01Who we are

whereisthisplace.online ("we", "us", or "the Service") is an AI photo location finder. You upload a photo; we return candidate places, confidence, and the visual reasoning — with optional paid unlocks for exact pins and Street View proof.

For privacy questions, email support@whereisthisplace.online. We operate this product for users worldwide.

02Information we collect

We only collect what we need to run the Service, keep it secure, and (when you pay) complete a purchase. Categories:

03How we collect information

• Directly from you — uploads, forms, optional account sign-in, checkout, and support emails.
• Automatically — when you use the site (logs, security signals, cookies / local storage).
• From processors acting on our behalf — for example Stripe confirming a payment, or an email provider delivering a receipt or notification.

04How we use information

We use personal information to:

• Provide photo location analysis and show you results.
• Honor purchases (unlocks, Plus subscription, refunds) and sync history when you are signed in.
• Detect abuse, spam, fraud, and prohibited uses — including attempts to locate or track private individuals.
• Improve reliability, fix bugs, and understand which features help people (aggregated or de-identified where practical).
• Send transactional messages (receipts, security notices). We do not blast marketing emails without a clear opt-in.
• Comply with law and enforce our Terms of Service.

We do not use your uploaded photos to train AI models.

05Legal bases for processing (EEA / UK users)

If you are in the European Economic Area or United Kingdom, we process personal data under one or more of these bases:

• Contract — to deliver the Service you request (analysis, unlocks, subscription).
• Legitimate interests — security, abuse prevention, product reliability, and essential analytics, balanced against your rights.
• Consent — where required (for example non-essential cookies, or optional marketing).
• Legal obligation — when the law requires us to keep or disclose records.

06Sharing and third parties

We do not sell your personal information. We share data only with processors who help us run the Service, or when the law requires it:

• Hosting and storage — infrastructure providers that host the app and temporary media (for example Cloudflare-related storage when enabled).
• Payments — Stripe processes card and billing details under their own privacy policy.
• Email delivery — providers such as Resend send transactional email (receipts, security notices) on our behalf.
• Analytics — privacy-conscious product analytics (and, if enabled in your deployment, other measurement tools) to understand aggregate usage. Configure or disable non-essential trackers where the product offers that choice.
• Legal requests — if we receive a valid legal demand, we may disclose information as required, and we will narrow the scope when we can.

Service providers are instructed to process data only for the purposes we specify and to protect it appropriately.

07International data transfers

We may process and store information in countries other than your own, including the United States and other locations where our providers operate. When we transfer personal data from the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision, where required.

08How long we keep data

Retention follows the job the data is doing:

• Uploaded photos — deleted within 24 hours by default. Kept longer only if you explicitly save a private result or publish a shareable case file.
• Temporary share links created for reverse-engine checks — short-lived (on the order of about one hour) and then expire.
• Analysis results tied to an anonymous session — removed with the photo timeline unless you unlock, save, or share.
• Account and billing records — kept while your account is active and for a limited period afterward as needed for taxes, refunds, disputes, and fraud prevention.
• Security and server logs — kept for a short operational window, then deleted or aggregated.
• Support emails — kept as long as needed to resolve your request and maintain a basic support history.

09Your rights and choices

Depending on where you live (including under GDPR and CCPA/CPRA), you may have rights to:

• Access — ask what personal information we hold about you.
• Correction — ask us to fix inaccurate data.
• Deletion — ask us to delete personal information, subject to legal retention needs (for example completed payment records).
• Portability — receive a copy of data you provided in a portable format, where applicable.
• Restriction / objection — limit certain processing, or object to processing based on legitimate interests.
• Opt out of sale / sharing — we do not sell personal information; if that ever changes, we will provide a clear opt-out.
• Withdraw consent — where processing is based on consent, you can withdraw it at any time.
• Lodge a complaint — with your local data protection authority.

To exercise these rights, email support@whereisthisplace.online with the subject line "Privacy request". We will verify your request and respond within the time required by applicable law (typically within 30 days for GDPR-style requests). We will not discriminate against you for exercising privacy rights.

10Cookies and tracking

We use cookies and similar technologies for:

• Essential operation — session, authentication, security, and remembering your theme preference.
• Analytics — understanding aggregate traffic and feature use so we can improve the product.

You can control cookies through your browser settings. Blocking essential cookies may break sign-in or checkout. Where required by law, we will request consent before setting non-essential cookies.

11Security

We use industry-standard measures appropriate to the risk: HTTPS in transit, access controls on production systems, least-privilege practices for staff access, and automatic deletion schedules for ephemeral uploads. No method of transmission or storage is perfectly secure; if we learn of a breach that affects your personal information, we will notify you and regulators as required by law.

12Children's privacy

The Service is not directed to children under 13 (or under 16 where that is the local digital-consent age). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact support@whereisthisplace.online and we will delete it.

13California privacy notice (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, delete it (with exceptions), correct it, and opt out of "sale" or certain "sharing" for cross-context behavioral advertising. We do not sell personal information and we do not use your photos for cross-context ads. To submit a request, email support@whereisthisplace.online. You may use an authorized agent as permitted by California law; we may need to verify both you and the agent.

14Third-party links and tools

Results may include links to Google Maps, Street View, or other external sites. Those services have their own privacy policies. Related privacy-friendly tools on this site — such as the browser-side EXIF viewer and EXIF remover — are linked below so you can inspect or strip metadata without sending a file to us for that step.

• EXIF Viewer — metadata stays in your browser
• Remove EXIF Data — download a clean copy
• Terms of Service

15Changes to this policy

We may update this Privacy Policy as the product or the law changes. When we make material changes, we will update the "Updated" date at the top of this page and, when appropriate, provide additional notice (for example an in-product banner or email to account holders). Continued use after the effective date of a revised policy means you accept the updated terms, except where consent is required by law.