Privacy policy

3.1 Controller

Legal name

QUICKAIHEADSHOTS LTD

Company number

16279803

Jurisdiction

England and Wales

Registered address

128 City Road, London, United Kingdom, EC1V 2NX

Trading name

BackdropZap

Website

https://backdropzap.com

Contact

hello@backdropzap.com · support@backdropzap.com is an alias.

For privacy requests, contact hello@backdropzap.com.

3.2 Data we process and why

• Account data: email address, a password hash held by our authentication provider, verification status, credits, purchases and API-key hashes, to provide the service. The full API key is shown only when you create it.
• Request records: request and provider identifiers, timestamps, status, dimensions, credit use, the engine used, latency and provider costs, for service operation and billing. These database records do not contain image contents.
• Keyed IP hashes and a visitor cookie: for abuse prevention, trial admission and free-preview quotas. IP hashes are kept for no more than 30 days. They are security identifiers, not a guarantee that records are anonymous.
• Server logs: for security and troubleshooting. We do not put image bytes in application logs. Hosting providers may keep connection and access logs.
• Support emails: to answer your questions and requests.
• Purchase-opening notifications: your email, consent version, signup source and timestamps, when you explicitly ask to be notified. Only the service owner can read the list through authorized access; backend services store your request. Joining creates no account or subscription and sends no email immediately. It is consent to the purchase-opening notice, not unrelated marketing. You can withdraw or request deletion by emailing hello@backdropzap.com.

3.3 Images

Background removal uploads images to our servers and sends them to fal.ai solely to produce the requested result. Guest previews require Cloudflare Turnstile verification; signed-in editor uploads automatically use full-resolution cloud processing. We request that fal.ai disables request and response payload storage and applies a five-minute lifecycle to provider-hosted output objects. These are provider settings, separate from deletion in our own storage.

Temporary uploaded images and processing results are deleted automatically from our systems within three hours. Images you deliberately save in your signed-in workspace are kept until you delete them. API results are returned directly in the response and are not automatically saved to your workspace; API inputs still use temporary processing storage.

We do not run a background-removal model on your device or offer on-device fallback. Importing an image URL connects to the website you enter. Downloaded copies on your device are under your control. BackdropZap never uses your images to train models.

3.4 Service providers

Providers process data for the features you use. Payment, sender and support-mailbox providers receive data only when their corresponding service is enabled.

3.5 Legal bases

Under the UK and EU GDPR, our legal bases are contract, legitimate interests in abuse prevention and security, legal obligations such as tax records handled through Paddle, and consent where required. The purchase-opening notification list is based on your consent. Non-essential cookies would also require consent.

3.6 Your rights

Under the UK and EU GDPR, your rights include access, correction, deletion, portability, objection, restriction and withdrawal of consent. You may complain to a supervisory authority, including the UK Information Commissioner’s Office.

Send requests to hello@backdropzap.com. We answer within 30 days, or sooner where applicable law requires. You can request account deletion from your dashboard. Completion follows cancellation of any active subscription, settlement of processing already underway and deletion of stored images.

3.7 Retention

• Account information is kept while your account exists. Following account deletion, only minimal billing and administrative audit records and a deletion receipt are retained for up to 12 months. The retained records exclude image contents and paths, email addresses, IP hashes and API-key hashes.
• Request records are normally removed by scheduled retention jobs after 24 months, or earlier during account deletion. Records still needed to settle a processing charge or refund are kept until reconciliation completes.
• Keyed IP hashes are erased or pruned within 30 days. The necessary visitor cookie expires after 30 days unless renewed following successful free-preview security verification.
• Temporary and saved images are handled as described in section 3.3.
• Purchase-opening notification details are kept for the requested notice. You can withdraw your request and ask for deletion at any time.

3.8 International transfers

Data may be processed in the EU, UK and USA by the providers above. Our support mailbox provider, Lark, may also store support emails in Japan or Singapore. Where required, international transfers must use applicable contractual safeguards, such as standard contractual clauses.

3.9 Children

The service is not intended for users under 16.

3.10 Sale of data and advertising

We do not sell personal data or use advertising trackers at this time. If analytics or advertising cookies are added, we will update our policies and provide a consent banner. See the Cookie policy for current browser storage.

3.11 Security

We use encryption in transit, restricted access and audit logs for administrative actions. Authorized administrators can manage accounts, credits and processing controls; administrative actions are audited.

3.12 Changes and contact

Changes to this policy will be reflected in its “Last updated” date and version. For questions about privacy, contact hello@backdropzap.com. support@backdropzap.com is an alias.