Security & data handling

Transport uses TLS for the website, APIs, and payment callbacks. API keys are stored hashed — raw keys are shown once at creation.

Standard cloud hosting. Photo processing may call subprocessors (including fal.ai) solely to deliver requested checks or permitted framing. Wallet and order records live in the application database.

Customer vaults are scoped to the signed-in account. API routes under /api/v1 require a Bearer key (pf_live_…); session cookies are rejected there. Admin console access is MFA-gated and audited.

Paid vault photos are kept up to 365 days after purchase — not forever. Guest download links expire in 14 days unless claimed. Invoice and payment records are kept for accounting.

In the vault, Delete photo permanently removes the original and processed images from that order. Account closure and remaining erasure: gakkardigitalservices@gmail.com.

Suspected incidents are investigated, contained, and documented. Where law requires notice, we notify affected customers. Report issues to gakkardigitalservices@gmail.com.

Face photos can be sensitive. We process them to check published document-photo rules and, if you pay, to produce a file. We do not sell photo libraries.

Detect → guide → validate against the selected document’s rules. Transform only where that document permits (typically crop, size, and background). Outputs are compliance assistance — not legal advice or an approval prediction.

Razorpay processes payments (we do not store full card numbers). fal.ai may receive images solely for requested background or framing work. Hosting and email providers process account and transactional messages.

We are based in India and treat ourselves as a data fiduciary under the Digital Personal Data Protection Act, 2023 for Indian users. Where GDPR or similar laws apply, we rely on contract, consent, and legitimate interests as described in the Privacy Policy.