Legal & privacy
Privacy Notice
How account information, uploaded media and service records are handled, and how to make a privacy request.
Effective:
Who we are and what this covers
Imazeo is a media processing service operated by Manish Balodia, with MSME/Udyam registration in Jaipur, Rajasthan, India. Our address is Near Jain Temple, Govindgarh, Jaipur, Rajasthan 303712, India. This notice covers the public website, Customer portal, image, PDF and code-generation APIs, and administrative handling of account, support and inquiry information.
Contact contact@imazeo.com for privacy questions. If you use Imazeo to process images containing another person’s information, you are responsible for having the rights and permissions to submit that information and for giving them appropriate notice. This notice is not a data processing agreement.
Information the service handles
Account information includes your email, name, account status, verification and sign-in records. Optional profile information includes a timezone and avatar. The service also records onboarding state. Password-based authentication uses password hashes. If you choose an enabled Google or GitHub sign-in option, the service receives provider identity and account information needed to authenticate you.
Project information includes project identifiers and names, API key metadata and hashes, original images, transformed images, transformation settings and media metadata. Uploaded originals preserve their bytes, including any embedded personal information or location metadata. Derivatives omit EXIF, GPS and ICC metadata; this does not remove personal information visible in the image itself.
Usage and security information includes processing, storage and bandwidth records, request identifiers, timestamps, session IP addresses and browser or device user-agent information. Account, entitlement and administrative actions can generate audit records.
Commercial records can include agreed plan snapshots, prices, currency, service and usage dates, external payment amounts, payment dates and references, administrative notes, corrections and allocations. Authorized administrators use these records to confirm payment, activate agreed access and resolve commercial questions. Internal payment references, notes and administrative audit details are excluded from public catalogs and customer subscription history. Imazeo does not collect payment-card details through a website checkout.
Support information includes the subject and body of tickets and replies, account identifiers, status, priority and assignment. Emailing us also shares your email address and message. Do not send passwords, API keys, tokens or unnecessary sensitive information in a support request.
Public contact inquiries include your name, email, optional company, inquiry type, subject and message. These are retained with status and timestamps for authorized administrators to handle the inquiry. The inquiry document does not store the CAPTCHA token or visitor IP; separate security and audit records may contain request context. Optional operator email notifications carry inquiry details. The form does not enroll you in marketing.
PDF tools handle the files and selected pages you submit; QR and barcode tools process their supplied text. Preview outputs are temporary. When you choose a supported Save action, outputs and metadata are stored for later authorized retrieval. Assigned terms can specify source-retention settings; these settings are not a guarantee that a background job erases files at an exact time. Usage and security records can remain.
Why information is used
Information is used to create and authenticate accounts, maintain sessions, manage projects and keys, carry out requested image processing, return and store media, measure usage, enforce account limits, troubleshoot failures and respond to support requests.
Security and audit information supports access control, abuse investigation and the review of administrative changes. Account information is also used for verification, password recovery and service-related communications. The current launch has no paid checkout or payment-card collection workflow. When enabled on the public website, Google Analytics is used to understand aggregate visit and page usage.
Information needed to provide the service is processed to handle your requests and administer your account and agreed service terms. Security and abuse-prevention information is used to protect the service and its users. Records may also be kept to meet applicable legal duties. Where applicable law requires consent for a particular activity, that consent must be obtained for that activity. Using the website is not blanket consent to unrelated processing or marketing.
Access, providers and disclosure
Authorized administrators can review account and project metadata, usage, entitlement history and support conversations, and perform permitted account-management actions. Administrative authentication is separate from customer authentication. Media requests require customer or project authorization; the service does not provide anonymous public media links.
Operating the service involves the hosting, database, storage and transactional email services configured for the deployment. The supported integrations below are used only when enabled; they are not a statement that every listed service is active. Optional identity providers process sign-in under their own notices. When you request remote URL processing, the source server receives a fetch request, including the requested URL.
Information may need to be disclosed where legally required, to respond to valid legal process, or to investigate abuse and protect the service or other people. Processing locations depend on the configured providers and may be outside India. We do not offer an India-only data-residency guarantee. Contact us for provider and location information relevant to your use, particularly before submitting data subject to residency or international-transfer restrictions.
| Service | When it is involved |
|---|---|
| Amazon S3 | Private media storage when configured. Local/server-disk storage is also supported. The selected region depends on the deployment; no particular region is guaranteed by this notice. |
| Google / GitHub | Optional sign-in providers, only when enabled and selected. Each provider handles its own sign-in service. |
| Cloudflare Turnstile | Optional spam and authentication protection when enabled. It receives browser/device information; it is not an advertising integration added by Imazeo. |
| Google Analytics | When the public website build includes a measurement ID, Google Analytics 4 loads on Main pages and receives ordinary usage information such as page views, device/browser signals and approximate location. Google processes this under its own terms. It is not used for advertising remarketing by Imazeo in the current integration. |
| Hosting, MongoDB hosting and transactional email | Configured infrastructure stores account and service records and delivers account emails. MongoDB is the database software; this notice does not imply a particular hosted database or email vendor. |
Cookies and browser storage
The public website serves fonts and demonstration assets locally. When a production build includes Google Analytics, the Main site loads Google’s measurement scripts to collect aggregate visit and page-usage information; Imazeo does not add advertising or session-replay scripts. The contact form submits inquiry details to Imazeo without account credentials and does not persist them in browser storage. When enabled, a validated contact or Customer authentication submission loads Cloudflare Turnstile for protection against automated abuse. Cloudflare and Google may process browser, device and interaction information under their own privacy policies and terms. You can email us instead of using the contact form. Hosting infrastructure can receive ordinary request information such as IP addresses. The Cookies and browser storage notice explains the current inventory and available controls.
The Customer and Admin portals keep access tokens in memory rather than localStorage or sessionStorage. Realm-specific HttpOnly cookies on the API host retain refresh credentials so a valid session can be restored after reloading. These cookies use Secure and SameSite protections in deployed environments and expire with the server session. Signing out revokes that session and clears its cookie. The public website can check only whether a Customer session is active; it receives no tokens or account details. The portals retain a non-secret session reference and last-activity timestamp on the device to coordinate idle sign-out across tabs and reloads; these values do not grant account access. Customer browser storage also retains interface preferences, selected and recent project identifiers and capacity-alert acknowledgements. Clearing preferences does not delete server records. External sign-in providers may use their own cookies when you choose to sign in with them.
Storage, retention and deletion
Uploaded originals and persisted transformations remain stored until a deletion or cleanup operation removes them. Cache mode allows reuse within a cache lifetime; cache expiry does not guarantee immediate physical deletion. Ephemeral transformation mode does not save an output media file, but an uploaded source and associated usage or security records can remain.
Deleting an account is currently a soft deletion: it disables access and revokes sessions and project keys. It does not immediately erase owned projects, media, support conversations or audit and security records. There is no implemented automatic permanent account purge or published fixed retention period for these records.
There is no single fixed retention period covering all service records. Retention depends on the record’s purpose, your service use, operational cleanup and applicable legal duties. Contact us to request erasure or information about retained records. Requests must distinguish data that can be removed from information subject to a legal retention requirement. The account-deletion button is not a permanent-erasure workflow.
| Information | What happens today |
|---|---|
| Account and profile | Account deletion disables access. Account/profile records remain; there is no automatic permanent account purge. |
| Originals, avatars and saved outputs | Private storage remains until a supported deletion/replacement or operator cleanup removes it. Deleting an account does not erase its media. File deletion can leave metadata, request settings and deletion records. |
| Cached transformations | Cache lifetime controls reuse. Expired entries can remain physically stored until cleanup. |
| Temporary tool files | Processing paths attempt cleanup after work, including errors. A crash can leave files requiring operator cleanup. |
| Sessions | Server expiry limits access. A MongoDB TTL index is declared; physical removal depends on provisioning the index and database cleanup. |
| Support, inquiries, usage, commercial and audit records | These records do not have an automatic deletion schedule and are not erased by account closure. Contact us about a privacy request; applicable legal duties may require retention. |
| Backups and infrastructure logs | Backup and log handling depends on the deployment and applicable retention duties. Deleting an account or a file does not guarantee immediate removal from backups or infrastructure logs. |
Your choices and requests
You can manage available profile settings, revoke sessions and API keys, and use supported media-deletion controls in your account. You may also contact contact@imazeo.com to request access, correction or erasure, ask about processing, or raise a privacy concern. Use the subject “Privacy request” and identify the account involved. We may request proportionate identity verification before disclosing or changing account information.
Where applicable law provides rights to data portability, withdraw consent, object, restrict processing or complain to an authority, those rights are not limited by this notice. Their availability and any response deadlines depend on the law in force and the request. Withdrawing consent does not affect processing already lawfully carried out on that basis. Do not send identity documents unless specifically requested through an appropriate channel.
The current portal does not provide a complete personal-data export or permanent-erasure workflow. If your organization submits someone else’s personal information, they should normally contact that organization about its processing; Imazeo account and service-record questions can be sent directly to us. Where your use requires a data processing agreement or specific transfer or residency terms, agree these separately with us before submitting the relevant data.
Security and children
Application controls include password and API-key hashing, revocable sessions, project-scoped authorization, bounded image processing and secret redaction in logs. No service can promise absolute security. Keep your credentials private and report suspected exposure promptly.
Imazeo is intended for adults able to enter into a service agreement. Do not create an account if you are under 18. If you believe a child has supplied personal information through an account, contact us. Images of other people, including children, must only be submitted with a lawful basis and appropriate permissions.
Changes and contact
This notice takes effect on the date shown above. Updates will identify the revised date, with any additional notice required by applicable law. Send privacy questions, requests and complaints to contact@imazeo.com, addressed to Manish Balodia, Imazeo’s operator.