Your photos stay yours.

If you select the optional checkout reminder, we use your email to send one message after about one hour, only while that cart is unpaid and open. Its private link resumes the same checkout and expires within 24 hours of cart creation. This is not a marketing subscription. Reminder records are removed within 7 days after expiry. We also retain dates, page paths and HTTP status codes of failed page requests for 7 days, without IP addresses or full URLs in the dashboard.

We also retain aggregate server request counts for 7 days, grouped by hour, language and referring platform or hostname. These counters store no IP addresses, cookies, identifiers, full URLs or individual histories and are not shared with Meta. Click and dwell measurements still require consent.

1. Data controller

The controller is AVSOF di Enrico Bisco, Via Villanova 91, 35020 Saonara (PD), Italy, VAT / P.IVA IT05793440289, tax code / C.F. BSCNRC78R02A059H (referred to below as AVSOF or we). You can contact us at info@avsof.comor +39 049 6747089.

2. The desktop app and your photo archive

Photo JSON Rescue processes selected photos, videos, JSON sidecars, timestamps, coordinates and place information locally on your Windows computer. The normal restoration workflow does not upload those files or coordinates to AVSOF and does not use an online reverse-geocoding service. AVSOF cannot see your archive unless you deliberately send files to us for support.

Please remove or obscure unnecessary personal content before sending any sample file for support. We will use a support sample only to investigate your request.

If you activate software updates, the app checks at most once every 30 days. It sends the installed version and a random update credential issued with your purchase. It does not send photos, file names or paths, coordinates, your name or email, or a device identifier. The hosting provider necessarily receives the request IP address and time in ordinary security logs. The check is not advertising telemetry.

3. Personal data we may receive

• Purchase data: name, email, preferred transactional-email language, billing address, country, buyer type, order, tax identifier and, for an Italian business where supplied, SDI recipient code or PEC. Stripe processes full payment-card details; AVSOF does not receive your complete card number.
• Protected delivery data: a hashed download token, package and entitlement status, download count, and short-lived hashed network and browser signals used to prevent automated abuse. The download is not rigidly bound to an IP address.
• Software-update data: installed product version, a server-side hash of the random update credential, entitlement status and last successful use time. The raw credential is encrypted only while the transactional email is pending and is purged after delivery; on Windows it is protected for the current user. Infrastructure security logs may include the request IP address and time.
• Messages and support: your contact details, message, diagnostic information and attachments you choose to provide.
• Online withdrawal requests: name, purchase email, public order reference, withdrawal statement, submission time, acknowledgement status and provider message reference. The request content is encrypted at rest.
• Technical website data: IP address, browser, device, time and requested pages in security or server logs generated by our hosting infrastructure.
• Consent preference: the choice saved by the cookie banner in local browser storage.
• Order-status continuity: the checkout reference, its test/live mode and expiry, stored only for the current tab and valid for 30 minutes so that reloading the confirmation page can check the same order. This essential reference is not sent to Meta.
• Optional website usage data, only with consent: click positions and selected controls, visible time and scrolling, checkout steps and errors, form field identifiers and validation codes without entered values, the page and its language, and browser and operating-system families without versions. A random identifier groups page events. A new explicit usage-measurement choice enables a random browser code, retained locally for 7 days without automatic extension, to recognize reloads and returns. We also measure referring hostnames and available campaign tags, and may link these to a confirmed order for 7 days. These identifiers are not sent to Meta. These records exclude typed text, names, email addresses, photo or file contents, URL query strings, raw IP addresses and full browser identifiers. We do not record screens or replay sessions.
• Optional Meta advertising measurement, with separate consent: public-page visits and purchases confirmed by our server, including amount, currency and an opaque event reference. Meta receives browser/network details, permitted public-page URLs and advertising identifiers, and may associate events with your Meta account. We do not send names, email addresses, typed billing details, card data, photo contents, checkout session references or download tokens through the pixel. Automatic collection and advanced matching are disabled.

4. Why we process data and our legal bases

5. Service providers and international transfers

If you allow Meta measurement, Meta Platforms Ireland Limited receives the advertising events described above. Its processing, including advertising personalisation and potential association with your account, is explained in Meta's Privacy Policy. No Meta request is required to read the site, try the tool or purchase without this consent.

Data may be handled by providers that support hosting, transactional email, payment processing, accounting, electronic invoicing, fraud prevention and customer support. Stripe acts under its own privacy information for parts of the payment process. We disclose only the data reasonably necessary for each service and may also disclose data where required by law.

Some providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, approved standard contractual clauses or another lawful safeguard. You may ask us for information about the relevant safeguard.

6. Retention

We keep personal data only as long as needed for the purpose collected. Purchase, invoice and accounting records are normally retained for the period required by Italian law. Download entitlements and the minimum security record needed to provide or support the purchase, including an update credential hash and last-use time, are kept for the licence/support period, then deleted or anonymised unless a longer legal retention rule applies. Support communications are generally kept for up to 24 months after the request closes, unless they are needed longer for a contract, security matter or legal claim. Withdrawal requests and acknowledgements are retained with the related contract records for the period required to demonstrate compliance and handle claims. Security logs are retained for a limited period set according to operational and hosting needs.

Optional usage records are kept for up to 7 days in AVSOF's private storage, with a total limit of 16 MB that may cause earlier deletion. The random page identifier remains page-local. The optional browser-recognition code is retained locally for 7 days and removed on withdrawal; expired values are discarded on next access. Older consent does not enable this recognition. The consent preference remains in your browser until you change it or clear site data. Usage records are separate from ordinary security logs.

The essential checkout reference in the current tab's session storage is valid for 30 minutes; expired entries are discarded when next read. It is separate from the per-page identifier used for optional usage measurement.

Meta's browser cookies normally last up to 90 days; browser restrictions may shorten that duration. Meta's own notices explain retention of the data it receives. The 7-day limit for AVSOF's internal usage records does not apply to data held by Meta. Withdrawing consent stops future Meta measurement and does not automatically erase data already received by Meta.

With marketing consent, one opaque purchase-event identifier and its expiry are also kept in the current tab's session storage to avoid repeat sends on reload. It is valid for 30 minutes; expired entries are discarded when next read. This contains no payment-session reference and is removed on withdrawal of marketing consent.

7. Your GDPR rights

Subject to the conditions in applicable law, you may ask for access, correction, deletion, restriction, portability or objection to processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may also complain to the Italian Data Protection Authority (Garante per la protezione dei dati personali) or the competent authority where you live or work.

To withdraw consent for optional website measurement, open "Cookie settings" in the footer and disable the relevant purpose, or choose "Only essential" to stop both internal usage measurement and Meta measurement. Records already sent remain subject to the applicable retention limits above. Browsing, the trial and purchasing remain available when you refuse or withdraw consent.

To exercise a right, email info@avsof.com. We may request information reasonably needed to confirm your identity.

8. Security, children and changes

We use proportionate technical and organisational measures, but no system is completely risk-free. The product and website are not directed to children. We may update this policy when the service, providers or law changes; the date at the top identifies the current version.