Last updated: 19 October 2026
ShotHarvest AI is run by Cristian Balan (individual), Sofia, Bulgaria. For anything about your data, use the contact form.
Your photos may show other people (for example your clients or wedding guests). You decide what to upload and you are responsible for having the right to use those photos. If you use ShotHarvest for your business, we process those photos for you, on your instructions.
We do not sell your data. We do not use your photos to train AI models. We do not use advertising or tracking cookies.
| Company | What they do | Where |
|---|---|---|
| Hetzner Online GmbH | Server and photo storage (accounts, photos, edits) | Germany (EU) |
| Google (Gemini API) | AI looks at each photo to judge quality and suggest edits | Google's global infrastructure; may be outside the EU |
| Resend | Sends account and session emails (your email address and the message) | Company in the US; EU sending region |
We use Google's paid Gemini API. Under Google's terms for paid API use, Google does not use your photos or the results to improve its products. Transfers outside the EU rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework, as offered by each company.
Today we keep your photos and edits until you ask us to delete them or close your account. We are adding automatic deletion (original uploads after 30 days, finished photos after 90 days, with an email 7 days before); we will email you before it starts. Account data is deleted when you close your account; backups roll over within 30 days.
Under the GDPR you can ask to see, correct, export or delete your data, object to or limit how we use it, and withdraw consent. Send the request through the contact form (topic "Data request"); we answer within 30 days. You can also complain to your data protection authority (in Bulgaria: Commission for Personal Data Protection, cpdp.bg).
One essential cookie keeps you signed in. No analytics, advertising or tracking cookies.
Connections use HTTPS, passwords are hashed, and photo storage is reachable only from our server. Client share links work for anyone who has the link, so treat them like a password.