Privacy Policy

1. Who we are

AutoShot is operated by Hristo Lilkin, sole trader, based in Bulgaria. For data protection purposes, Hristo Lilkin is the "controller" of your personal data.

Contact: hristo@autoshotapp.com

If AutoShot is later incorporated as a company, this policy will be updated and the new entity will become the data controller; you will be notified of any such change.

2. What personal data we collect

Account data: your email address, password (stored as a salted hash by our authentication provider, Supabase — we never see or store your plain-text password), and your chosen interface language.

Uploaded images:

• Car photos are held privately while processing, and originals are deleted after processing. Abandoned uploads are removed by the daily cleanup. Finished results are normally removed by the daily cleanup after 7 days. If you report a problem with a result, that result is retained while the report is unresolved so we can investigate, then becomes eligible for the normal cleanup. Job records do not contain the original image.
• If you upload your logo, that image is stored in our database/storage (Supabase) and used only to add it to your future photos, until you remove it or delete your account.

Payment data: if you purchase credits, payment is handled entirely by Stripe. We receive only confirmation that a payment succeeded and a payment reference — we never see or store your card details.

Telegram bot data: if you link your Telegram account, we store your Telegram chat ID and username so the bot can identify you and apply your credit balance, background, and language preferences. Photos and messages sent to the bot are processed the same way as uploads through the web app.

Technical & usage data: your IP address and basic diagnostic information collected automatically by our error-tracking tool (Sentry) when something goes wrong, and anonymous, aggregated usage statistics collected by Vercel Analytics, which does not use cookies and cannot identify you individually.

3. Why we use your data and our legal basis

• To create and manage your account, process your images, and operate the credit and billing system — necessary to perform our contract with you (Art. 6(1)(b) GDPR).
• To detect, prevent, and fix errors and abuse, and to keep the Service secure and working — our legitimate interest (Art. 6(1)(f) GDPR).
• To comply with legal obligations, such as keeping records of payments for tax purposes (Art. 6(1)(c) GDPR).

4. Who we share your data with

We use the following service providers ("processors") to operate AutoShot. Each receives only the data needed for its specific function, under its own terms and privacy policy:

• Supabase — database, authentication, and file storage
• AI image-processing provider — processes the car photos you submit, to generate the edited image. This provider may temporarily retain processing data for a limited period for abuse-monitoring purposes, as described in its data usage policy
• Stripe — payment processing for credit purchases
• Telegram — delivery of bot messages, if you choose to use the Telegram bot
• Vercel — website hosting and cookieless, aggregated analytics
• Sentry — error tracking and diagnostics
• Upstash (Redis) — short-lived technical data used to avoid double-processing Telegram messages

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

5. International data transfers

Some of our providers (for example, our AI image-processing provider, Vercel, and Sentry) are based in or process data in the United States. Where this happens, the provider relies on appropriate safeguards required by GDPR, such as Standard Contractual Clauses or participation in the EU-U.S. Data Privacy Framework.

6. How long we keep your data

• Account data: for as long as your account is active, and deleted or anonymized within 30 days of you requesting account deletion.
• Car photos are held privately while processing, and originals are deleted after processing. Abandoned uploads are removed by the daily cleanup. Finished results are normally removed by the daily cleanup after 7 days. If you report a problem with a result, that result is retained while the report is unresolved so we can investigate, then becomes eligible for the normal cleanup. Job records do not contain the original image.
• Saved background, plate preferences and logo: retained while your account is active; you can change preferences or remove your logo. They are covered by account-deletion requests.
• Photo-job and credit-ledger records: retained while your account is active to track processing, charges and refunds. They are covered by account-deletion requests and the 30-day deletion or anonymization period above, except payment records that must be retained by law.
• Payment records: kept for as long as required by applicable Bulgarian tax and accounting law.
• Sentry error events: retained for 30 days under our current Developer plan, then removed by Sentry. These events help diagnose failures; they are separate from your photo history.

7. Your rights

Under GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Restrict or object to certain processing
• Receive your data in a portable, machine-readable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP, cpdp.bg) or your local supervisory authority

To exercise any of these rights, including requesting account deletion, email hristo@autoshotapp.com. You can also manage your account details, logo, and Telegram link directly from your account page.

8. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS), database access controls and row-level security, and secure authentication through Supabase. No system is 100% secure, but we work to protect your data appropriately for the risk involved.

9. Children

AutoShot is not intended for children under 13 or below the minimum age required in their country. Users under 18 need permission from a parent or legal guardian, as described in our Terms. If you believe a child is using AutoShot without the required permission, contact hristo@autoshotapp.com so we can investigate and take appropriate action.

10. Cookies

We use only the essential cookies set by Supabase to keep you signed in. Our analytics tool (Vercel Analytics) does not use cookies and cannot identify you individually.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the "last updated" date above and, where appropriate, notify you (for example, by email or in-app).

ChatGPT integration

Connecting ChatGPT stores your AutoShot account identifier, authorized permissions, and connection expiry/revocation information. Photo viewing, processing and saving preferences require their respective permissions. Connections are valid for up to 90 days. Disconnect on your AutoShot account page to prevent further access; disconnection does not delete your account or past results. Connection records are covered by account-deletion requests.

For the edit you request, AutoShot retrieves only the attachment you authorize and sends it, the chosen settings and any applicable saved logo to OpenAI's image-processing API. We return relevant preferences, processing status, background previews and requested images to ChatGPT. Full-resolution download links last one hour; anyone holding a valid link may access that result until it expires. Image retention follows Section 6. We do not collect the full conversation.

OpenAI receives data to provide image processing and operates ChatGPT under its own privacy policy (https://openai.com/policies/privacy-policy/). AutoShot uses connected-account data to provide the requested features, not for advertising. You can request access, correction or deletion through hristo@autoshotapp.com. Accounts created through ChatGPT are excluded from our activation-email series; authentication and essential service emails are separate.

Cursor, Grok Bot, grok.com and other MCP clients

You can connect AutoShot from Cursor, Grok Bot, and grok.com, and from other MCP clients that register themselves with AutoShot (dynamic client registration). Connecting stores your AutoShot account identifier, the permissions you approve, and expiry and revocation information.

The connection can read your saved photo preferences and your recent processed photos. A photo you upload from the connected chat is stored in your private folder. Processing one photo uses one credit already on your account. If processing fails, that credit is refunded. The connection cannot buy credits.

Access tokens last 10 minutes. Refresh tokens last 30 days. A connection lasts up to 90 days. Disconnect it on your AutoShot account page to revoke access. Disconnecting does not delete your account or past results. Connection records are covered by account-deletion requests. A self-registered client that is never used is deleted after 30 days.

For an edit you request, AutoShot sends that photo, the chosen settings, and any applicable saved logo to the image-processing provider, and returns the relevant preferences, status, and requested images to the connected client. Full-resolution download links last one hour. Image retention follows Section 6. We do not collect the full conversation. Connected-account data is used to provide the features you request, not for advertising.

12. Contact

If you have any questions about this Privacy Policy or how we handle your data, email hristo@autoshotapp.com.