Privacy policy

What we collect

Account details. When you sign up we store the email address you sign in with and a user identifier. Sign-in is handled by Clerk; if you sign in with Google or another provider, we receive the name and email that provider shares with us. We do not see or store your password.

Photos you upload. Your photos are stored in Cloudflare R2 so that they can be analysed, shown to you in the review table and downloaded again with metadata written in. Before upload, each photo is resized in your browser; the resized copy is what is sent for analysis.

Metadata already in your files. If a file contains a title, caption or keywords, we read them and use them as context when generating new metadata.

Generated metadata. The titles, descriptions and keywords produced for your photos, along with any edits you make, folder names, settings such as preset or excluded keywords, and custom instructions.

Payment details. Subscriptions are billed by Stripe. Stripe collects and stores your card details; we never receive or store card numbers. We keep a record of your plan, the credits you have and your billing history.

Usage and technical data. Standard server logs (IP address, browser type, the pages and actions requested, timestamps) and error reports, used to keep the service running and to investigate abuse.

How we use it

We use this information to:

• generate titles, descriptions and keywords for the photos you upload;
• run your account, apply your credits and bill your subscription;
• send you transactional email, such as receipts and account notices;
• answer your support requests;
• keep the service secure, prevent abuse and fix problems.

We never use your photos or your generated metadata to train machine-learning models, and we do not sell or rent your data to anyone.

Who processes your data

We rely on a small number of service providers, each of which only receives what it needs for its part of the job:

• Clerk for sign-in and account management.
• Convex for our database and application backend.
• Cloudflare for photo storage (R2) and for serving the site.
• Stripe for payments and subscription billing.
• Resend for transactional email.
• MetaPhotoAI for image analysis. The resized copy of each photo is sent to the MetaPhotoAI engine to produce the metadata, under the same no-training commitment.

These providers may store data in the United States or other countries. When your data is transferred across borders we rely on the safeguards each provider offers, such as standard contractual clauses.

How long we keep it

Photos are deleted automatically 30 days after upload. You can delete a photo or a whole folder at any time before that, and it is removed from storage promptly.

Generated metadata and account data are kept while your account is active so you can export and re-export your work.

Billing records are kept for as long as tax and accounting law requires, typically seven years.

Logs are kept for a short period, usually no more than 90 days, unless we need a specific entry to investigate abuse or a security incident.

Deleting your data

You can delete photos and folders from inside the app at any time. To delete your whole account, including your generated metadata, email hello@keyworder.ai from the address on the account and we will remove it within 30 days, keeping only the billing records we are legally required to retain.

Depending on where you live you may also have rights to access, correct, export or restrict the use of your personal data, and to complain to a data-protection authority. Email us and we will help.

Cookies

We use only essential cookies: the ones Clerk needs to keep you signed in and the ones needed to protect forms from abuse. We do not use advertising cookies or third-party analytics trackers.

Security

Data is encrypted in transit, and our providers encrypt it at rest. Access to production systems is limited to the people who run the service. No system is perfectly secure, so if you believe your account has been compromised, tell us straight away.

Children

Keyworder is not aimed at children under 16, and we do not knowingly collect data from them.

Changes

If we change this policy in a way that matters, we will post the new version here with a new effective date and, for significant changes, email account holders before they take effect.

Contact

RSTJ Tools LLC, hello@keyworder.ai. This policy is governed by the laws of the State of Delaware, USA, as applicable.