Privacy policy

1. Who we are and what this policy covers

This policy covers the Finegrain website, iOS camera app, developer dashboard, web app, SDK, API and support channels. Finegrain is operated by Lagon Technologies SAS, 3 Rue Joliot-Curie, 91190 Gif-sur-Yvette, France, registered with the Evry Trade and Companies Registry under number 922 507 405. Contact hello@finegrain.ai.

We act as controller for account administration, our own service telemetry, billing, support and feedback. When we process photos through the API on a business customer’s instructions, we act as processor, or subprocessor where that customer is itself a processor. The data-processing terms govern that processing. If you use Finegrain inside another company’s app, its privacy notice also explains how it uses your data.

2. Camera app and on-device SDK

Photo transformations in the Finegrain camera app happen on your iPhone. Taking a photo does not send it to Finegrain, and your originals are preserved. The on-device SDK likewise performs its transformations on the device; an app developer may separately offer cloud or sharing features, which should be explained in that app.

Camera and photo-library permissions are controlled in your device settings. Backups or sharing services you enable separately, such as iCloud Photos, operate under their own settings and privacy information. Basic SDK telemetry is separate from photo processing, as described below.

3. Cloud API and web app

The API receives input photos and processing instructions, applies the requested transformation and returns outputs. The web app is a client of this same API and follows the same processing and input-retention rules. Cloud input photos are retained for a maximum of three days after processing, solely for debugging, and are then deleted. These services are not a photo archive: download and retain outputs you want to keep.

Photos may contain personal data, including identifiable people or information visible in documents. Only submit material you are entitled to process. Business customers determine the purposes and lawful basis for processing their users’ photos and provide the required information to them. We do not use inputs or outputs for model training or fine-tuning.

4. Reported photos and support

Human review for quality assessment is limited to material you choose to report or share through the mobile app, web app, email or customer-support Slack channels. We do not routinely review everyone’s cloud photos. Reporting can provide us with originals, outputs, your explanation and related technical information so we can investigate the issue and respond.

Copies deliberately submitted with a report are handled as support material, separately from the API’s three-day input buffer. They are used for the reported issue and quality assessment, not model training. Shared photos are stored on our European infrastructure; email and Slack providers may also process attachments you send through those channels. Avoid sending information unrelated to your request. You can withdraw consent to optional photo sharing or request deletion by contacting us; this does not affect earlier lawful processing.

5. Accounts, payments and technical data

For dashboard and developer accounts, we process the account details you provide, such as your name, email address and company, authentication information, plan and usage records, and billing details where applicable. Payment providers process payment information under their own privacy notices. We use account information to provide access, manage usage allowances and subscriptions, communicate service information and prevent misuse.

The SDK sends basic usage telemetry, including the transform used, framework or build version and platform. Technical access and error logs can include IP addresses, timestamps, request identifiers, user-agent information and response status. These records are not necessarily anonymous. Telemetry does not require uploading your photos. We use technical data to understand feature usage, diagnose faults, secure the services and maintain reliability.

This website’s page code does not add advertising trackers or analytics cookies. It uses session storage in your browser tab to remember campaign tags from the link you followed during your visit. These tags can accompany a waitlist signup or a link to our dashboard; they do not contain your photos. Hosting and access-control services may use technical logs and cookies necessary to serve and secure it. Dashboard authentication may also require essential storage. Where consent is required for non-essential tracking, it must be obtained before that tracking takes place.

Android availability updates

If you join the Android waitlist, we use your email address, with your consent, to let you know when Finegrain is available on Android. Brevo processes your email address, waitlist membership and, when present, campaign source, medium, campaign name and other campaign tags on our behalf. We also record which signup button you used to understand which outreach brings people to the waitlist. This signup does not subscribe you to unrelated marketing. You can withdraw your consent using the unsubscribe link in our emails or by contacting hello@finegrain.ai.

We keep your waitlist details while needed to provide the availability updates you requested, or until you withdraw your consent. We may retain a limited suppression record to respect your choice not to receive further emails.

6. TestFlight

Apple distributes the iOS beta through TestFlight and processes beta usage, crash and submitted feedback information. See Apple’s TestFlight privacy information. Information you send to Finegrain through beta feedback is handled for support and quality assessment under this policy.

7. Why we process personal data

• Providing services and managing accounts: performance of our contract with you, or our legitimate interest in administering a business customer’s account where you represent that customer.
• Optional photo reports: your consent to the submission and quality assessment; support correspondence is handled to answer your request and pursue our legitimate interest in helping users.
• Telemetry, reliability and security: our legitimate interests in operating, protecting and improving the services, subject to your rights and any consent required by law.
• Billing records, legal requests and compliance: applicable legal obligations; establishing or defending claims where necessary.
• Customer photo processing: the customer’s documented instructions and the legal basis it determines, where we act as processor.

8. Providers, locations and transfers

Cloud photo infrastructure is located in Europe: Google Cloud hosting in the Netherlands and AWS inference infrastructure in Spain. Shared photos held by Finegrain for quality assessment are also stored in Europe. Authorized personnel and service providers receive access only as needed for their responsibilities.

Other service data can be processed outside Europe. SDK telemetry and access logs use AWS US East (Northern Virginia). Operational providers include Postmark for transactional email, Sentry for error reporting and Slack for support and operational communications, which may process relevant data in the United States. UptimeRobot monitors service availability without customer photo content. This website is published through OpenAI Sites and served on Cloudflare infrastructure. Apple handles TestFlight under its own policies.

International transfers must comply with applicable data-protection requirements, including an applicable adequacy decision or appropriate contractual safeguards where required. Contact us for information about the safeguards applicable to your data and how to obtain a copy. We may disclose data where required by law or necessary to establish, exercise or defend legal claims.

9. How long we keep data

• On-device photos: remain under your control in the app and photo library.
• Cloud input photos: no more than three days after processing for debugging, then deleted; this applies equally to API and web-app requests.
• Photos submitted with reports: only for as long as needed to investigate and resolve the reported issue and assess its quality outcome. We review that need and delete the photos when it ends or following a valid deletion request, subject to legal obligations.
• Support correspondence: generally up to twelve months after the last interaction. Photo attachments follow the shorter, purpose-based rule above when no longer needed.
• Account records: during the account relationship, then only the records needed for legal obligations or claims, generally up to five years after it ends. Accounting documents are retained for the statutory period applicable to them. This does not extend photo retention.
• Telemetry and technical logs: only while needed for usage analysis, fault investigation or security. We assess continued necessity and delete or anonymize records when those purposes no longer require identifiable data.

Where a legal requirement or dispute requires longer retention, relevant records are restricted to that purpose. Independent providers such as Apple apply their own retention rules to data for which they are responsible.

10. Security and your rights

We apply technical and organizational safeguards appropriate to the nature of the data and risks, including access restrictions and confidentiality requirements. No system can guarantee absolute security.

Depending on the circumstances, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, or withdraw consent. Email hello@finegrain.ai. We may need proportionate information to verify your identity. Where we process data on another business’s behalf, direct your request to that business; we assist it with requests as required.

You may complain to the French supervisory authority, the CNIL, or your competent data-protection authority.

11. Updates

The date above identifies this version. We will provide an appropriate notice of material changes and request consent where required.