Privacy Policy

Introduction

BG-Zero ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website at bg-zero.tech (the "Service").

Image Processing — Your Data Stays Local

Your images are processed entirely within your browser using WebAssembly and WebGPU technology. We do NOT upload, receive, store, or have any access to your images. No image data ever reaches our servers. This is a core design principle of BG-Zero.

Data We Collect

We collect limited personal data necessary to provide the Service:

• Email address — collected during registration or Google OAuth sign-in, used for account management and communication.
• Password hash — stored securely using bcrypt, never in plaintext.
• Google OAuth profile — name and avatar URL, if you sign in with Google.
• Session data — stored in cookies and our database for authentication (7-day expiry).
• Analytics events — page views and feature usage, collected for improving the service. No personally identifiable information beyond user ID (for logged-in users).
• Server logs — IP addresses may be temporarily logged for rate limiting and security (retained up to 30 days).

Legal Basis for Processing (GDPR)

We process your data under the following legal bases: Contract necessity (Art. 6(1)(b)) for account management and service delivery; Legitimate interest (Art. 6(1)(f)) for analytics and security.

Third-Party Services

We use the following third-party services:

• Hosting & CDN — for serving the website globally
• Database provider — for storing account data
• Resend (US) — for sending transactional emails (verification, password reset)
• Google OAuth (US) — for social login (only when you choose to sign in with Google)
• Hugging Face CDN (US) — for downloading AI model files directly to your browser (no personal data transmitted)

Data Retention

Account data is retained for the duration of your account. Analytics events are retained for up to 12 months. Server logs are retained for up to 30 days. You may request deletion of your data at any time.

Your Rights

Under GDPR, CCPA, and other applicable laws, you have the right to:

• Access — request a copy of your personal data
• Correction — request correction of inaccurate data
• Deletion — request deletion of your account and data
• Data portability — export your data in machine-readable format
• Object — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent

To exercise these rights, use the account settings page (for deletion and export) or email us at privacy@bg-zero.tech.

Children's Privacy

BG-Zero is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us at privacy@bg-zero.tech.

Security Measures

We implement appropriate security measures including: HTTPS encryption, bcrypt password hashing, Content Security Policy headers, rate limiting, and secure session management.

International Data Transfers

Your data may be processed in the United States through our service providers. We ensure appropriate safeguards (Standard Contractual Clauses) are in place for EU/UK data transfers.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The "Effective Date" at the top indicates when this policy was last revised.

Contact Us

For privacy-related inquiries, contact us at: privacy@bg-zero.tech

Supervisory Authority

EU/UK residents have the right to lodge a complaint with their local data protection authority if they believe their data has been processed unlawfully.