Home/Privacy Policy

Privacy Policy

Last updated: October 28, 2026

This Privacy Policy explains how Webmint s.r.o. ("we", "us"), the operator of bgcut.net, collects, uses and protects personal data when you use our website, web application, API, browser extensions and plugins (together the "Service"). We act as the data controller under the EU General Data Protection Regulation (GDPR) and, for California residents, comply with the California Consumer Privacy Act as amended by the CPRA (CCPA).

1. Who we are

Webmint s.r.o., Jana Želivského 2, 130 00 Praha 3, Czech Republic, Company ID (IČO) 27888819, VAT ID (DIČ) CZ27888819, Registered in the Commercial Register at the Municipal Court in Prague, file no. C 124216. Contact for privacy matters: [email protected].

2. What data we collect

  • Images you upload. The photos you submit for background removal, the generated masks, previews and results, and your manual edits. Images may contain personal data (e.g. faces). We process them solely to provide the Service.
  • Account data. E-mail address, password (stored as a salted hash), name, preferred language, e-mail verification status.
  • Billing data. Name, address, country, optional company name, company ID and VAT ID, order history and invoices. Card details are processed by Stripe; we never receive your full card number.
  • Usage data. Credit balance, downloads, API calls (endpoint, status, timing), API key metadata, affiliate clicks and commissions.
  • Technical data. IP address, browser user agent, timestamps and server logs used for security, abuse prevention and rate limiting.
  • Communications. Messages you send us via the contact form or e-mail.
  • Cookies. See section 8.

3. Why we process data and on what legal basis

PurposeLegal basis (GDPR)
Providing the Service (processing images, storing results, account features, API)Performance of a contract (Art. 6(1)(b))
Payments, invoicing, tax and accounting recordsContract and legal obligation (Art. 6(1)(b), (c))
Security, fraud and abuse prevention, rate limiting, spam protectionLegitimate interests (Art. 6(1)(f))
Transactional e-mails (verification, password reset, receipts)Contract (Art. 6(1)(b))
Product news by e-mailConsent (Art. 6(1)(a)) – withdraw any time
Analytics cookiesConsent (Art. 6(1)(a))
Affiliate program trackingContract with the affiliate and legitimate interests

We do not use your images to train machine-learning models, we do not sell personal data and we do not share images with third parties.

4. How long we keep data

  • Images of visitors without an account: deleted automatically 2 hours after upload.
  • Images of registered users: deleted automatically after 30 days, or immediately when you delete them in "My images".
  • Temporary download files: deleted within 2 hours.
  • Account data: for as long as your account exists. After deletion the profile is anonymised.
  • Invoices and order records: 10 years, as required by Czech accounting and VAT law.
  • Server and API logs: up to 180 days.

5. Where data is processed and who receives it

Images are processed on servers we operate in the European Union. We use the following processors, each bound by data-processing agreements:

  • Stripe Payments Europe, Ltd. – payment processing (card data, billing e-mail).
  • Mailgun Technologies, Inc. (Sinch) – transactional e-mail delivery (EU region).
  • Google LLC – reCAPTCHA v3 for spam protection on forms and, only with your consent, Google Analytics.
  • Anthropic, PBC – AI-assisted creation and translation of our website content. Your uploaded images are never sent to Anthropic.
  • Our hosting provider for server infrastructure.

Where a processor is located outside the EEA, transfers are protected by the EU Standard Contractual Clauses or an adequacy decision (e.g. the EU-US Data Privacy Framework).

6. Your rights (GDPR)

You have the right to access, rectify and erase your personal data, to restrict or object to processing, to data portability and to withdraw consent at any time. Most of this you can do yourself in your account settings (edit profile, delete images, delete account). For other requests e-mail [email protected]; we respond within one month. You may also lodge a complaint with your supervisory authority – in the Czech Republic the Office for Personal Data Protection (ÚOOÚ, www.uoou.cz).

7. California and other US privacy rights (CCPA/CPRA)

If you are a California resident you have the right to know what personal information we collect and how it is used, to request deletion, to correct inaccurate information, to opt out of the sale or sharing of personal information and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising. Categories collected in the last 12 months: identifiers (e-mail, IP), commercial information (orders), internet activity (usage logs), and the content of uploaded images. To exercise your rights contact [email protected]; we will verify your request via your account e-mail. Residents of Virginia, Colorado, Connecticut, Utah and other states with privacy laws have comparable rights and may use the same contact.

8. Cookies and similar technologies

  • Essential cookies (always on): session cookie bgs, CSRF protection, "keep me logged in" cookie bgr, affiliate referral cookie bgref (90 days), reCAPTCHA cookies, and your cookie preference stored in local storage.
  • Analytics cookies (only with consent): Google Analytics with IP anonymisation. You can change your choice any time by clearing the "bgc" entry in your browser's local storage.

9. Security

All traffic is encrypted (HTTPS). Passwords are hashed with Argon2id. Uploaded files are stored outside the web root under random, unguessable paths and can only be accessed by their owner through authenticated requests. API keys are stored as SHA-256 hashes. Access to production systems is restricted to authorised staff.

10. Children

The Service is not directed to children under 16 and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

11. Changes

We may update this policy; the date at the top shows the latest revision. Material changes will be announced on the website or by e-mail.