you live and whether a law applies to us, additional rights may include restricting or objecting to processing, withdrawing consent where processing relies on it, appealing a rights-request decision, or complaining to a competent regulator. We will address applicable rights without unlawful discrimination. Withdrawals do not affect prior lawful processing.
9. Security and adult eligibility
We use TLS for transmission, private storage, access-controlled application records, and short-lived authorized download links. Result access is restricted to the authorized account; having another person's task reference does not itself authorize access. A PSD assembled in the browser is processed in browser memory for download. No system is risk-free. We provide legally required incident notices within applicable deadlines. The service is for adults who are at least 18 and meet any higher local age of adulthood. We record an active declaration with applicable versions and server time; we do not request a birth date, identity document, or facial scan for that declaration. Contact support if you believe a person who does not meet this age requirement has provided personal information.
10. Policy changes and contact
Material changes will have a new effective date and be communicated where required. Where renewed consent is legally required, we request it expressly rather than treat silence or continued use as consent. For privacy, account-deletion, or other rights requests, email support@imagetolayers.online.
Effective: 2026-10-15T08:21:55.000Z · Version: privacy-2026-10-15-free-trial-v1