Privacy Policy

Introduction

BackGone (backgone.com) is an AI-powered image background removal tool. This Privacy Policy explains what information we collect when you use the service, how we use it, and the choices you have. Because our product processes your images, this policy dedicates a full section to explaining exactly what happens to them.

If you have any questions, you can always reach us at support@backgone.com.

How We Process Your Images

This is the most important section of this policy for most users, so we state it plainly:

1. Transient processing only. When you upload an image, it is held in our server's memory only for the duration of the request. We do not write your uploaded images or the resulting images to any persistent storage — no database, no disk, no object storage bucket. Once the result is returned to you, the image data is gone from our servers.
2. Third-party AI provider. To remove backgrounds, the image is forwarded to Replicate (replicate.com), a third-party AI inference provider located in the United States, which runs the background removal model and returns the result. The result image is passed directly back to you; we do not retain a copy. Your use of the service therefore also involves processing by Replicate under their own terms and privacy practices.
3. Usage counters. We do keep a record of how many images you process — a per-day count (date and number of images) tied to your account or anonymous session. This counter is used solely to enforce plan quotas and free-tier limits. It contains no image content, filenames, or image metadata.
4. Feature-usage events. We also record feature-usage events — such as page visits, feature usage (for example choosing a background color or generating an ID photo), downloads, and purchases — tied to your account or an anonymous identifier. These events never contain image content, filenames, or other file metadata. We use them to improve the product and to analyze conversion (for example, understanding where visitors drop off before becoming paying users). When you arrive from a campaign link, the page-visit event also records that link's campaign source parameter (utm_source), so we can tell a launch spike apart from everyday traffic; no other parameter from that link is stored.

Because we do not store your images, we cannot recover a result you failed to download, and we cannot show you a history of your past images — this is a deliberate privacy choice, not a missing feature.

Information We Collect

Beyond the transient image processing described above, we collect:

1. Account information — When you register, we store your email address and a securely hashed password. If you sign in with Google or GitHub OAuth, we receive and store the basic profile data those providers share with us (typically your name, email address, and avatar URL).
2. Usage data — The daily image-processing counters and feature-usage events described above, plus standard request logs (IP address, timestamps, errors) used to operate, secure, and debug the service.
3. Payment data — Payments are processed by our Merchant-of-Record partners: Creem (creem.io) or Waffo Pancake (pancake.waffo.ai), depending on the payment method shown at checkout. The provider that processes a transaction collects your payment details and handles billing and taxes directly as Merchant of Record for that transaction. We never see or store your full card number; we only receive from the provider the information needed to activate your purchase (such as the product purchased, amount, and subscription status).
4. Cookies — We use strictly functional cookies only: a session cookie to keep you signed in, and a preference cookie to remember your language choice. See the Cookies section below.
5. Analytics — If enabled on our site, we use Google Analytics (GA4) to understand aggregate traffic and usage patterns. See the Analytics section below.

How We Use Your Information

We use the information we collect to:

• Provide the background removal service, including enforcing plan quotas and free-tier limits.
• Create and maintain your account, and authenticate you when you sign in.
• Process purchases, activate subscriptions and credit packs, and send transaction confirmations.
• Respond to your support requests and questions.
• Improve the product and analyze conversion, using the feature-usage events described above.
• Detect, prevent, and address fraud, abuse, and technical issues.

We do not sell your personal information, and we do not use your uploaded images to train models.

Cookies and browser storage

We use functional cookies and temporary browser storage only for the reasons below:

• Session cookie — keeps you signed in between page loads.
• Language preference cookie — remembers the interface language you selected.
• Campaign source cookie — if you arrive from a link containing a utm_source parameter, we remember that one value for 30 days so a visit (and a later signup) can be attributed to that campaign. It contains no identifier of its own.
• Email verification session storage — while an email address is being verified, this browser tab temporarily stores the address and resend-cooldown timestamp in sessionStorage so the code screen works across in-app navigation. Successful verification removes them; closing the tab clears the remaining session data. These values are not sent to Google Analytics.

We do not use advertising or cross-site tracking cookies. If Google Analytics is enabled, it sets its own cookies; you can block these with a browser extension or your browser settings without affecting the core service.

Analytics

Our site may use Google Analytics (GA4), a web analytics service provided by Google, to collect page views, approximate geographic region, device type, and conversion events for verified email signups, checkout starts, and completed purchases. Checkout and purchase events may include the product name, order reference, amount, and currency so we can measure conversion and revenue by traffic source. These events do not include your email address, account name, or uploaded images. Google processes this data under its own privacy policy. Analytics does not give Google access to the images you upload.

Data Sharing

We share personal data only with the service providers needed to operate BackGone, and only to the extent necessary:

• Replicate — receives the images you upload, in real time, solely to perform background removal.
• Resend — delivers account emails such as email-verification codes and password resets; receives your email address and the email content.
• Creem and Waffo Pancake — our Merchant-of-Record partners. The provider used for a given checkout processes that payment and handles sales tax on our behalf.
• Google — if Google Analytics is enabled, receives site-usage and conversion events, including checkout and purchase details described above; if you sign in with Google OAuth, Google handles that authentication.
• GitHub — only if you choose to sign in with GitHub OAuth.

We may also disclose information if required by law or to respond to lawful requests from public authorities, or to protect our rights, property, or safety and that of our users.

Data Retention

• Images: not retained — processed in memory and discarded immediately after the result is delivered.
• Account data: retained for as long as your account is active.
• Usage counters and logs: retained as long as needed for quota enforcement, security, and troubleshooting.
• Content reports and enforcement records: if you report content, or if an account or IP address is blocked for a violation, we keep the report correspondence and the enforcement record — the account or IP address, the category of violation, and our notes — for as long as the block is in force. These records never contain image content. See Report Abuse or Illegal Content.
• Payment records: retained by the relevant Merchant of Record (Creem or Waffo Pancake) as required for tax and accounting purposes.

Your Rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate information in your account.
• Export your account data.
• Delete your account and personal data — you can request full deletion at any time by emailing support@backgone.com. We will delete your account, profile data, and associated usage records, except where we must retain limited records for legal or accounting reasons (for example, payment records held by our Merchant-of-Record partners).

API and Business Customers

The same pipeline described above serves API calls. Alongside the image you send, we record per-call metadata: a key identifier, a timestamp, the model used, the status, the elapsed time and the credits charged. We keep that metadata for billing, debugging and abuse prevention.

Images sent through the API are processed only to return your result and are never used to train models. We do not keep submitted images as assets. A temporary result link returned by the inference provider may be retained briefly for debugging; such links expire on the provider's side.

Our inference provider, Replicate (United States), acts as a sub-processor for API calls exactly as it does for the website.

If your organisation needs a data processing agreement, a security summary, a retention schedule suitable for a procurement file, or the current sub-processor list, write to support@backgone.com and we will provide it.

Nothing here narrows the rights described under "Your Rights": API data belongs to the same account and is handled through the same channel.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the date at the top of this page and, where appropriate, by a notice within the service.

Contact Us

If you have questions about this Privacy Policy or want to exercise your rights, contact us at support@backgone.com.