Security & data handling

Encryption

Transport uses TLS for the website, APIs, and payment callbacks.

API keys are stored hashed. Raw keys are shown once at creation.

Infrastructure

The application runs on standard cloud hosting. Photo processing may call subprocessors (including fal.ai) solely to deliver requested checks or permitted framing.

Wallet and order records live in the application database. Production should use a managed store with backups and access logging.

Access control

Customer vaults are scoped to the signed-in account. API routes under /api/v1 require a Bearer key (pf_live_…); session cookies are rejected there.

Admin console access is MFA-gated and audited.

Retention

Paid photos saved to My photos (vault) are kept for up to 365 days after purchase — not forever. Guest download links expire in 14 days unless claimed to an account. Invoice and payment records are kept for accounting.

Privacy mode at checkout stores no usable photo bytes after processing. You can also delete a vault photo permanently.

Deletion

In the vault, Delete photo permanently removes the original and processed images from that order.

Account closure and remaining erasure requests: gakkardigitalservices@gmail.com.

Incident response

Suspected incidents are investigated, contained, and documented. Where law requires notice, we will notify affected customers.

Report security issues to gakkardigitalservices@gmail.com.

Privacy

Face photos can be sensitive. We process them to check published document-photo rules and, if you pay, to produce a file.

We do not sell photo libraries. See the Privacy Policy for legal bases and subprocessors.

Data processing

Detect → guide → validate against the selected document’s rules. Transform only where that document permits (typically crop, size, and background).

Outputs are compliance assistance, not legal advice and not a prediction that an application will be approved.

Subprocessors

Razorpay processes payments (UPI, cards, netbanking). We do not store full card numbers.

fal.ai may receive images solely to perform requested background or framing work. Privacy mode and vault delete apply to copies we control after fulfilment.

Hosting and email providers process account and transactional messages.

Applicable privacy law

We are based in India and treat ourselves as a data fiduciary under the Digital Personal Data Protection Act, 2023 for Indian users.

Where GDPR or similar laws apply, we rely on contract, consent, and legitimate interests as described in the Privacy Policy.