01The short version

Everything below is the long form of six sentences. If you read nothing else, read these.

Your photos are never used to train AI models. Not ours, not anyone else's. They are used to produce your edit and for nothing else.
Photos are deleted automatically. A photo you upload and the edit we return are removed from our storage within 30 days.
An AI provider does the editing, not us. Your photo is sent to OpenAI or xAI (Grok) to produce the result, under terms that forbid them training on it.
There is no account. Perfekt does not ask for your name, email or phone number to work.
We do not sell your data. There is no advertising network in Perfekt and no data broker behind it.
You can ask us to delete everything. One email, and we will.

02Who we are

Perfekt is built and operated by Onrois ("we", "us"), 707, Kyros Business Center, Sarathana, Surat, Gujarat, India. For the purposes of the Digital Personal Data Protection Act, 2023 and the GDPR, Onrois is the data fiduciary / controller for the personal data described in this policy.

Questions, requests and complaints all go to one place: [email protected].

03What we collect

Photos you choose to edit

When you apply a preset, the photo you selected is uploaded to our servers and passed to a third-party AI provider — currently OpenAI or xAI (Grok), depending on the preset — which produces the edit and returns it to us, and then to your device. Perfekt has no image model of its own; this hand-off is how the product works. Those providers may use the photo only to produce that edit: our agreements with them prohibit using it to train, fine-tune or improve their models. Section 05 names each provider and links to its own privacy policy, and section 06 covers how long anything is kept. Photos in your camera roll that you never select are never read, uploaded or scanned.

A device identifier and a support code

Perfekt works without a login. Instead, your install is given a random identifier, and a short support code shown on your profile tab. The code exists so you can quote it to us and we can find your edits and credits without asking for anything that identifies you personally.

Session and device information

Each time you open the app we record the platform (iOS or Android), the app version, and basic device details such as model and OS version. This is what tells us whether a bug is universal or specific to one phone.

Purchases and credits

If you buy credits or a subscription, our payment partner tells us that the purchase happened, what it was for, and when it expires. We never receive your card number, UPI ID or billing address — those stay with Apple, Google and their payment processors.

Diagnostics

We log errors and events — a failed edit, a timed-out request — so we can fix them. If you opt in to notifications, we also store a push token so we can tell you when a long edit is finished.

What we do not collect

No name, no email address, no phone number, no contacts, no precise location, no advertising identifier, and no browsing history from outside the app. This website is a separate matter — section 07 covers what it measures.

04Why we use it

To produce your edit. Without the photo there is no edit — this is the whole of the service.
To keep your credit balance honest. Purchases and edits are tallied so you are charged once for one edit.
To fix what breaks. Crash and error logs, tied to a device rather than a person.
To notify you, only if you allowed notifications, and only about your own edits.
To prevent abuse — automated scraping, credit fraud, or uploads that break our Terms.

Under the GDPR our legal bases are performance of a contract (delivering the edit you asked for), legitimate interests (security, abuse prevention, fixing bugs), and consent (notifications, which you can withdraw in your device settings at any time). Under the DPDP Act, processing rests on the consent you give when you choose a photo and tap a preset.

We never use your photos to train, fine-tune or evaluate an AI model, and we do not allow our providers to either.

05Who else touches your data

We do not sell personal data and we do not share it for advertising. We do rely on a small number of processors, each contractually bound to use the data only to provide their service to us:

OpenAI — receives the photo, returns the edit. Images sent through its API are not used to train OpenAI's models. See the OpenAI privacy policy and its API data usage policies.
xAI (Grok) — receives the photo, returns the edit, for the presets served by Grok's image models. Images sent through its API are not used to train xAI's models. See the xAI privacy policy.
Object storage and hosting providers — hold the image files and run the API that serves the app.
RevenueCat — records purchases and entitlements from the app stores (privacy policy).
Google Firebase — delivers push notifications and collects crash reports (privacy and security).
Apple and Google — process the payment itself under their own privacy policies (Apple, Google).

Which AI provider handles a given edit depends on the preset you chose, and we may change or add providers as the models improve. If we do, this list changes with them — and any new provider is held to the same two conditions: no training on your images, and no use of them for anything but returning your edit.

Some of these providers operate outside India and outside the EEA, so your data may be processed in other countries, including the United States. Where the GDPR applies, those transfers rely on Standard Contractual Clauses.

We will also disclose data where the law genuinely requires it — a valid court order or a binding legal demand — and we will tell you when we are permitted to.

06How long we keep things

Photos and edits — deleted from our storage within 30 days of the edit. Your own copy, saved to your camera roll, is yours and stays until you delete it.
Purchase and credit records — kept as long as the balance is live, then for as long as tax and accounting rules require.
Session and diagnostic logs — kept in a rolling window, typically no more than 12 months.
Your support code and device identifier — kept while the install exists, so your credits survive an app restart.

The AI provider that produced your edit also holds a copy while it works. Under the API terms linked in section 05, that copy is not used for training and is retained only briefly — in OpenAI's case, for up to 30 days for abuse monitoring — before it is deleted on their side. We cannot delete it for you sooner, but we can confirm it is subject to those terms.

07Cookies and website analytics

Everything above describes the Perfekt app. This section is about the website you are reading right now — perfekt.app — which is a separate thing with separate data.

The site runs Google Analytics 4 so we can see how many people arrive, which page they land on, and roughly where in the world they are. That is the whole of it. Google processes this on our behalf under its own privacy policy.

What analytics sees

The pages you viewed on this site and how long you stayed.
The site or search that sent you here.
An approximate location — country and region, derived from your IP address, which Google truncates rather than stores.
Your browser, operating system and screen size.

What it does not see

No name, no email address, no advertising profile, and nothing about where you go after you leave. We run no ad network and no remarketing tags, and the Google consent signals that would enable them are switched off permanently rather than merely unticked. Joining the waitlist sends your email address to our form provider and to nobody else — it is not passed to analytics.

The cookie notice, and who gets asked

If your browser reports a European timezone, analytics storage starts off and a notice asks you first. Decline and no analytics cookie is ever set — we still receive an anonymous, cookieless count of the visit, carrying no identifier that could link it to you or to any other visit. Accept and two cookies (_ga and _ga_*) are stored for up to two years so a return visit is not counted as a new person.

Elsewhere in the world the notice does not appear and those cookies are set when you arrive. We would rather say that plainly than imply a consent step that most visitors will never see.

Your answer is remembered in your own browser's local storage, not on our servers. Clearing this site's data resets it and we will ask again; blocking cookies or analytics at the browser level overrides all of the above, and the site works exactly the same either way. Nothing on this site is behind a tracking wall.

08Your rights

Wherever you live, you can ask us to show you what we hold about you, correct it, or delete it. Email [email protected] with your support code — that code is what lets us find your records without you having to prove an identity we never asked for.

If you are in the EEA or the UK, the GDPR also gives you the rights to restrict or object to processing, to receive your data in a portable format, to withdraw consent at any time without affecting past processing, and to complain to your local supervisory authority.

If you are in India, the DPDP Act gives you rights of access, correction, erasure, grievance redressal, and the right to nominate someone to exercise these rights on your behalf. Our grievance officer can be reached at the same address.

We answer requests within 30 days. There is no charge.

09Children

Perfekt is not intended for children under 13, and we do not knowingly collect data from them. In India, the DPDP Act requires verifiable consent from a parent or guardian before we process the data of anyone under 18.

If you believe a child has used Perfekt without that consent, write to us and we will delete the data.

10Security

Traffic between the app and our servers is encrypted in transit. Image files are stored on infrastructure with access limited to the small number of people who operate the service, and the automatic deletion in section 06 is the main protection: data we no longer hold cannot leak.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your data we will notify you and the relevant authority as the law requires.

11Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how we handle your photos, we will say so in the app before it takes effect — not quietly in a diff.

12Contact

Onrois, 707, Kyros Business Center, Sarathana, Surat, Gujarat, India
Email: [email protected]