GDPR

The short version

This supplements our Privacy Policy, which covers the same processing in general terms.

Who the controller is

Useful Tool Ai is the data controller for the personal data described here. Reach our privacy contact through the contact form.

Given how little personal data we process, and that we neither monitor individuals nor handle special category data at scale, we are not required to appoint a Data Protection Officer under Article 37. The form above reaches the people responsible for these decisions.

What we process

The complete list, with nothing omitted:

• Contact form submissions — the name, email, subject and message you type, plus the sending IP address and time.
• Server and error logs — IP address, browser and operating system, page requested, date and time, recorded automatically.

We do not process the images, videos or files you open in the tools. Your own browser reads and transforms them on your own device; no copy is ever transmitted to us. There is no upload endpoint to send them to.

Legal bases

• Article 6(1)(a) — consent. You decide to send the contact form. Withdraw any time by asking us to delete the message; withdrawal does not affect the lawfulness of processing before it.
• Article 6(1)(f) — legitimate interests. Keeping the site available and secure, rate-limiting and blocking abuse, diagnosing faults. Weighed against your rights, with data restricted to what is necessary.
• Article 6(1)(c) — legal obligation. Where law requires us to retain or disclose information.

Your rights

Under the GDPR and UK GDPR you have the right to:

• Access (Art. 15) — confirmation of whether we process your data, and a copy.
• Rectification (Art. 16) — correction of inaccurate or incomplete data.
• Erasure (Art. 17) — deletion, the "right to be forgotten".
• Restriction (Art. 18) — pause our use while a dispute is resolved.
• Portability (Art. 20) — receive your data in a machine-readable format, or have it sent to another controller.
• Objection (Art. 21) — object to processing based on legitimate interests, and to direct marketing, which we do not carry out.
• Withdraw consent (Art. 7(3)) — at any time.
• Complain (Art. 77) — to a supervisory authority, as below.

How to exercise them

Use the contact form with the subject "Privacy question" and tell us which right you want to use.

• We reply within 30 days. For unusually complex requests we may extend by up to two further months, telling you why within the first month.
• Requests are free. We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive — and we will explain why.
• We may ask you to confirm the email address the request concerns. As we hold no accounts, that address is usually the only way to link a request to the data, and verifying it stops us disclosing one person's message to another.
• Exercising a right never changes how you may use the service.

Retention periods

• Contact messages — while your enquiry is handled, then up to 24 months, then deleted. Earlier on request.
• Server and error logs — normally no more than 12 months.
• Images and files — no retention period exists, because we never receive them.

Processors we rely on

A deliberately short list, each bound by a data processing agreement meeting Article 28:

• Our hosting provider — operates the servers and holds the contact messages database.
• Our email provider — transmits our replies to you.

The public host of the AI model files is not our processor: your browser requests those files directly, and that host acts as an independent controller of the request data it receives. It receives no images and no contact data.

We do not sell personal data or share it with advertisers or data brokers.

International transfers

Our providers may store or process data outside the EEA, UK or Switzerland. Where they do, we rely on a mechanism recognised under Chapter V — an adequacy decision, or Standard Contractual Clauses with the UK International Data Transfer Addendum where the UK GDPR applies — supported by appropriate technical and organisational safeguards. You can ask which mechanism applies to a specific transfer.

Automated decision-making

We carry out no automated decision-making producing legal or similarly significant effects, and we do not profile you, within the meaning of Article 22. The AI model decides about pixels, on your device, never about people.

Data breaches

If a personal data breach is likely to risk your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it under Article 33, and inform affected individuals without undue delay where Article 34 requires it.

Because your images never reach our infrastructure, any breach on our side is limited to contact form submissions and server logs.

Complaints

Please raise concerns with us first — most are settled in a single exchange. You also have the right to complain to a supervisory authority, in particular in the EU or EEA state where you live or work, or where the alleged infringement took place. In the UK this is the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner.

Contact us

For any data protection matter, use our contact form and choose the subject "Privacy question".

See also the Privacy Policy and Cookie Policy.