Privacy Policy
Please read this Privacy Policy carefully before using the APImage service.
§1 Definitions
Key Terms
Important definitions used throughout this policy. For the purposes of this Privacy Policy, the following terms have the meanings set out below:
Personal Data: Any information relating to an identified or identifiable natural person (Art. 4(1) GDPR). This includes obvious identifiers such as your name and email address, as well as indirect identifiers such as your IP address, device identifiers, account ID, or API usage patterns that can be linked back to you.
Processing: Any operation performed on Personal Data (Art. 4(2) GDPR), whether or not automated. This includes collecting, recording, storing, organizing, using, analyzing, transmitting, disclosing, restricting, erasing, and destroying data.
Service: The APImage platform in all of its forms, including the apimage.org website, the web application and dashboard, our public APIs and SDKs, image generation and editing features, documentation, and any related support or communication channels we operate.
Subprocessor: A third-party company we engage to process Personal Data on our behalf and on our instructions in order to provide the Service, for example our hosting, database, email, payment, and AI model providers. Every subprocessor is bound by a data processing agreement under Art. 28 GDPR. Our current subprocessors are listed in §8.
Controller: The entity that determines the purposes and means of processing Personal Data (Art. 4(7) GDPR). APImage is the Controller for the data described in this policy. See §2 for contact details.
GDPR: Regulation (EU) 2016/679, the General Data Protection Regulation, together with the German Federal Data Protection Act (BDSG) where applicable.
User / You: The natural or legal person accessing or using the Service, whether as a registered account holder or as a visitor to our website.
§2 Controller Contact
Controller Information
Your data protection rights and how to contact us
Data Controller
APImage is the data controller responsible for the processing of your personal data in connection with our Service.
Data Protection Officer
According to the provisions of the General Data Protection Regulation (GDPR) and the new Federal Data Protection Act (BDSG-neu), APImage is currently not legally obliged to appoint a data protection officer, as our company does not meet the relevant thresholds and criteria for such an obligation.
Contact Information
For any questions or concerns regarding this Privacy Policy or our data protection practices, please contact us at:
Email: ask@support.apimage.org
We typically respond to privacy-related inquiries within 30 days.
§3 Categories of Personal Data We Process
Account Data
- Full name or username
- Email address
- Company or organization name (if applicable)
- User preferences and settings
Usage Data
- API usage statistics (e.g., number of calls, endpoints used)
- Counts of images processed or generated
- IP addresses and device identifiers
- Browser and operating system details
- Log files and error reports
Important: We do not store your payment card or bank details. Payments and related secure data are handled exclusively by our payment processor and Merchant of Record, Lemon Squeezy, LLC, with effect from September 21, 2026. For payments made before that date, this role was performed by our previous Merchant of Record, Polar Software Inc. (“Polar”).
Payment Data
- Subscription plan details
- Billing and invoice history
- Payment transaction metadata
Image Data
- Images you upload for processing (transient, deleted after processing)
- AI-generated images or outputs from your inputs
- Processing logs (non-identifiable)
Instagram Data (only if you use Instagram Automations or interact with an account that does, see §6)
- Connected Instagram account identifiers, username, profile picture URL, and granted permissions
- An encrypted access token issued by Meta
- Usernames, IDs, and comment text of people who comment the chosen keyword, and the delivery status of the messages sent to them
- Affiliate codes and Lemon Squeezy tracking IDs for visits to guide pages through affiliate links, and for new accounts created through an affiliate’s prompt template
§4 Purposes and Legal Bases of Processing
| Purpose | Legal Basis | Description |
|---|---|---|
| Provision and operation of the Service | Art. 6(1)(b) - Contract performance | To fulfill our contractual obligations to you, enabling access to and functioning of the Service. |
| Payment and billing | Art. 6(1)(b), (f) - Contract performance and legitimate interest | To process subscriptions and payments securely and prevent fraud. |
| Service notifications and updates | Art. 6(1)(b), (f) | To inform you of Service changes, new features, or security alerts. |
| Usage monitoring and security | Art. 6(1)(f) - Legitimate interest | To monitor service usage patterns, prevent unauthorized access, and enhance security. |
| Instagram Automations | Art. 6(1)(b) for account owners; Art. 28 GDPR (processing on the account owner’s behalf) for people who comment | To connect your Instagram account and send the messages you configure in reply to keyword comments. See §6. |
| Affiliate attribution on guide pages | Art. 6(1)(f) - Legitimate interest | To credit the affiliate who referred a visitor when that visitor later makes a purchase. See §6.8. |
| Compliance with applicable laws | Art. 6(1)(c) - Legal obligation | To meet statutory requirements, tax obligations, and law enforcement requests. |
We do not process your information for purposes incompatible with these objectives without your explicit consent.
§5 Image Processing and File Handling
Your images are handled carefully with privacy and security in mind:
- Images you upload or generate are processed and stored by us or our subprocessors on disks or servers for generation, editing, analysis, and storage. They are retained only until the expiration of the retention period defined by your plan, which may be subject to change.
- By using our service and creating an account, you consent to the use of your uploaded or generated images and processing metadata for training and improving AI models. By accepting these terms and/or using our services, you provide your consent for this use, which you can withdraw at any time.
- Logs and monitoring data may include metadata about image processing events anonymized wherever possible, strictly used for system performance monitoring, usage tracking, abuse detection, and troubleshooting.
- Any files or text you upload or generate may be transmitted to an AI subprocessor for moderation to help prevent illegal or harmful conduct.
§6 Instagram Integration (Meta), Guide Pages and Affiliate Links
APImage offers Instagram Automations: a business customer can connect an Instagram professional account (Business or Creator) so that people who comment a chosen keyword under a selected post or Reel automatically receive a direct message with a button, and, after tapping it, a second message with a link to a resource such as an APImage-hosted guide page. This section explains what data this involves. It applies only if you use this feature, or if you interact with an Instagram account that uses it.
6.1 Connecting an Instagram account
Accounts are connected through Instagram’s own login and authorization service (“Business Login for Instagram”), operated by Meta Platforms Ireland Limited for users in the European Economic Area and by Meta Platforms, Inc. elsewhere (“Meta”). You sign in on Instagram, not on APImage, and you decide which permissions to grant. We never see or store your Instagram password. Your APImage account itself is not created or signed in with Facebook or Instagram.
When you connect an account, we receive and store:
- The Instagram professional account ID and the app-scoped user ID, the username, the account type, and the profile picture URL
- The permissions you granted:
instagram_business_basic,instagram_business_manage_comments, andinstagram_business_manage_messages - An access token issued by Meta, which we store encrypted (AES-256-GCM), use only to operate the automations you configure, and renew automatically while the connection is active
- For the post or Reel you select: its ID, link, thumbnail link, and a short caption excerpt. The list of your posts shown in the picker is loaded from Instagram when you open it and is not stored.
6.2 People who comment on a connected account
When someone comments the keyword, Meta notifies us and we process:
- Their Instagram-scoped user ID and username, the comment text, the comment and post IDs, and timestamps
- Whether they tapped the button in the first message, and whether each of our messages was delivered
- The messages sent to them, whose wording and links are set by the account owner
Because the messaging permission is required for this feature, Meta also notifies us of other direct messages the connected account receives. We use these notifications only to recognize button taps and to confirm that our own messages were delivered. We do not store their content.
6.3 Roles and legal bases
- Account owners (our customers): we process connection and configuration data as controller to perform our contract with you (Art. 6(1)(b) GDPR).
- People who comment: the account owner decides to run the automation and which messages and links to send, and is the controller for this processing. APImage processes this data on the account owner’s behalf and on their instructions as a processor (Art. 28 GDPR). Account owners are responsible for having a legal basis, typically their legitimate interest in answering a request the person made in a public comment (Art. 6(1)(f) GDPR), and for informing their audience. If you commented on an account that uses APImage and wish to exercise your rights, contact that account owner, or contact us and we will forward your request.
- Security and abuse prevention across all of the above: our legitimate interest in operating a safe service (Art. 6(1)(f) GDPR).
6.4 Meta’s role and how we use Instagram data
Meta is not our subprocessor. It operates Instagram as an independent controller, and its own processing, including any transfer of data outside the EEA within its services, is governed by the Instagram Privacy Policy. We use data received through the Instagram API only to provide the features you configure, and in line with Meta’s Platform Terms and Developer Policies. We do not sell it, use it for advertising or profiling, share it with data brokers, or use it to train AI models. The AI-training use described in §5 does not apply to data received from Instagram.
6.5 Retention
- Access tokens: deleted immediately when you disconnect the account, when you remove APImage in your Instagram settings, on a data deletion request, or when your APImage workspace or account is deleted.
- Usernames, user IDs, and comment text of people who commented: automatically redacted 90 days after the comment. Anonymous delivery statistics remain.
- Message-sending records: deleted after 30 days. Notification identifiers used to avoid duplicate processing: deleted after 14 days.
- Connection and automation settings: kept until you delete them, request deletion, or delete your workspace or account.
6.6 Disconnecting and deleting your Instagram data
- In APImage: Instagram Automations → Accounts → Disconnect. We delete the stored access token, cancel any messages that have not yet been sent, and pause the account’s automations.
- In Instagram: Settings → Apps and websites → Active → APImage → Remove. Meta informs us, and we revoke the connection in the same way.
- Data deletion request: after removing APImage in Instagram you can ask for your data to be deleted there, or email ask@support.apimage.org. We then delete the connection, the automations built on it, and all related interaction records, and give you a confirmation code. You can check the status at app.apimage.org/instagram/data-deletion.
- Deleting your APImage account or workspace deletes all Instagram data connected to it.
6.7 Hosted guide pages
Customers can publish guide pages (for example, the prompts and steps behind a video) at addresses of the form app.apimage.org/g/…. Published guide pages are public. Their content is provided by the customer who published them. When you visit one, we process the technical data described in §3 (Usage Data) to deliver the page and keep it secure (Art. 6(1)(f) GDPR).
6.8 Affiliate links on guide pages
If you open a guide page through a link that contains an APImage affiliate code (?aff=…), the page loads Lemon Squeezy’s affiliate tracking script from lmsqueezy.com. The script registers the referral with Lemon Squeezy, our payment processor and affiliate program operator, and returns a tracking ID. Lemon Squeezy receives your IP address and browser information when the script loads. We store the affiliate code, the tracking ID, the guide page, and the time in a first-party cookie (apimage_aff, 30 days). If you then create a new APImage account, the affiliate code and tracking ID are stored with that account. If you later buy a subscription or credits, we pass the tracking ID and affiliate code to Lemon Squeezy so the affiliate who referred you receives their commission. Only new accounts are credited to an affiliate: if you already have an account, opening an affiliate link credits no one. Our legitimate interest, and that of our affiliates, in attributing referrals correctly is the legal basis (Art. 6(1)(f) GDPR). Without an affiliate code in the link, no tracking script is loaded and no affiliate cookie is set. Links that a customer chose to send to their own website are passed on unchanged; we add no tracking to them.
Some prompt templates on apimage.org are written by our affiliates. If you create a new APImage account from one of those templates (with its “Use this template” button or its sign-in dialog), we record which template you came from and its author’s affiliate code with your new account. The template page itself loads no tracking script. On your first visit to the app after signing up, Lemon Squeezy’s affiliate tracking script runs once to register the referral and return a tracking ID, which we store with your account rather than in a cookie. Lemon Squeezy receives your IP address and browser information when the script loads. If you later buy, we pass the affiliate code and tracking ID to Lemon Squeezy as described above. The legal basis is the same legitimate interest (Art. 6(1)(f) GDPR). Existing accounts are never attributed to an affiliate.
§7 Data Retention
We retain personal data only as long as necessary to fulfill the purposes for which the data was collected or as required by law:
Account Data: Retained as long as your account is active. You may request deletion of your personal data at any time subject to contractual or legal retention obligations.
Usage Data and Logs: Data is retained for up to 12 months to enable effective analytics, security monitoring, and abuse prevention. Information directly associated with your account is stored for the duration that your account remains active. This may include, but is not limited to, usage data, activity history, requests made through the web application or API, and corresponding API response data. In some cases, a limited subset of data may be retained after account closure to prevent misuse of our free services.
Instagram Data: Access tokens are deleted as soon as a connection ends. The usernames, IDs, and comment text of people who commented are redacted after 90 days. See §6.5 for details.
Invoices, Billing, and Payment Records: Retained for at least 10 years to comply with German tax and accounting laws (§ 147 AO).
After expiration of applicable retention periods, personal data is securely deleted or anonymized.
§8 Subprocessors and International Data Transfers
To provide the Service, we collaborate with trusted subprocessors who process your data on our behalf. We ensure all subprocessors comply with GDPR via data processing agreements and necessary safeguards.
Change of payment provider: With effect from September 21, 2026, Lemon Squeezy, LLC replaced Polar Software Inc. (“Polar”) as our payment processor and Merchant of Record. From that date, new billing data is processed by Lemon Squeezy. Billing records created before that date were processed by Polar and remain subject to the statutory retention periods set out in §7, after which they are deleted or anonymized. Polar is no longer an active subprocessor for new transactions. If you wish to exercise your data protection rights in relation to a payment made before September 21, 2026, contact us at the address in §2 and we will coordinate with the responsible provider.
Meta (Instagram): If you use Instagram Automations, data is exchanged with Meta Platforms Ireland Limited and Meta Platforms, Inc. through the Instagram API. Meta is not our subprocessor. It acts as an independent controller of Instagram under its own privacy policy. See §6.
Lemon Squeezy
Lemon Squeezy, LLC, United States
Purpose & Location
Payment processing, subscription management, affiliate tracking, and merchant of record services (Merchant of Record with effect from September 21, 2026)
Location: United States
Legal Basis & Purpose
- Payment and billing
Art. 6(1)(b), (f) GDPRTo process subscriptions, checkouts, and renewals, and to prevent fraud and payment abuse. - Compliance with applicable laws
Art. 6(1)(c) GDPRTo issue invoices and calculate, collect, and remit applicable sales and value-added taxes as merchant of record.
Personal Data Processed
Name, Email address, Billing and address details, Payment method metadata, Transaction and subscription history, Device identifiers, IP address
Data Transfers
Transfers to the USA are based on Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR.
Netlify
Netlify, Inc.
Purpose & Location
Provision and operation of the Service
Location: United States
Legal Basis & Purpose
- Provision and operation of the Service
Art. 6(1)(b) GDPRNecessary for contractual performance. - Usage monitoring and security
Art. 6(1)(f) GDPRTo ensure service integrity and prevent abuse.
Personal Data Processed
IP address, Browser metadata, Request headers
Data Transfers
Transfers to the USA are based on Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR.
Supabase
Supabase Inc.
Purpose & Location
Provision and operation of the Service
Location: United States
Legal Basis & Purpose
- Provision and operation of the Service
Art. 6(1)(b) GDPRFor core app functionality. - Usage monitoring and security
Art. 6(1)(f) GDPRTo ensure integrity and detect misuse. - Compliance with applicable laws
Art. 6(1)(c) GDPRTo fulfill regulatory obligations.
Personal Data Processed
Login data, Email addresses, Session tokens, IP addresses
Data Transfers
Supabase stores data primarily in EU data centers. Where data is processed in third countries (e.g., USA, Singapore), SCCs apply in accordance with Art. 46 GDPR.
OpenAI
OpenAI, L.P.
Purpose & Location
Provision and operation of the Service
Location: United States
Legal Basis & Purpose
- Provision and operation of the Service
Art. 6(1)(b) GDPRFor AI features and functionality. - Usage monitoring and security
Art. 6(1)(f) GDPRTo protect systems and detect misuse.
Personal Data Processed
Image data, Prompts, Request metadata
Data Transfers
Transfers to the USA are secured through Standard Contractual Clauses (SCCs) as per Art. 46 GDPR.
SendGrid
Twilio Inc. (SendGrid)
Purpose & Location
Service communications
Location: United States
Legal Basis & Purpose
- Service communications
Art. 6(1)(b) GDPRTo deliver important service-related communications. - Marketing communications
Art. 6(1)(a) GDPRWith user consent for marketing purposes.
Personal Data Processed
Email address, Name, Email engagement data, IP address
Data Transfers
Transfers to the USA are protected by Standard Contractual Clauses (SCCs) in accordance with Art. 46 GDPR.
Mailgun
Mailgun Technologies, Inc.
Purpose & Location
Service communications
Location: United States
Legal Basis & Purpose
- Service communications
Art. 6(1)(b) GDPRTo deliver important service-related communications.
Personal Data Processed
Email address, Name, IP address, Email content
Data Transfers
Transfers to the USA are protected by Standard Contractual Clauses (SCCs) in accordance with Art. 46 GDPR.
MailerLite
UAB MailerLite
Purpose & Location
Marketing communications
Location: EU
Legal Basis & Purpose
- Marketing communications
Art. 6(1)(a) GDPRWith user consent for receiving marketing emails.
Personal Data Processed
Email address, Name, Email engagement data, Location data, IP address
Data Transfers
Data is stored in the EU. Any transfers outside the EEA are protected by Standard Contractual Clauses (SCCs) in accordance with Art. 46 GDPR.
Stability AI
Stability AI Ltd
Purpose & Location
Provision of AI features
Location: EU
Legal Basis & Purpose
- Provision of AI features
Art. 6(1)(b) GDPRTo provide AI image generation functionality. - Service improvement
Art. 6(1)(f) GDPRTo improve and optimize our AI services.
Personal Data Processed
Image generation prompts, Image data, Usage data, IP address
Data Transfers
Data may be transferred to the UK and other countries where Stability AI operates, protected by Standard Contractual Clauses (SCCs) where applicable.
Anthropic
Anthropic PBC
Purpose & Location
Provision of AI features
Location: United States
Legal Basis & Purpose
- Provision of AI features
Art. 6(1)(b) GDPRTo provide AI-powered text processing functionality. - Service improvement
Art. 6(1)(f) GDPRTo improve and optimize our AI services.
Personal Data Processed
Text inputs, Usage data, IP address
Data Transfers
Transfers to the USA are protected by Standard Contractual Clauses (SCCs) in accordance with Art. 46 GDPR.
Black Forest Labs
Black Forest Labs Inc.
Purpose & Location
Provision of AI features
Location: United States
Legal Basis & Purpose
- Provision of AI features
Art. 6(1)(b) GDPRTo provide specialized AI capabilities. - Service improvement
Art. 6(1)(f) GDPRTo enhance and optimize our AI services.
Personal Data Processed
Input data for processing, Usage patterns, IP address
Data Transfers
Transfers to the USA are protected by Standard Contractual Clauses (SCCs) in accordance with Art. 46 GDPR.
fal.ai
Features & Labels, Inc.
Purpose & Location
Provision of AI features
Location: United States
Legal Basis & Purpose
- Provision of AI features
Art. 6(1)(b) GDPRTo run the video, lip-sync, speech, music, dubbing and transcription models behind these features.
Personal Data Processed
Prompts and scripts, Image, video and audio inputs, Generated outputs, Request metadata
Data Transfers
Transfers to the USA are protected by Standard Contractual Clauses (SCCs) in accordance with Art. 46 GDPR.
All subprocessors are carefully vetted and bound by data processing agreements that require them to protect your data to the same standard as we do.
§9 Your Data Protection Rights
Under GDPR, you have extensive rights regarding your personal data. To exercise these rights, please contact us at ask@support.apimage.org. We will respond promptly, and you can expect a reply within 30 calendar days in compliance with Art. 12 GDPR.
Right of Access: Request a copy of your personal data we hold. You can do so in the Settings section of your account.
Right to Rectification: Request corrections of inaccurate or incomplete data.
Right to Erasure: Request deletion of your personal data, subject to legal and contractual limitations. You can do so in the Settings section of your account. Please note that this action will permanently delete your account and cannot be undone.
Right to Restrict Processing: Request temporary suspension of processing under certain circumstances.
Right to Data Portability: Obtain your personal data in a structured, machine-readable format for transfer to another provider.
Right to Object: Object to processing based on legitimate interests or direct marketing.
§10 Cookies & Local Storage
We use cookies and similar technologies to enhance your experience while using our service. These technologies help us provide a secure, functional, and efficient platform.
Essential Cookies
- Manage user sessions and authentication
- Remember language and interface preferences
- Enable core website functionality
Local Storage
We use the browser’s local storage to store the following information:
- theme - Your selected UI theme (light/dark mode - no personal data is stored)
- sb-*-auth-token - Authentication token for session management (* indicates a value that may vary)
- web-vitals-extension-metrics - Performance metrics for debugging and optimization (no personal data is stored)
Affiliate Attribution Cookie
apimage_aff: set only when you open a guide page through a link with an affiliate code. It stores that code, Lemon Squeezy’s tracking ID, the guide page, and the time, for 30 days, so that a new account created afterwards can be credited to the referring affiliate. On those pages, Lemon Squeezy’s affiliate script (lmsqueezy.com) also runs. See §6.8.
You can clear this data at any time through your browser settings.
We respect your privacy and do not use cookies for advertising purposes. The affiliate attribution cookie above is used only to credit referrals. You can manage your cookie preferences at any time through your browser settings. If we use cookies on this site that legally require an opt-out option, you will be able to manage your preferences here and in your account settings.
§11 Newsletter and Email Distribution
We use the following email service providers to manage our newsletter and transactional emails. When you subscribe to our newsletter or receive emails from us, your data may be processed by these providers in accordance with their privacy policies. We, together with our partners, may analyze email interactions, including delivery rates, open rates, link clicks, and other engagement metrics. Our partners include:
Lemon Squeezy: Used for transactional emails related to your purchases, such as order confirmations, receipts, invoices, and renewal notices, sent in its capacity as our Merchant of Record from September 21, 2026 onward. Comparable emails for earlier purchases were sent by our previous Merchant of Record, Polar Software Inc.
Privacy Policy
SendGrid: Used for sending transactional and marketing emails.
Privacy Policy
Mailgun: Used for processing and delivering email communications, including system emails.
Privacy Policy
MailerLite: Used for managing newsletter subscriptions and email marketing campaigns.
Privacy Policy
Your Email Preferences
You can manage your email preferences or unsubscribe at any time by clicking the “unsubscribe” link in any marketing email, inside your account settings or by contacting us at ask@support.apimage.org.
§12 Security Measures
We implement comprehensive technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our security practices are regularly reviewed and updated to address emerging threats.
Data Encryption: End-to-end encryption for data in transit and at rest, using industry-standard protocols (TLS 1.3+) and strong ciphers.
Access Controls: Strict role-based access controls (RBAC) and principle of least privilege for all systems handling personal data.
Secure Infrastructure: Enterprise-grade hosting in SOC 2 Type II and ISO 27001 certified data centers with physical security controls.
Incident Response: Comprehensive incident response plan with defined procedures for data breach notification within 72 hours when required.
Vulnerability Management: Regular security audits, penetration testing, and automated vulnerability scanning of all systems.
Employee Training: Regular security awareness training for all employees with access to personal data.
We are committed to maintaining the highest security standards. Our security practices are regularly audited and certified to meet industry standards and regulatory requirements.
§13 Minors and Children’s Privacy
Adults Only, 18+
APImage is an adults-only service. Our Services are not intended for and may not be used by anyone under 18 years of age.
Age Requirements
Our Services are exclusively for users who are at least 18 years old. We do not knowingly collect personal data from anyone under 18. We may require verification of age and may suspend an account pending verification.
Parental Controls
We encourage parents and guardians to monitor their children’s online activities. If you believe your child has provided us with personal data without your consent, please contact us immediately.
If we discover that we have collected personal data from anyone under 18, we will terminate the account and promptly delete that information from our servers, subject to any statutory retention obligations.
For Parents & Guardians:
To request review, deletion, or to place restrictions on your child’s personal data, please contact us at ask@support.apimage.org.
§14 Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service functionality. We encourage you to review this page periodically for the latest information on our privacy practices.
Last Updated: October 18, 2026
Notification of Changes
We will notify you of any material changes through your registered email address and/or by posting a prominent notice on our website before the changes take effect.
Your Acceptance
Your continued use of our Services after we post any modifications to the Privacy Policy will constitute your acknowledgment of the modifications and your consent to abide by the updated Policy.
Version History
You can review previous versions of this Privacy Policy by contacting us at ask@support.apimage.org.
For your convenience, we also maintain an archive of recent policy changes on our website. The most current version of the Privacy Policy will always be available at: https://apimage.org/legal/privacy
§15 Supervisory Authority
Your Data Protection Rights
You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates applicable data protection laws.
European Economic Area (EEA)
For users in the EEA, you can find your local data protection authority through the link below. The relevant authority is determined by your country of residence, place of work, or the location of the alleged violation.
Find your DPAUnited Kingdom
For users in the United Kingdom, the supervisory authority is the Information Commissioner’s Office (ICO). You can contact them directly through their website.
ico.org.ukBefore filing a complaint, we encourage you to contact us first at ask@support.apimage.org so we can address your concerns directly.