Privacy Policy | PhotoExamAI

1. Data controller

The controller of your personal data is TONVI TECH SL (hereinafter, «PhotoExamAI»), Spanish tax ID B-19780394, with registered office at Calle Puerta del Mar 18, 5th floor, 29005 Málaga (Spain).

General contact and support: [email protected]
Dedicated privacy and data-subject-rights channel: [email protected]

Version of this policy: 4 September 2026.

2. What data we process

Depending on how you use PhotoExamAI, we may process the following categories of data:

Account and identification data: email address, name, profile picture and Google identifier if you sign in with Google, language and country.
Study profile (optional): date of birth, level of studies, city, study dedication and preferences about the style of the AI tutors.
Content you upload: photographs and PDF files of exams, exercises and notes; audio recordings to be transcribed; texts and questions you type in the tutor chat.
AI-generated content derived from the above: corrections and indicative grades, summaries, outlines, concept maps, quizzes, transcriptions, notes, essays and study plans.
Usage and technical data: activity logs, product events with a pseudonymous identifier, IP address in security logs, AI service consumption and marketing attribution identifiers (utm_*, gclid, fbclid and similar) when you have accepted marketing cookies.
Billing data: subscribed plan, amounts, Stripe customer identifier and the tax details shown on the invoice. PhotoExamAI never receives or stores your card number: the payment is processed entirely by Stripe.

3. Purposes and legal bases (art. 6 GDPR)

We process your data for the following purposes, each with its own legal basis:

Performance of the contract (art. 6(1)(b) GDPR): creating and maintaining your account, providing the correction, solving, summarising, transcription and content-generation services, storing your exam history, providing support and managing your subscription.
Consent (art. 6(1)(a) GDPR): sending commercial communications by email; installing analytics and marketing cookies and similar technologies; profiling for promotional purposes. You may withdraw consent at any time, without affecting the lawfulness of prior processing.
Legal obligation (art. 6(1)(c) GDPR): issuing, sending and retaining invoices and accounting and tax records (art. 66 of the Spanish General Tax Act, 4 years; art. 30 of the Commercial Code, 6 years) and responding to requests from competent authorities.
Legitimate interest (art. 6(1)(f) GDPR): platform security, prevention of fraud and service abuse, technical and error logs, internal measurement of AI service costs and defence against claims.

We do not use your data or your content to train artificial intelligence models, neither our own nor those of third parties.

4. Important notice about other people's data

Do not upload exams, notes or recordings containing personal data of other people (classmates' names, third-party grades, the voice of teachers or classmates), or anonymise or crop them before uploading. You are responsible for the content you upload.

Before photographing an exam, cover or crop the header containing the name, surname, class group or student number. Before recording a class, bear in mind that other people's voices are personal data and that you need a legal basis to process them.

If we detect content with third-party personal data that should not be there, we may remove it. If you are a third party and believe your data appears in content uploaded by a user, write to [email protected].

5. Recipients: processors and providers

To provide the service we rely on the following providers, which act as processors on our behalf and under our instructions. Their country and the safeguard applicable to international transfers is indicated (Standard Contractual Clauses, «SCC», and/or the EU-US Data Privacy Framework, «DPF»):

OpenAI, L.L.C. (United States) — correction and content generation, OCR, Whisper transcription, text-to-speech (TTS) and the Assistants, Files and Vector Stores features. Safeguard: OpenAI data processing addendum (DPA) and Standard Contractual Clauses (SCC). Data is sent solely to provide the service and is not used to train their models.
Google Cloud Vision — Google Ireland Ltd. (Ireland) and Google LLC (United States) — optical character recognition (OCR) of images and PDFs. Safeguard: Google Cloud Data Processing Addendum + SCC/DPF.
Google Gemini (Google) — transcription and reading of images and PDFs. Safeguard: same contractual framework as Google Cloud (DPA + SCC/DPF).
Google OAuth / Sign-In (Google) — authentication when you choose to sign in with your Google account.
Stripe Payments Europe Ltd. (Ireland) and Stripe, Inc. (United States) — payment processing, subscriptions and billing portal. Safeguard: DPF + SCC.
Amazon Web Services (Amazon SES, eu-west-3 Paris region, European Union) — transactional and commercial email delivery.
Brevo (Sendinblue, France, European Union) — management of the commercial mailing list and unsubscribes.
Cloudflare, Inc. (United States) — content delivery network, reverse proxy and Turnstile (anti-bot protection). Safeguard: DPF + SCC.
Google Cloud Storage (bucket «fotoexamen») — storage of the images and PDFs you upload.
Hetzner Online GmbH (Germany, European Union) — application servers and database.
OpenPanel, self-hosted on our own infrastructure (Hetzner, European Union) — product analytics with a pseudonymous identifier. Only activated if you accept analytics cookies.
Trackdesk (Czech Republic, European Union) — affiliate programme. Only activated if you accept marketing cookies.
AgentLedger/Aikount (TONVI TECH SL's own tool, hosted in the European Union) — issuing and archiving legal invoices.

In addition to these processors, we may disclose data to public authorities, courts and law enforcement where there is a legal obligation, and to tax and accounting advisers bound by professional secrecy.

We do not sell your personal data nor transfer it to third parties for advertising purposes.

We keep the list of sub-processors up to date. You may request the current version, as well as a copy of the international transfer safeguards, by writing to [email protected].

6. International transfers

Some of the providers above are established in the United States (OpenAI, Cloudflare, Stripe Inc., Google LLC). In those cases the transfer relies on the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914) and/or on the adequacy decision for the EU-US Data Privacy Framework, together with any applicable supplementary measures.

The application servers and database, email delivery and the commercial mailing list are located in the European Union (Germany and France).

7. Retention periods

We apply the following periods, enforced automatically:

Images and PDF files you upload and exam records: 365 days from upload.
AI-generated content (summaries, outlines, quizzes, transcriptions, notes, essays and study plans): 365 days.
Free accounts with no access for 24 months: deleted, after a warning email sent 30 days in advance.
Sent-email log: 30 days.
AI service usage logs: 365 days.
Application logs: 90 days.
Billing and accounting data: between 4 and 6 years, as a legal obligation.

When you delete your account, everything above is erased, except the billing information we must keep blocked for the legal periods indicated.

8. Minors

The minimum age to use PhotoExamAI is 14, in accordance with art. 8 GDPR and art. 7 of Spanish Organic Law 3/2018 (LOPDGDD). Date of birth is requested at sign-up.

Children under 14 may not use the service without the verifiable consent of a parent or legal guardian. If an age below 14 is declared at sign-up, the account is suspended and a signed link is sent to the guardian's email address so that they can confirm consent. If it is not confirmed within 30 days, the account and its content are deleted.

Users aged 14 to 17 are not sent commercial communications, are not subject to promotional profiling, and no marketing cookies or third-party trackers are activated for them.

Parents and guardians are responsible for supervising minors' use of the service and the content they upload.

9. Automated decisions and profiling (arts. 13(2)(f) and 22 GDPR)

PhotoExamAI corrects and grades exams automatically using artificial intelligence models. Please note the following:

The correction and grade generated by the AI are indicative and intended solely for your own study and self-assessment.
They produce no legal effects, do not constitute an official assessment and do not determine your grade, your admission or your academic record.
They may contain errors and never replace the assessment of your teacher or school.
You may request human intervention and a review of any result by writing to [email protected], as well as express your point of view and contest the result.

Profiling for promotional purposes (recommendations, coupons and campaigns) applies only if you have consented to marketing, and never to users under 18.

10. Your rights and how to exercise them

You may exercise the following rights at any time:

Access to your personal data.
Rectification of inaccurate data.
Erasure («right to be forgotten»).
Restriction of processing.
Portability of your data in a structured, commonly used format.
Objection to processing based on legitimate interest.
Withdrawal of consent at any time.
Not to be subject to decisions based solely on automated processing, including profiling.

To exercise them, write to [email protected] or [email protected] from the email address linked to your account, stating the right you wish to exercise. We will only ask for an identity document if there are reasonable doubts about your identity.

We will reply within one month of receiving the request, extendable by two further months if the request is particularly complex, in which case we will inform you.

If you believe we have not handled your rights properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or with the supervisory authority of your country of residence.

11. Manage your data from the app

From your profile in the application you can, without writing to us:

«Download my data»: obtain a copy of your information and content in a downloadable file (right to portability).
«Delete my account»: erase your account and all its content (exams, images, generated content, profile and list subscriptions), keeping only the billing data blocked by legal obligation.

You can also unsubscribe from commercial communications using the link at the bottom of every email.

12. Cookies

We use necessary first-party cookies and, only with your consent, analytics and marketing cookies. You can find the detail of each cookie, its provider, purpose, duration and international transfers in our Cookie Policy.

You can withdraw or change your consent at any time from the «Cookie settings» link in the footer of every page of the site.

13. Data security

We apply technical and organisational measures appropriate to the risk: encryption in transit (HTTPS), access control, passwordless authentication, environment segregation, activity logs and minimisation of the data sent to AI providers.

No security measure on the Internet is infallible. Should a breach occur that poses a high risk to your rights and freedoms, we will inform you without undue delay and notify the AEPD within 72 hours, in accordance with arts. 33 and 34 GDPR.

14. Accuracy of the data

You warrant that the data you provide is accurate and undertake to keep it up to date. PhotoExamAI reserves the right to suspend the service for anyone providing false data, in particular regarding age.

15. Changes to this policy

We may update this Privacy Policy to reflect regulatory changes or new features. If the change is substantial we will inform you by email or through a prominent notice in the application before it takes effect.