Privacy Notice & Data Protection.

When you upload an image for background removal, vector generation, upscaling, or editing:

1. Encrypted Ingest: The file is transmitted via TLS 1.3 encrypted HTTP directly to our secure inference cluster.
2. In-Memory Processing: The image is decoded into volatile memory and processed by our neural network engines.
3. Immediate Purge: Once the transparent PNG or converted output is generated and returned to your client browser, both the source file and processed artifact are permanently purged from disk and RAM.
4. Automated Cleanup Daemon: An automated background cleanup daemon runs continuously to sweep and unlink any temporary cache entries older than 60 minutes.

We maintain zero historical galleries, image archives, or backup snapshots of your uploaded visual media.

We collect only the following categories of data:

• Account Information: When you register, we collect your name and email address. Passwords are never stored in plaintext; they are securely hashed using computationally intensive, salted scrypt key derivation.
• Credit & Transaction Metadata: We store your active token balance (Bronze, Silver, Gold tokens) and an immutable credit ledger of deductions and top-ups to guarantee transaction accuracy and process refunds.
• Payment Records: When you purchase tokens, transaction references (Razorpay Order ID, Payment ID) are retained for accounting compliance. We do not store or have access to your full credit card numbers, CVVs, or bank net banking credentials.
• Security & Rate Limiting Telemetry: We process IP addresses in an ephemeral rate-limiting buffer to block volumetric denial-of-service attacks, brute-force attempts, and automated abuse.

We deploy robust multi-layer technical defenses to secure our systems:

• Magic-Byte Validation: All file uploads undergo binary signature verification to reject disguised executable files, scripts, or malicious polyglots before memory processing.
• 30 MB Payload Capping: Strict gateway-level size limits reject oversized payloads with HTTP 413.
• Strict Content Security Policy (CSP): Prevents unauthorized script injections, enforces strict origin controls, and permits only approved payment gateway frames.
• Isolated Workspaces: File transformation occurs in temporary sandboxed workspaces with strict path-traversal prevention.

Regardless of your geographic location, bg.tools affords you comprehensive rights over your personal data:

• Right to Access: You may request an export of your account details and credit history.
• Right to Rectification: You may correct or update your profile information at any time.
• Right to Erasure ("Right to be Forgotten"): You may request the permanent deletion of your account and all associated records.
• Right to Restrict Processing: You may object to any non-essential data processing.

To exercise any of these rights, email our team at Support@bg.tools. We will process your verified request within 30 days without charge.