Privacy Policy

This Privacy Policy governs your use of imageToUrlKit.com and its associated image-processing and link-distribution tools. Under applicable data protection law, imageToUrlKit.com acts as the Data Controller for your account identifiers, authentication sessions, and service telemetry, and as a Data Processor for the image assets and metadata you choose to upload.

We align our data governance practices with the European Union General Data Protection Regulation (GDPR), the UK Data Protection Act, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). By accessing or using the platform, you acknowledge the collection and processing practices described herein.

When you upload a still image (JPEG, PNG, WebP, or AVIF) to the platform, the file is received in secure server memory, decoded, validated for structural safety, and re-encoded into an optimized web format. Animated files and vector SVG documents are rejected to prevent client-side script execution and security vulnerabilities.

As part of our commitment to user privacy, all Exchangeable Image File Format (EXIF), IPTC, and XMP metadata—including GPS geographic location coordinates, camera serial numbers, device timestamps, and hardware settings—is automatically stripped during the server re-encoding pass. The processed derivative does not retain embedded source metadata.

However, automated metadata stripping does not alter or obscure information visibly captured in the image pixels. Uploaders are solely responsible for reviewing images to ensure that names, addresses, identification documents, financial figures, or confidential screenshots are not visible before sharing a link.

We adhere strictly to the principle of data minimization and collect only the information necessary to provide, secure, and operate the platform:

Account Identifiers: When you register or sign in, we process your verified email address to establish and maintain your authenticated session.

Image Asset Records: For signed-in users, we store filenames, image dimensions, output formats, stored byte counts, and user-assigned collection tags to provide library search and organization features.

Security and Telemetry: Edge firewall infrastructure ephemerally logs client IP addresses, browser user-agent strings, and request timestamps solely for rate limiting, DDoS mitigation, spam defense, and brute-force protection. These operational logs are retained temporarily and are not combined with personal profiles.

Abuse and Support Reports: If you submit a report through our contact or abuse forms, the details you supply (including any optional email address) are preserved as an administrative record.

Strict No-Tracking Commitment: imageToUrlKit.com does not sell, rent, monetize, or trade personal data. We do not employ third-party advertising networks, marketing pixels, or cross-site tracking scripts.

Image assets are stored in isolated cloud object storage and distributed globally via a Content Delivery Network (CDN) to ensure fast, low-latency viewing and embedding across geographic regions.

Account Library Images: Saved images remain associated with your account until you move them to Trash or explicitly purge them. Trashed images can be restored from the workspace or permanently erased.

Anonymous Uploads: Images uploaded without an authenticated session are subject to automated lifecycle retention policies and may expire without notice.

CDN Caching and Deletion Latency: When you delete an image from your library or revoke an active share, our origin servers immediately reject future requests for that asset. However, distributed edge CDN nodes and intermediary proxy caches honor standard HTTP cache-control directives and may retain cached representations until their local time-to-live (TTL) expires. Keep your own master copies of all files.

The platform provides multiple access models tailored to different sharing requirements:

Share Page Links: A viewing URL ([[internal:/|share-page link]]) provides an HTML presentation with filename and image context, accessible to anyone who possesses the link.

Direct Image URLs: A direct image URL ([[internal:/|direct image link]]) returns raw image bytes with standard MIME headers for use in HTML image tags, Markdown documents, and external applications.

Password Protection: When enabled on an asset, both the share page and direct image delivery require a valid password. Successful authentication issues a scoped cryptographic cookie.

Link Expiration and Revocation: An owner can revoke access or set a expiration time. Once expired or revoked, origin servers block subsequent requests; however, this cannot recall files previously downloaded by recipients.

Depending on your geographic location, you may have specific statutory rights regarding your personal information:

Right of Access and Portability: You may request confirmation of whether we process your data and obtain an export of your account records.

Right to Rectification: You may correct or update inaccurate account information.

Right to Erasure (Right to Be Forgotten): You may request the permanent deletion of your account and all associated uploaded images.

Right to Restriction and Objection: You may object to specific processing activities under legitimate interest grounds.

California Consumer Rights: California residents have the right under CCPA/CPRA to know what personal information is collected, request its deletion, and receive equal service without discrimination. We do not sell or share personal information as defined by California law.

To exercise any of these rights, submit your request through our contact page. We verify requests prior to processing in accordance with legal requirements.

imageToUrlKit.com is intended exclusively for users aged 13 and older (or 16 in jurisdictions where local law requires a higher age of consent, such as the European Union). We do not knowingly collect, store, or solicit personal information from children under these ages. If we discover that a minor has provided personal data without verified parental consent, we will take immediate steps to delete the information and terminate the account.

We may update this Privacy Policy periodically to reflect technological improvements, legal mandates, or updates to our image workflows. The "Last Reviewed" date at the top of this document indicates when revisions took effect.

If you have questions, comments, or concerns regarding this Privacy Policy or our data processing practices, please reach out through our contact page or review our Terms of Service.