Privacy policy

This policy explains what personal data Free Alt Text Generator processes, why, how long we keep it and what your rights are. In short: we don't store your images, we keep as little data as we need to run the service and prevent abuse, and we don't use tracking or advertising cookies.

Who is responsible

The data controller is Dean Donovan, eenmanszaak (sole proprietorship), trading as Free Alt Text Generator, Hoofdweg 1323, 2151 MA Nieuw-Vennep, Netherlands, KvK 81088957. For anything about your data, email support@free-alt-text-generator.com.

What we process and why

Your images

Your browser shrinks each image and sends it to our server, which passes it to OpenAI to generate the alt text. We don't store your images: they are only held in memory while the alt text is generated. OpenAI processes them on our behalf. According to OpenAI's API data policy, it doesn't use this data to train its models, and may keep it for up to 30 days to detect abuse before deleting it.

If you reach the daily free limit and sign up, the images you dropped are temporarily saved in your own browser (not on our servers) so you don't have to upload them again. They are removed once you're back, or after 24 hours.

Your account

Your email address, a securely hashed password, and when you signed up and last logged in. We need this to give you an account and keep it secure (performance of a contract).

Credits and payments

Your credit balance and a history of credits added and used, for example "1 credit used for a generation". When you buy credits, Stripe handles the payment: we never see your full card details. We receive what we need for our administration and tax obligations, such as your name, country, the amount and the VAT charged (performance of a contract and legal obligation).

Daily free limit and abuse prevention

To enforce the daily free images and stop people from overusing the service, we keep a daily count per:

• your IP address, stored only as a one-way hash (we never store the IP address itself),
• a random browser ID stored in a cookie, and
• your account, if you're logged in.

These counts are deleted after 7 days. Short-lived per-minute counters for rate limiting are deleted after an hour. The legal basis is our legitimate interest in preventing abuse and keeping the free tier sustainable.

Bot protection

When you generate images without an account, we use Cloudflare Turnstile to check that you're a person and not a bot. Turnstile runs in your browser and Cloudflare processes technical information about your browser and connection, such as your IP address, to make that check. The legal basis is our legitimate interest in protecting the service against automated abuse.

Usage and cost records

For each generation we record when it happened, whether it was paid with a credit or a free image, which AI model was used and how much processing it took. If you're logged in, this is linked to your account. We use it to understand costs and fix problems (legitimate interest). If you delete your account, these records are kept without a link to you.

Technical logs

To find and fix problems (for example a generation that failed, or a refund that didn't go through), our server records technical events in our own logging service, Loglet. These logs contain IDs rather than personal details: your account ID if you're logged in, the ID of a generation, or a short code derived from the hashed browser ID if you're not. They never contain your images, the alt text, your email address or your IP address. Logs are deleted after 90 days (legitimate interest in keeping the service working).

Terms you accepted

When you create an account, we record which version of our terms you agreed to and when, so we can show it later if needed (legitimate interest and legal obligation).

Emails

We send emails needed to run your account, such as the confirmation email, password resets and important changes to the service or prices. We don't send marketing emails without your permission.

Who processes your data for us

These providers only process data on our instructions. Where data goes outside the EU, it is protected by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We don't sell your data.

How long we keep it

• Images: not stored (in your own browser for at most 24 hours, as described above).
• Account and credit data: as long as you have an account.
• Payment and invoice records: 7 years, because Dutch tax law requires it.
• Free-limit counts: 7 days. Rate-limit counters: 1 hour.
• Technical logs: 90 days.
• The record of which terms you accepted: as long as you have an account.
• Usage and cost records: kept for our administration; no longer linked to you after you delete your account.

Cookies

We only use cookies that are needed for the service to work, so we don't ask for consent. We don't use analytics, advertising or tracking cookies. If we ever add those, we'll ask for your consent first.

Your rights

Under the GDPR you can ask us to:

• give you a copy of your data, or send it to you in a machine-readable format;
• correct data that is wrong;
• delete your data and account;
• limit how we use your data, or object to processing based on our legitimate interest.

Email support@free-alt-text-generator.com from the address of your account. We'll respond within one month. If you're not happy with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the data protection authority in your country.

Changes

We may update this policy. The date at the top shows when it last changed. For important changes we'll let account holders know by email. See also our terms of service.