This policy explains what personal data Optaru collects, why we collect it, who we share it with, and what rights you have. We have tried to write it in plain language rather than legal padding.
1. Who is responsible for your data
Data controller: Optaru, operator of optaru.com
Email: info@optaru.com
Representative in the European Union (GDPR Article 27):
Our EU representative is currently being appointed. Until then, please contact us directly at info@optaru.com.
Representative in the United Kingdom (UK GDPR Article 27):
Our UK representative is currently being appointed. Until then, please contact us directly at info@optaru.com.
You may contact our representatives on any matter relating to the processing of your personal data.
We do not have a statutory Data Protection Officer. For any privacy question, write to info@optaru.com and it will reach the person responsible.
2. What we collect
2.1 Account data
- Your email address
- Your full name, if you provide it
- Your password — stored only as a cryptographic hash by our authentication provider. We never see or store your actual password.
- The date you created your account
2.2 Content you submit
- Product names, descriptions, and optional subtitles
- Optional scene notes describing the images you want
- Product photographs you upload
- Product page URLs you paste, and the publicly available text we extract from those pages
2.3 Content we generate for you
- Articles, titles, subtitles, SEO fields, and structured data
- The images we produce, stored in your library
2.4 Subscription and usage data
- Your current plan, your remaining product balance, and renewal or expiry dates
- Identifiers linking your account to your payment provider record
- Whether your account has administrative access
2.5 Payment data
We never see or store your card details. Payments are handled by Polar Software, Inc. as Merchant of Record, using its own payment processors. Polar collects your billing name, address, country, and payment method directly. We receive only a confirmation that a payment succeeded, along with the plan purchased and non-sensitive identifiers.
2.6 Technical data
- IP address and browser information contained in standard server logs kept by our hosting provider
- Error logs generated when something fails, which may contain a short excerpt of a request in order to diagnose the problem
We do not use advertising cookies, tracking pixels, cross-site trackers, or behavioural profiling. We do not sell personal data, and we do not share it for cross-context behavioural advertising.
3. Why we use it, and our legal basis
| What we do | Why | Legal basis (GDPR) |
|---|---|---|
| Create and maintain your account | To let you sign in and use the Service | Performance of a contract |
| Generate your articles and images | This is the Service you asked for | Performance of a contract |
| Store your library | So you can return to your content at any time | Performance of a contract |
| Track your product balance and plan | To apply the limits of the plan you bought | Performance of a contract |
| Process payments and tax | To sell to you lawfully | Contract and legal obligation |
| Send service emails (confirmation, password reset, billing notices, material changes) | To operate your account | Contract and legal obligation |
| Keep security and error logs | To keep the Service safe and working | Legitimate interests |
| Prevent abuse of free trials and fraud | To protect the business | Legitimate interests |
| Send optional product or marketing emails | To tell you about the product | Consent — you can withdraw it at any time |
Where we rely on legitimate interests, we have considered your rights and have concluded that our interest does not override them. You may object to this processing at any time (see Section 8).
4. Who we share it with
We use a small number of trusted providers to run Optaru. Each receives only what it needs.
| Provider | What it handles | Where |
|---|---|---|
| Supabase | Authentication, database (account, plan, library records) | United States |
| Cloudflare R2 | Storage of your generated images | United States / global network |
| Vercel | Website and application hosting, server logs | United States / global network |
| Anthropic | Generating your articles, titles, and SEO fields, and drafting image prompts | United States |
| OpenAI | Generating your images from the product photo you upload | United States |
| Polar Software, Inc. | Payments, invoicing, tax, and the customer billing portal, as Merchant of Record | United States |
| Microsoft 365 | Our business email, when you contact us | United States / EU |
Important, and a common question: our AI providers operate under business terms which state that content sent through their APIs is not used to train their models. Your product descriptions and photographs are used to produce your result and are not fed into model training.
We may also disclose data where we are legally required to, or where it is necessary to establish, exercise, or defend legal claims. If Optaru is ever sold or merged, your data may transfer to the acquirer, and we will tell you before that happens.
5. International transfers
Optaru is operated from outside the European Economic Area and the United Kingdom and our providers are located mainly in the United States. This means personal data of users in the EEA and the UK is transferred outside those regions.
Where such a transfer takes place, we rely on appropriate safeguards — principally the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Addendum, incorporated in our agreements with our providers, together with the technical measures described in Section 7.
You may request a copy of the relevant safeguards by writing to info@optaru.com.
6. How long we keep it
| Data | Retention |
|---|---|
| Account data | For as long as your account exists |
| Your library (content and images) | For as long as your account exists — including after a free trial ends or a paid plan is cancelled |
| Subscription and usage records | For as long as your account exists, and afterwards only where required for accounting or legal purposes |
| Payment and tax records | Held by Polar as Merchant of Record, for the period its own legal obligations require |
| Server and error logs | A short rolling period set by our hosting provider, typically measured in weeks |
When you delete your account, we delete your account data and your library, including your uploaded photographs and generated images. This is permanent and cannot be reversed. Residual copies may persist briefly in encrypted backups before being overwritten in the ordinary course.
7. How we protect it
- All traffic to and from the Site is encrypted in transit (HTTPS).
- Passwords are hashed, never stored in readable form.
- Database access is restricted at row level, so an authenticated user can reach only their own records.
- Administrative credentials are held server-side only and are never exposed to the browser.
- Access to production systems is limited to those who need it to operate the Service.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and inform you where the law requires it.
8. Your rights
If you are in the EEA or the UK, you have the right to:
- access the personal data we hold about you;
- correct data that is inaccurate or incomplete;
- erase your data ("right to be forgotten");
- restrict how we process it in certain circumstances;
- object to processing based on legitimate interests, and to direct marketing at any time;
- portability — receive your data in a structured, machine-readable format, or have it sent to another provider;
- withdraw consent at any time, where processing is based on consent, without affecting processing carried out before the withdrawal.
You also have the right to lodge a complaint with your local data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk).
How to exercise a right: email info@optaru.com from the address on your account. We respond within 30 days, and we do not charge for this. We may ask you to confirm your identity before acting on a request.
You can also delete your account yourself at any time from your settings, which erases your data as described in Section 6.
Residents of California and other US states
If you are a resident of a US state with a comprehensive privacy law, you have rights to know, delete, correct, and opt out of the sale or sharing of your personal data. We do not sell or share personal data, and we do not process sensitive personal data for inferring characteristics. We will not discriminate against you for exercising these rights. Contact us at the same address.
9. Cookies
Optaru uses a very small number of cookies, and none of them track you across other websites.
| Cookie | Purpose | Type |
|---|---|---|
| Authentication session | Keeps you signed in | Strictly necessary |
| Language preference | Remembers an interface language choice, used only by administrators | Functional |
Because we use only strictly necessary and functional cookies, and no advertising or analytics trackers, no consent banner is required. If we ever introduce analytics, we will update this policy and ask for consent first where the law requires it.
You can block or delete cookies in your browser, but the Service will not work without the authentication cookie.
10. Children
Optaru is a business tool and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, write to info@optaru.com and we will delete it promptly.
11. Automated decision-making
We do not make decisions that produce legal or similarly significant effects about you by purely automated means. AI is used to generate your content, not to evaluate you.
12. Changes to this policy
We may update this policy. For material changes we will notify you by email or in the app at least 14 days before they take effect, and we will update the date at the top of this page.
13. Contact
Privacy questions: info@optaru.com
EU representative: Our EU representative is currently being appointed. Until then, please contact us directly at info@optaru.com.
UK representative: Our UK representative is currently being appointed. Until then, please contact us directly at info@optaru.com.