Privacy Policy
Last updated Mon Nov 09 2026 00:00:00 GMT+0000 (Coordinated Universal Time)
Controller: Zahner Solutions, Dreibündenstrasse 64, 7000 Chur, Switzerland · support@sfwapi.dev
This policy covers the SFW API, the console and playground, the website sfwapi.dev and our support channels. It applies under the Swiss Federal Act on Data Protection (FADP) and, where you or your end users are in the EU, the EEA or the UK, under the GDPR and UK GDPR.
The short version
- We never store the media you send us. Images, GIFs and videos are analysed in memory on servers in Germany and discarded when the response leaves. We do not keep URLs, base64 payloads, file names or hashes, and none of them appear in logs.
- For media and results we act as your processor: each API call is your instruction. For account, billing, website and support data we are the controller.
- We keep as little as possible and say exactly what below.
1. Media and results (processor role)
When you call the API, the media you send and the result we compute are personal data if the picture shows an identifiable person. We process it only to return the answer you asked for, under the Data Processing Agreement. Nothing is retained: no bytes, no URL, no hash, no file name. If you send a URL, our server downloads the file over the internet; the operator of that host sees our server's address, not yours.
2. Data we hold as controller
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account: email address, name, sign-in provider ID (GitHub or Google) or magic-link verification | account, sign-in, service emails | contract (Art. 6(1)(b) GDPR) | until account deletion |
| API keys: name, prefix, hash, created and revoked times, last use, network prefix (/24 or /48) and country of last use | security, abuse prevention | legitimate interest (Art. 6(1)(f)) | key lifetime; network prefix 30 days |
| Request metadata without content: request ID, key ID, timestamp, status, error code, media kind, frames analysed, credits, latency, media size bucket | billing, abuse prevention, debugging | contract, legitimate interest | 7 days, then only aggregates |
| Hourly usage aggregates per key: counts, credits, bytes, levels, latency buckets | usage display, billing, capacity planning | contract | account lifetime |
| Billing: purchases, invoices, VAT ID, billing address, payment method reference held by Stripe | payment, invoicing, tax | contract, legal obligation (Art. 6(1)(c)) | 10 years after the tax year (Swiss and EU bookkeeping duties) |
| Audit log of console actions: action, time, user, network prefix | security | legitimate interest | 12 months |
| Support conversations sent to support@ or abuse@ | answering you | contract, legitimate interest | 24 months after the last message |
| Website analytics (only after consent): page views, referrer, device class, country | improving the site | consent (Art. 6(1)(a)) | 12 months |
| Server logs of the API host: request line without query string or body, status, timing, network prefix | security, operations | legitimate interest | 14 days |
We do not sell personal data, do not build advertising profiles and do not make automated decisions with legal effect about you.
3. Where processing happens
Inference and the API run on dedicated servers in Germany. Account and usage data are stored on those servers too. Traffic to the API passes through Cloudflare's European edge. The website is served by Vercel; it holds no account data and never sees media. Payments are handled by Stripe. Analytics and support tickets are processed by PostHog in its EU region. Transactional email is sent through Resend. The full list with locations and safeguards is on the sub-processor page.
Switzerland holds an EU adequacy decision, so transfers between the EU and us need no further safeguard. Where a provider processes data in the United States, we rely on the EU–US Data Privacy Framework or the EU standard contractual clauses together with the Swiss addendum.
4. Sign-in providers
If you sign in with GitHub or Google, that provider tells us your email address and name and learns that you signed in to our service. The provider acts as an independent controller under its own privacy policy. Magic-link sign-in involves no third party other than our email provider.
5. Cookies and local storage
The console uses one strictly necessary session cookie set by api.sfwapi.dev. The website stores your analytics choice in local storage and sets analytics cookies only after you allow them. Details are in the Cookie Policy.
6. Your rights
You may ask for access to your data, correction, erasure, restriction, portability of data you gave us, and you may object to processing based on legitimate interest. Where processing is based on consent you may withdraw it at any time with effect for the future. Write to support@sfwapi.dev; we answer within 30 days. You may complain to a supervisory authority, in Switzerland the Federal Data Protection and Information Commissioner, in the EU the authority of your residence. Because we hold no media, there is nothing to return or delete beyond the account data listed above; requests from your end users about media should be addressed to you as the controller, and we assist you under the Data Processing Agreement.
7. Security
TLS on every connection, in-memory processing without persistence, hashed API keys, key-only SSH access, network isolation of the inference workers, hardened containers, encrypted off-site backups of the non-content database, and least-privilege access for the operator. We notify affected customers of a personal data breach within 72 hours of becoming aware of it.
8. Children
The Service is not directed at children. We do not knowingly collect data from anyone under 16.
9. Changes
We update this policy when the Service changes. The date at the top tells you when. Material changes are announced by email to account holders.