Privacy Policy

1. Who we are

AutoShot is operated by Hristo Lilkin, sole trader, based in Bulgaria. For data protection purposes, Hristo Lilkin is the "controller" of your personal data.

Contact: hristo@autoshotapp.com

If AutoShot is later incorporated as a company, this policy will be updated and the new entity will become the data controller; you will be notified of any such change.

2. What personal data we collect

Account data: your email address, password (stored as a salted hash by our authentication provider, Supabase — we never see or store your plain-text password), and your chosen interface language.

Uploaded images:

• The car photos you upload are sent to our AI image-processing provider and held only briefly in private storage while the job runs; the originals are deleted right after processing. The finished result is kept in private storage for up to 7 days so you can re-download it from your account, then deleted automatically. We keep a record that a job ran (status, timestamp, processing time, success/failure) — never the original photo itself.
• If you upload your logo, that image is stored in our database/storage (Supabase) and used only to add it to your future photos, until you remove it or delete your account.

Payment data: if you purchase credits, payment is handled entirely by Stripe. We receive only confirmation that a payment succeeded and a payment reference — we never see or store your card details.

Telegram bot data: if you link your Telegram account, we store your Telegram chat ID and username so the bot can identify you and apply your credit balance, background, and language preferences. Photos and messages sent to the bot are processed the same way as uploads through the web app.

Technical & usage data: your IP address and basic diagnostic information collected automatically by our error-tracking tool (Sentry) when something goes wrong, and anonymous, aggregated usage statistics collected by Vercel Analytics, which does not use cookies and cannot identify you individually.

3. Why we use your data and our legal basis

• To create and manage your account, process your images, and operate the credit and billing system — necessary to perform our contract with you (Art. 6(1)(b) GDPR).
• To detect, prevent, and fix errors and abuse, and to keep the Service secure and working — our legitimate interest (Art. 6(1)(f) GDPR).
• To comply with legal obligations, such as keeping records of payments for tax purposes (Art. 6(1)(c) GDPR).

4. Who we share your data with

We use the following service providers ("processors") to operate AutoShot. Each receives only the data needed for its specific function, under its own terms and privacy policy:

• Supabase — database, authentication, and file storage
• AI image-processing provider — processes the car photos you submit, to generate the edited image. This provider may temporarily retain processing data for a limited period for abuse-monitoring purposes, as described in its data usage policy
• Stripe — payment processing for credit purchases
• Telegram — delivery of bot messages, if you choose to use the Telegram bot
• Vercel — website hosting and cookieless, aggregated analytics
• Sentry — error tracking and diagnostics
• Upstash (Redis) — short-lived technical data used to avoid double-processing Telegram messages

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

5. International data transfers

Some of our providers (for example, our AI image-processing provider, Vercel, and Sentry) are based in or process data in the United States. Where this happens, the provider relies on appropriate safeguards required by GDPR, such as Standard Contractual Clauses or participation in the EU-U.S. Data Privacy Framework.

6. How long we keep your data

• Account data: for as long as your account is active, and deleted or anonymized within 30 days of you requesting account deletion.
• Car photos you upload: originals deleted right after processing; finished results kept for up to 7 days so you can re-download them, then deleted automatically (see Section 2).
• Studio preference: for as long as your account is active, and deleted or anonymized within 30 days of your account-deletion request.
• Job/usage records (status and timing only, no image content): kept for service operation and basic analytics.
• Payment records: kept for as long as required by applicable Bulgarian tax and accounting law.

7. Your rights

Under GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Restrict or object to certain processing
• Receive your data in a portable, machine-readable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP, cpdp.bg) or your local supervisory authority

To exercise any of these rights, including requesting account deletion, email hristo@autoshotapp.com. You can also manage your account details, logo, and Telegram link directly from your account page.

8. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS), database access controls and row-level security, and secure authentication through Supabase. No system is 100% secure, but we work to protect your data appropriately for the risk involved.

9. Children

The Service is intended for users aged 18 and over. We do not knowingly collect personal data from children, and accounts must not be created by anyone under 18.

10. Cookies

We use only the essential cookies set by Supabase to keep you signed in. Our analytics tool (Vercel Analytics) does not use cookies and cannot identify you individually.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the "last updated" date above and, where appropriate, notify you (for example, by email or in-app).

12. Contact

If you have any questions about this Privacy Policy or how we handle your data, email hristo@autoshotapp.com.