Privacy Policy

Last updated: 2026-08-28

SendToSample ("we") serves users in the USA and UK. This policy describes how we process personal data. Template only — legal review required before launch.

Data we collect

• Account: email, name, profile image (via Google sign-in)
• Uploads: product photos you submit for generation
• Outputs: generated tech pack images
• Payment: processed by Stripe — we do not store card numbers
• Usage: generation counts, plan tier, country (if provided)

Why we process data (UK GDPR lawful bases)

• Contract — to provide the Service you signed up for
• Legitimate interest — fraud prevention, abuse limits, product improvement
• Legal obligation — tax and accounting records via Stripe

Sub-processors

• Vercel — hosting
• Supabase — database and file storage (Postgres + Storage only, not Supabase Auth)
• OpenRouter — AI vision and image generation (configure: prompt logging OFF)
• Stripe — payments
• Resend — magic-link email (if enabled)
• Google — OAuth sign-in

Retention

Uploaded images and generated outputs are deleted automatically after 30 days unless you export them locally. Account data is retained while your account is active.

International transfers

Data may be processed in the United States. UK users: we rely on appropriate safeguards (Standard Contractual Clauses where applicable) for transfers outside the UK/EEA.

Your rights

USA: state privacy laws may grant access/deletion rights (e.g. California CCPA/CPRA). UK/EU: access, rectification, erasure, restriction, portability, objection. Contact privacy@sendtosample.com.

Cookies

We use essential session cookies for authentication. Analytics cookies (if added) will require consent for UK users under PECR.