Privacy Policy

Last updated: July 23, 2026  ·  Operated by XDMEDIA, Netherlands

1. Who we are

PuffPix is a trade name of XDMEDIA, a business registered in the Netherlands (KvK nr. 54185904), hereinafter referred to as "we", "us", or "our". This policy explains what data we collect, why, and how we protect it.

2. Data we collect

• Email address — collected at checkout to deliver your API key and subscription receipts.
• Payment data — processed entirely by Stripe. We never see or store your card details.
• API key usage — we store a SHA-256 hash of your key, plan type, expiry date, daily usage count, and a device fingerprint hash (derived from browser user-agent + language). No personal data in these values.
• Uploaded images (compression tool) — files are compressed server-side and deleted automatically within 30 minutes. We do not inspect, analyse, or retain image content.
• Images processed by the background removal tool — the AI model runs entirely in your browser using WebAssembly. Your image is never sent to any server and never leaves your device.
• Server logs — standard web-server access logs (IP address, timestamp, request path) retained for up to 30 days for security and abuse prevention.
• Trial account data — if you request a free trial, we store your email address, the date of the request, and a compression-credit counter. Trial accounts are valid for 30 days from sign-up or until the 100 credits are exhausted, whichever comes first.
• Referral data — if you share your referral link and someone signs up or subscribes through it, we store a short anonymous referral code (linked to your account) and a reference to the code on the new account. This is used solely to award referral bonuses (extra credits or subscription days). No personal data about the referred person is shared with the referrer beyond the bonus being applied.
• Anonymous compression statistics — when you compress an image (including via the WordPress plugin), we record the file extension, compression engine, quality setting, bits-per-pixel range (a bucketed size category), and the resulting compression ratio. No image content, filename, IP address, or API key is associated with these values. They are used solely to improve our size-estimate feature.
• Newsletter opt-in — if you voluntarily subscribe to our newsletter, we store your email address and the plan you held at the time of sign-up. You can unsubscribe at any time via the link in each email.

3. Cookies and local storage

We use the following cookies:

• pp_consent — records your cookie-consent choice. Expires after 365 days. No personal data.
• PHPSESSID — standard PHP session cookie that isolates your uploaded files on the server. Contains only a random ID. Deleted when your browser session ends.
• _ga, _ga_* — Google Analytics cookies, set only if you accept analytics. See section 5.

The background removal tool uses your browser's Cache Storage API to store the AI model file (~5–176 MB depending on selected engine) after the first download. This data is stored entirely on your device and is never accessible to us. You can clear it at any time via your browser's site data settings.

We also use browser localStorage (not cookies) to store your tool preferences locally on your device. This includes your last-used compression settings, your API key (if entered), your active plan type, and UI preferences such as tab and threshold values. This data never leaves your device and is not accessible to us.

You can withdraw your analytics consent at any time by clearing your browser cookies or using the Google Analytics opt-out add-on. Deleting the pp_consent cookie will cause the consent banner to reappear on your next visit.

4. What we do NOT collect

• We do not create user accounts or profiles.
• We do not use tracking pixels, behavioural advertising, or sell data to third parties.
• Compression statistics are fully anonymous — no email, IP, or key is attached to them.

5. Legal basis (GDPR)

We process your email address on the basis of contract performance (Art. 6(1)(b) GDPR) — to fulfil your subscription or trial. Newsletter emails are sent on the basis of your consent (Art. 6(1)(a)). Server logs and anonymous compression statistics are processed on the basis of legitimate interests (Art. 6(1)(f)) for security and service improvement. Device fingerprint hashes are processed on the basis of our legitimate interests to prevent API abuse.

6. Third-party processors

• Stripe (stripe.com) — payment processing. Data may be stored in the US under Stripe's EU–US Data Privacy Framework certification.
• Brevo / Sendinblue (brevo.com) — transactional email delivery (API keys, receipts) and, if you opt in to our newsletter, marketing email delivery. Your email address is shared with Brevo only for these purposes and is stored in Brevo's EU data centres.
• Hugging Face (huggingface.co) — when you use the background removal tool, the AI model file is downloaded directly from Hugging Face's CDN to your browser. Your IP address and browser details may be visible to Hugging Face as part of a normal CDN request. No image data is sent to Hugging Face. See Hugging Face's privacy policy.
• Google Analytics (google.com/analytics) — loaded only if you accept cookies. Uses Consent Mode v2: defaults to denied, collects no cookies until consent is granted. Collects anonymised page-view and session data (IP addresses are anonymised). Cookies: _ga, _ga_*, up to 2 years. Data may be stored in the US under Google's EU–US Data Privacy Framework certification.
• jsDelivr CDN (jsdelivr.net) — when you use the free browser tools (SVG optimizer, image converter, etc.), open-source libraries are loaded from jsDelivr's CDN. Your IP address may be visible to jsDelivr as part of a normal CDN request. No image data is sent to jsDelivr. See jsDelivr's privacy policy.

7. Data retention

• Your email and subscription record are kept for as long as your subscription is active, plus 2 years for accounting and legal purposes.
• Trial accounts: email and usage data deleted 90 days after all credits are exhausted or the account is otherwise deactivated.
• Newsletter opt-in: email retained until you unsubscribe. You can also request deletion at [email protected].
• Anonymous compression statistics: retained indefinitely (no personal data).
• Uploaded images: deleted within 30 minutes.
• Server logs: deleted after 30 days.

8. Your rights

Under the GDPR you have the right to access, rectify, or erase your personal data, and to object to or restrict processing. To exercise these rights, email us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch data protection authority (Autoriteit Persoonsgegevens).

9. Security

All data is transmitted over HTTPS/TLS. API keys are stored as SHA-256 hashes — we cannot recover your raw key. Payment data never touches our servers.

10. Changes to this policy

We may update this policy from time to time. The current version is always at puffpix.com/privacy.php. Material changes will be notified by email to active subscribers.

11. Contact

XDMEDIA (PuffPix)  ·  Netherlands  ·  [email protected]

← Back to PuffPix