Built to be trusted with other people’s photos.

Your customers’ photos

A photo reaches us for one purpose: to build the cutline preview and, if it becomes a real order, the production PDF. While your customer is still choosing a size, the preview engine processes the photo in memory and stores nothing.

Once a photo belongs to an order (through your hosted portal, or synced from your own webshop with a paid order), we store it so you can collect it, for at most 30 days. Then it is deleted automatically. The deletion is enforced by code that runs every night, not by a sentence in a policy.

Before any photo is stored, its embedded metadata is stripped: the GPS location and camera details that phones quietly attach. And no photo is ever used for AI training, marketing, analytics or demos, in any form, ever. The full detail per route is in our privacy notice.

Where data lives

Everything runs on EU-region infrastructure. The web application and the cutline engine run on our own servers at Hetzner in Falkenstein, Germany. The database and photo storage run on Supabase in Frankfurt, Germany, and data at rest stays in the EU. Every connection is encrypted in transit.

We are a Dutch company (Lifesizy is a trade name of CasMaster, Hoofddorp, the Netherlands), so the GDPR is our home turf rather than a foreign obligation.

Sub-processors

These are the vendors that may touch personal data when we work for you. The scope marker matters: only vendors marked “shop data” ever touch data we process on your behalf, and only those are sub-processors under the data processing agreement. The others touch only data of our own (our leads, our customer administration, our internal reporting).

We notify shops by e-mail at least 14 days before adding or replacing a vendor that touches shop data, and you may object on reasonable data-protection grounds.

What is deliberately not on this list: analytics or advertising vendors (the widget and portal are cookieless), and any AI service in the photo path. Customer photos are never sent to a model provider and never used for training, by us or by anyone else. To be precise about what that does and does not mean: the cutline itself is traced by a model, but it is our own, it runs inside our own container on our own servers in Germany, and it is nobody’s sub-processor because no third party is involved. The full explanation is in our privacy notice.

Sub-processor list last updated 4 August 2026.

The widget on your site

Our code runs on your storefront, so it is built as a guest, not an owner. The embed is cookieless: no analytics, no tracking pixels, no consent-banner obligation caused by us. It lives in an isolated shadow DOM, does not read or restyle the rest of your page, and loads from a pinned origin.

We do not quote an uptime percentage we have not earned yet. Instead the design assumes failure: if Lifesizy is ever unreachable, your product page keeps working, our WooCommerce plugin keeps selling on cached settings, and your checkout never waits for us. Paid orders placed just before or during an outage reach your dashboard once we are back (the plugin retries on its own for roughly two days, with a manual retry button after that). What does pause is new cutline previews, and with them new cutout orders: a customer cannot approve a cutline they cannot see, and we would rather say that plainly than promise a number.

Security practices

Honestly described: we hold no ISO 27001 or SOC 2 certification and do not claim one. What we do have is a security posture built for a system that accepts strangers’ uploads on other people’s websites:

• Uploads are validated on content, not just file extension, and size-capped before they can touch memory.
• Passwords are stored with a memory-hard hash; API keys are stored hashed and shown only once.
• Every endpoint that accepts input is rate-limited, against abuse and against cost attacks.
• Each shop’s data is partitioned per shop by construction. One shop can never read another shop’s orders or photos, and cross-tenant access attempts have been adversarially tested.
• Every release passes a security review with veto power, and we run red-team attacks against our own stack before strangers get the chance.
• No secrets live in our code repository.

If something goes wrong

If a personal data breach affects your data, we notify you without undue delay and at the latest within 48 hours of becoming aware, with what happened, what data was involved, and what we did. Your own 72-hour clock towards your supervisory authority starts when you become aware, which is exactly why we commit to well inside that window. We update the notice as facts firm up rather than waiting for a complete picture. Our incident runbook exists before our first customer, not after.

Paperwork

Everything your compliance file needs is public and written to be read:

• The data processing agreement (GDPR Art. 28). It applies automatically from the moment your account is activated; no signature chase. We countersign a copy on request for your records.
• The sub-processor list above, with a 14-day change notice.
• Our privacy notice and terms of service.

Software licences

Due diligence sometimes asks what our product is allowed to be built from. Short answers, verified against the code rather than assumed:

• The AI model that removes photo backgrounds is u2net, under the Apache 2.0 licence, loaded through the MIT-licensed rembg library. Both allow commercial use without payment.
• The model choice is fixed in code and guarded by an allow-list of models whose licences permit free commercial use, checked in our build pipeline. No setting, environment variable or incoming request can load a paid or unvetted model.
• Production PDFs embed no fonts: all production text is rendered to pixels at print resolution, so no font licence travels with your files.
• A full, dated licence overview of everything we run and ship, written for a lawyer to check without reading code, is available on request.

Questions?

We answer security and privacy questions from shops and their advisers at hello@lifesizy.com. Ask us the hard ones.