Privacy Policy

Effective date: October 4, 2026

This Privacy Policy explains how ShapeAny (we, us, or our) collects, uses, shares, and retains personal data when you use the ShapeAny website and product (the Service).

For product and privacy questions, contact support@shapeany.com.

1. Our role

ShapeAny is the independent controller of personal data used to operate product accounts, process uploaded images, generate Shapes and Bins, provide downloads, enforce usage limits, secure the Service, provide support, and understand basic product usage.

2. Personal data we collect

Account and authentication data

We collect your name, email address, email-verification status, profile image if supplied by an identity provider, account identifiers, authentication method, and security and session records. Passwords are processed through our authentication system and are not stored in plain text.

If you sign in with Google, Google supplies account information according to the permissions and privacy information shown during sign-in.

Uploaded and generated content

We process:

• photographs you upload;
• the original filename and technical information such as image dimensions and file size;
• paper calibration coordinates and dimensions;
• derived previews, rectified images, masks, contours, SVG data, thumbnails, Bin layouts, and generated download files; and
• Shape and Bin names, settings, creation dates, and update dates.

Your uploaded photograph and a rectified version are processed to detect the object boundary and create a Shape. A rectified image and job metadata are transmitted to our AI processing provider for this purpose.

Product and usage data

We collect plan and entitlement status, monthly usage-cycle dates, generation usage, Shape and Bin counts, processing-job status, feedback, feature events, and records needed to enforce plan limits and diagnose failures.

For basic visitor measurement, we derive a rotating daily pseudonymous value from the IP address and normalised browser user-agent. We store the resulting one-way daily hash and visit date, not the raw IP address or raw user-agent in the analytics table. For signed-in funnel measurement, we record limited feature-event names associated with the account.

Transaction data

We receive limited data from the checkout and payment services used for a purchase, such as the purchase email, product, transaction or order reference, amount, currency, payment status, refund or chargeback status, and timestamps. ShapeAny does not receive or store your full card number.

Communications and support

If you contact us, we collect your name, email address, message, and any information you include in the communication.

Technical and security data

Our systems and infrastructure providers may process IP address, request and response metadata, device and browser information, timestamps, error details, security events, and diagnostic logs to deliver and protect the Service.

3. How and why we use personal data

We use personal data to:

• create, authenticate, secure, and administer accounts;
• receive uploads, process images, generate outputs, and store user assets;
• provide downloads and save Shape and Bin settings;
• provide Free or Pro entitlements and enforce usage and storage limits;
• reconcile purchases, refunds, chargebacks, and access with checkout and payment services;
• send email verification, password reset, security, support, and other transactional messages;
• respond to questions, feedback, legal requests, and disputes;
• prevent abuse, fraud, unauthorised access, and security incidents;
• monitor reliability, diagnose errors, and improve core product flows;
• comply with legal, tax, accounting, consumer-protection, and law-enforcement obligations; and
• establish, exercise, or defend legal claims.

Where GDPR or similar law applies, our legal bases are performance of our contract with you, compliance with legal obligations, our legitimate interests in operating and securing the Service, and consent where the law requires it.

We do not use uploaded photographs to train a general-purpose AI model. We do not sell personal data. We do not use Resend Contacts or other mailing lists for marketing subscriptions in the current version of the Service.

4. Service providers and disclosures

We disclose only the data reasonably necessary for each provider's role:

We may also disclose data when required by law, to protect users or the Service, in connection with a corporate transaction, or at your direction.

5. International transfers

Our providers may process data in countries other than the country where you live. Where required, we rely on recognised transfer mechanisms, contractual safeguards, adequacy decisions, or another lawful basis for international transfers. You may contact us for more information about safeguards relevant to your data.

6. Retention and deletion

We keep personal data only for as long as reasonably necessary for the purposes described in this Policy, subject to these product-specific rules:

• A local browser copy used to carry a selected upload into the Shape editor expires after approximately 30 minutes and is removed after the handoff or expiry cleanup.
• Browser session caches may temporarily retain the current My Assets page, asset summaries, and scroll position until the browser session storage is cleared. A local preference may retain the selected Bin preview colour.
• Uploaded images and generated assets are generally retained while the corresponding asset remains available under your plan and account.
• Free Shapes and Bins within the applicable Free plan limits do not have a fixed time-based expiry while the account remains active.
• Deleting an individual Shape or Bin hides it immediately and schedules its stored files and database record for asynchronous permanent deletion.
• After Pro access is revoked, excess assets above the Free limit are locked and scheduled for deletion after 30 days unless valid Pro access is restored before deletion.
• Requesting account deletion disables the account immediately and begins a 7-day recovery period. If you do not restore the account during that period, assets are scheduled for permanent deletion and the account identity is deleted or anonymised after asset cleanup completes.
• Temporary processing artifacts are removed on an operational schedule; successful-job history is normally eligible for cleanup after 30 days and failed-job artifacts after 7 days, unless temporarily retained to complete or reconcile a job.
• Limited financial, entitlement, usage, fraud, security, and dispute records may be retained or anonymised for legal compliance, accounting, audit, enforcement, or defence of claims.

Deletion from active systems may take additional time where background cleanup is retrying a failed storage operation. Residual copies may remain in protected backups until those backups rotate, subject to access restrictions.

7. Security

We use reasonable technical and organisational safeguards designed to protect personal data, including access controls, authenticated asset access, private object storage, encrypted network transport, and separation of user assets. No system is completely secure, and we cannot guarantee absolute security.

8. Your rights

Depending on where you live, you may have rights to:

• request access to personal data;
• correct inaccurate data;
• request deletion;
• restrict or object to processing;
• receive portable data;
• withdraw consent where processing relies on consent; and
• complain to a competent data-protection authority.

To exercise a privacy right, email support@shapeany.com. We may need to verify your identity before completing a request. Some information may be retained where the law permits or requires it.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from a child who cannot lawfully consent to the relevant processing. If you believe a child has provided personal data improperly, contact us so we can investigate and delete it where appropriate.

10. Automated processing

The Service uses automated image processing to generate Shapes and automated security or fraud signals may be used by service providers. ShapeAny does not use automated decision-making that produces legal or similarly significant effects about users. Checkout and payment providers may independently use fraud and compliance systems as described in their privacy notices.

11. Changes to this Policy

We may update this Policy to reflect changes in the Service, providers, or law. We will update the date above and provide additional notice where a material change requires it.

12. Contact

ShapeAny

Email: support@shapeany.com