Privacy Policy
Last updated: 22 July 2026
At Imagokit we take your privacy very seriously. This policy explains how we process your personal data, including your photograph, which constitutes special-category biometric data, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
- Service controller: Zemobile LLC, a company of the State of Delaware (United States), with registered office at 2810 North Church Street, Wilmington, DE 19802, United States. It is the entity responsible for the data processed to provide the service, the contract and the charge.
- Marketing and advertising activity: Elite Media Applications, S.L. (Avda. Josep Tarradellas 38, 08029 Barcelona, Spain, Tax ID (NIF) B67444869).
- Contact and exercise of rights: privacidad@imagokit.com
2. Data we process, purpose and legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Photograph of the face (original and processed) — special-category biometric data (Art. 9 GDPR) | Generate and verify the document photograph | Explicit consent (Art. 9.2.a) + performance of the contract |
| Email address | Delivery, account and transactional communications | Performance of the contract |
| Holder's name | Billing, fraud prevention and personalisation | Performance of the contract |
| IP address | Security and abuse prevention | Legitimate interest |
| Referrer URL, gclid and UTM parameters | Marketing attribution (captured server-side, not by cookie) | Legitimate interest |
| Preferred language and currency | Usage preferences | Legitimate interest / preferences |
| Payment identifiers (Stripe) | Charging and subscription | Performance of the contract |
| Expiry schedule (document and date) | Reminders scheduled by the User themselves | Consent |
Card details never pass through our servers: they are collected and stored directly by Stripe; we only keep the provider's identifiers or tokens.
3. Processing of your photograph (biometric data)
Your photograph is special-category biometric data. We process it solely to generate the image and automatically verify that it meets the requirements of the selected document, on the basis of your explicit consent (Art. 9.2.a GDPR), which is obtained unambiguously before processing, and of the performance of the contract. For verification, the image is sent to our artificial-intelligence provider (OpenAI, in the USA), which entails an international transfer of biometric data with the safeguards described below.
4. Automated decisions
The compliance verification of the photograph is automated and may have a significant effect on you (for example, a rejection requiring you to retake the photo). We inform you of the existence of this automated processing and of your right to obtain human intervention, to express your point of view and to contest the decision, in accordance with Articles 13 to 15 and 22 of the GDPR. The optional compliance review, when purchased, is carried out by an expert (human review) and therefore does not constitute an automated decision.
5. Processors and recipients
To provide the service we use suppliers that process data on our behalf, under the corresponding data-processing agreement:
| Provider | Purpose | Location |
|---|---|---|
| Stripe | Payments and subscriptions (card details, email, name, amount) | USA / EU |
| OpenAI | Photo verification using AI (receives the image of the face — biometric data) | USA |
| Supabase | Database and storage of the photos (private bucket) | EU / USA |
| Make (Integromat) | Email orchestration (email, name and content) | EU |
| Google Workspace / Gmail | Sending transactional emails | USA / EU |
| Vercel | Website hosting (traffic, logs, IP) | USA / EU |
| Railway | Payments backend (order/payment data in transit) | USA / EU |
Advertising and analytics: when activated, Google Ads and Google Analytics 4, Meta Ads and Microsoft Ads will act as advertising recipients/processors (in the USA), only with your consent. Their activation will involve the creation of advertising profiles and remarketing, which you may object to.
6. International transfers
Some processing takes place in the USA (at least OpenAI and Stripe) and, when advertising is activated, Google, Meta and Microsoft. These transfers are covered by the Data Privacy Framework (where the provider is certified) and/or by Standard Contractual Clauses (SCCs) with supplementary measures. Particular attention is paid to OpenAI as it involves biometric data.
7. Retention and deletion
Photographs from orders without an active subscription are automatically deleted after 30 days (file and record), after which the download link stops working; subscribers keep them for the duration of the subscription. The remaining data is retained for the duration of the relationship and, thereafter, for the applicable legal periods in accordance with commercial and tax law.
8. Security
We apply appropriate technical and organisational measures: private storage with temporary signed links, access to each order by means of a high-entropy token, password-free account access (magic link) with session verification and row-level access rules, and limiting access to strictly necessary staff and providers.
9. Your rights
You may exercise your rights of access, rectification, erasure, restriction, portability and objection, and withdraw your consent at any time, by writing to privacidad@imagokit.com. Deleting your photograph is straightforward (erasure of the file and the record). If you reside in the EU, you may lodge a complaint with the supervisory authority; in Spain, the Spanish Data Protection Agency (AEPD), www.aepd.es.
10. Minors
The service may be used for photographs of minors (for example, children's passports). In that case, processing the minor's image —biometric data— requires the consent of their parents or guardians (Art. 8 GDPR; digital age of consent in Spain: 14 years) and is surrounded by reinforced safeguards. By providing a minor's photograph, the User declares that they are the parent or guardian or that they have sufficient authorisation.
11. Advertising, profiling and communications
When advertising is activated, we may create profiles for measurement and remarketing purposes through the platforms indicated, always with your prior consent managed from the cookie banner, and you may object to or withdraw it at any time. The sending of commercial communications by email, where applicable, requires separate consent and you may unsubscribe at any time.
12. Changes to the policy
We may update this policy to adapt it to regulatory or service changes, publishing the current version with its update date.