Privacy Policy.

Passport.AI (“the app”) is made by ALAZ Software (“ALAZ”, “we”, “us”), a software studio. ALAZ is the controller of the personal data processed through the app. You can reach us at hello@alaz.pro; our office addresses are listed on alaz.pro.

This policy explains what the app collects, why, who receives it, how long it is kept and what you can do about it. It covers the iOS and Android app. Our website has its own privacy policy.

Passport.AI turns a photo you take or choose into a passport, ID, visa or profile photo. Because that involves pictures of faces, this policy explains in detail what happens to them.

The face check runs on your phone. While you take or pick a photo, the app checks framing, head angle, eyes, lighting and sharpness on the device, with Apple's Vision framework on iOS and Google's ML Kit (bundled in the app) on Android. These measurements are not stored or sent anywhere, except the position of the face in the picture (a rectangle), which is sent with the photo so it can be framed correctly.

The photo you choose is uploaded to make your ID photo. A reduced copy (at most 1600 pixels on its longest side) is uploaded to our cloud storage and sent, with your chosen settings, to Google's Gemini image model, which generates the finished photo. The result is cropped to the document size and stored in your photo library in the app.

What is stored. For each photo: the uploaded source image, the generated photo, and its settings — document type, country and size, background, outfit, retouching and any text you typed to describe a background or clothing — plus the credits it cost and when it was made. Photos are reached only through private, hard-to-guess links that the app uses; we don't publish them.

What we never do with your photos. We don't use them to identify you, we don't create or keep a biometric template (a “faceprint”), we don't use them to train AI models, and we don't share them with anyone except the providers listed below, for the purpose of making your photo. Google processes the images under its paid Gemini API terms, which don't allow it to use them to improve its products; Google may keep requests for a limited time to detect abuse, as its terms describe.

On your phone. The app keeps a cached copy of your photos for fast access. Photos you save go to your photo library (album “Passport.AI”), and PDF print sheets to the app's files; those copies are yours and stay until you delete them.

Account. An account is needed to use the app, so your photos and credits are kept safe. We store your email address, display name (from Apple or Google, if they share it), sign-in method (email and password, Google or Apple) and when you joined and were last active. Passwords are handled by Firebase Authentication; we never see them.

Credits and purchases. Your credit balance and history (what each credit was earned or spent on), and your plan and its renewal status, through RevenueCat. Payment details stay with Apple or Google; we never receive card numbers.

Feedback. If you send feedback from the app: your message, topic, an optional screenshot, the related photo ID, your device model, app version and language.

Technical logs. Our servers log requests and errors (for example your account ID, a photo ID and an error message) to keep the service running and to refund failed generations.

Settings on your device. Language, theme, sounds, haptics and the country the app suggests from your device's region.

The app has no advertising and no analytics or tracking SDKs. Camera and photo library access are used only when you take, pick or save a photo.

• To make your photos: upload, generate, store and export them, and keep your library across devices.
• To run your account, plan and credits, and refund credits automatically when a generation fails.
• To keep the service secure and prevent fraud and abuse of credits.
• To answer your feedback and support requests and fix problems you report.

Where the GDPR, the UK GDPR or Türkiye's KVKK applies, we rely on these legal bases:

• Contract — to provide the service you asked for: processing your photos, your account, plan and credits, as described in the terms. Photos of faces are processed only to make the photo you requested; we don't use them for biometric identification.
• Explicit consent — where the law treats a face image as sensitive data, you give it by choosing to upload the photo; you can withdraw it at any time by deleting the photo or your account.
• Legitimate interests — to keep the service secure, prevent fraud and improve reliability. You can object at any time.
• Legal obligation — to keep purchase records required by tax and accounting law and to answer lawful requests.

• We don't sell or rent your personal data.
• We don't use it for advertising and we don't share it with data brokers.
• We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
• We don't use your photos for training AI models or for anything other than making your photo.

We use a few service providers to run the app. They process data on our behalf, under contracts that limit them to that purpose:

• Google Firebase / Google Cloud — sign-in (Authentication), database (Cloud Firestore), photo storage (Cloud Storage) and server functions (Cloud Functions) (Google LLC / Google Ireland Ltd.)
• Google Gemini API — generates the ID photo from your uploaded photo and settings (Google LLC)
• RevenueCat — manages subscriptions and plan status (RevenueCat, Inc., USA)
• Apple and Google — sign-in with Apple or Google, and payment for plans bought in the App Store or Google Play

Apart from them, we disclose data only when the law requires it (for example a valid court order), to protect our rights or users' safety, or to a successor if ALAZ or the app is sold or merged, in which case this policy keeps applying to your data.

Your account data, credit history and server functions are hosted by Google Cloud in the European Union (Belgium, europe-west1). Image generation by the Gemini API, Firebase Authentication and RevenueCat may process data in the United States and other countries where they operate. This may be outside the country where you live. When data leaves the European Economic Area, the United Kingdom, Switzerland or Türkiye, we rely on the safeguards the law provides, such as the European Commission's adequacy decisions (including the EU–US Data Privacy Framework for certified providers) and standard contractual clauses in our providers' data processing terms.

• Photos (source and generated): until you delete them, delete all photos, or delete your account. There is no automatic expiry, so your library stays available for re-downloads.
• Account, credits and history: until you delete your account.
• Purchase records: as long as tax and accounting law requires (Apple, Google and RevenueCat keep their own records under their policies).
• Feedback and screenshots: up to 24 months after we handle them.
• Server logs: up to 30 days.
• Copies on your device: until you delete them or the app.

Depending on where you live (for example under the GDPR, the UK GDPR, Türkiye's KVKK, Brazil's LGPD or US state privacy laws such as the CCPA), you can ask us to:

• tell you what data we hold about you and give you a copy;
• correct it, or delete it;
• export it in a portable format;
• restrict or object to how we use it, and withdraw any consent you gave.

In the app you can delete a single photo, delete all photos, and delete your account from Account › Profile › Delete my account (how). To get a copy of your data, email us and we'll send it.

For anything else, email hello@alaz.pro from the address on your account, with “Passport.AI” in the subject. We may need to confirm it's you. We answer within 30 days and don't charge for it. You can also complain to your local data protection authority (in Türkiye, the KVKK Authority at kvkk.gov.tr; in the UK, the ICO). California residents: we don't sell or share personal information as those terms are defined by the CCPA, and we won't treat you differently for using your rights.

Data travels over encrypted connections (TLS) and is encrypted at rest by our cloud providers. Access is limited by per-user rules, so one user can't read another's data, and only the people at ALAZ who need it for support or operations can reach it. Photos are stored in private storage that only your account can reach through the app. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.

The app isn't directed at children under 13 and they shouldn't create an account. Parents and guardians can use it to make an ID photo of their child. Only upload photos of yourself, of a child you are responsible for, or of someone who has agreed to it. If you believe a photo of you was uploaded without your consent, write to hello@alaz.pro and we'll remove it.

When we change how the app handles data, we update this page and the date at the top. If a change is significant, we also tell you in the app before it takes effect.

Questions about this policy or your data: hello@alaz.pro. Help with the app: Passport.AI support.