How we protect your personal data

Data controller

Controller: Valerio Lorenti - VAT 18140441009

Business name: Verifoto AI

Email: support@verifotoai.com

Office: Rome

You can contact the controller for any data-related request using the address above.

Legal bases for processing

We only process personal data when there is a valid legal basis under GDPR. The most common scenarios are listed below.

• Contract: to activate and deliver the Verifoto AI service you requested, including account creation and paid subscriptions.
• Consent: for optional communications and to store your preferences when you explicitly allow it.
• Legal obligation: to meet accounting, tax, or security requirements that require us to retain specific records.
• Legitimate interest: to prevent fraud, secure our infrastructure, and improve the reliability of the analysis models while respecting your rights.

Personal data we collect

We only collect the information needed to operate Verifoto AI and deliver accurate reports.

• Account email used to create and access your profile.
• Billing and contact details you share when activating a paid plan.
• Number of analyses completed and remaining credit balance.
• Minimal technical logs required for security and diagnostics.

Why we use your data

Every processing activity has a specific purpose that helps us run the service in a safe and compliant way.

• Authenticate you when you sign in to Verifoto AI.
• Protect your account security and monitor for misuse.
• Manage subscription payments when you choose a paid plan.
• Send service communications about support, incidents, or product updates you request.

Data processors

We rely on external providers that offer adequate security and GDPR compliance guarantees to handle certain service functions, including authentication and data storage in European infrastructures, and payment processing.

For image analysis we use proprietary artificial intelligence models. For generating textual explanations we may use third-party services, which receive only the data strictly necessary for processing, including the analysed image. Your data is never used to train third-party models.

All processing activities are carried out under contractual agreements that include Standard Contractual Clauses (SCC) or equivalent safeguards when required.

Data is used exclusively to deliver the requested service and is not retained by third-party providers beyond the time strictly necessary for processing.

Data retention

We collect only the data strictly necessary to run the service — no unnecessary data, no image storage.

Uploaded images are processed temporarily in memory during analysis and are not stored permanently in our systems. We keep only essential technical data over time, such as:

• Account email to manage your access.
• Number of analyses completed and remaining credits.
• Minimal technical logs for security and diagnostics (kept for a limited period, up to 30 days).

International transfers

Some processing activities may involve transfers of data outside the EU. In those cases, we work with providers that apply Standard Contractual Clauses (SCC) or equivalent safeguards to ensure an adequate level of protection.

Your rights under GDPR

You remain the owner of your personal data. GDPR grants you several rights that we fully respect.

• Rectification: correct inaccurate or incomplete details.
• Restriction and objection: limit certain processing activities when you have a legitimate reason.

• Right of accessRequest a copy of the information we hold about you at any time.
• Right to erasureAsk us to delete your account and associated data when allowed by law.
• Right to portabilityObtain your data in a structured, commonly used, and machine-readable format.

How to exercise your rights

Exercising your privacy rights is free of charge. We review every request and reply within one month.

• Send your request from the email associated with your Verifoto AI account so we can verify your identity.
• Tell us which right you want to exercise (for example, deletion of stored data or data access).

Complaints and supervisory authorities

If you believe that the processing of your personal data violates applicable law, you have the right to lodge a complaint with a competent supervisory authority.

Users under 16

Verifoto AI is not intended for individuals under 16 years of age. We do not knowingly collect data from minors and any such account will be deleted.

Cookies and tracking

Verifoto AI only uses cookies or local storage elements that are essential to keep you logged in and protect your sessions.

Analytics, marketing, or any other non-essential tracking tools are disabled until you give explicit consent.

Use by restaurant clients

When a restaurant uses Verifoto AI to analyse images related to its end customers, the restaurant acts as an independent data controller for those customers' data.

Verifoto AI acts as a data processor on behalf of the restaurant, limited to the technical operations required for the analysis. The restaurant is responsible for informing its customers and for having a valid legal basis for the processing.