Privacy Policy
Updated and effective: 2026-10-12 · Version 2.1
Operator: FIIT.AI · 4665 University Street, Dallas, 97338
Contact: Bryan Bai
1. Scope and responsibility
This Policy describes PicFiit's handling of account, image, payment and visit information. The company named above operates the website and is its data controller. Use the contact channel below for privacy requests. Data processed by Waffo Pancake and other providers is also subject to their own policies.
2. Information and purposes
- Account data: email, salted password hashes, account identifiers and session records for registration, sign-in, security and account management. We do not store plaintext passwords.
- Transactions and usage: order IDs, packages, amounts, currencies, payment and refund status, credit balances and processing counts and timestamps for delivery, reconciliation, refunds and preventing duplicate fulfillment.
- Images: basic editing, cropping, styling and compression run in your browser. When you choose AI background removal, our server forwards your image to remove.bg and returns the result. The processing endpoint does not save images to an image library. Download and keep your own results.
- Network and security information: providers may process IP addresses, request timestamps, browser information, errors and security logs for service delivery, troubleshooting and abuse prevention.
- Support information you voluntarily provide for account, billing, refund or privacy requests. Do not include unnecessary sensitive information.
Essential account and paid-service processing generally supports performance of our service contract; fraud prevention and security support legitimate interests; legally required transaction retention supports legal obligations. Optional analytics depends on your choice. Applicable bases and rights depend on the relevant law.
3. Cookies and analytics
An essential HttpOnly cookie maintains sign-in for up to 30 days. Legacy wallet recovery may use an essential wallet cookie lasting up to 365 days. Blocking essential cookies affects sign-in and account functionality.
Optional analytics does not load by default. Only after you allow analytics do public pages load tags managed by Google Tag Manager. Such tags may process page visits, device information, referrals and cookies. Account, sign-in and payment-return pages do not load these analytics tags. See Google's Privacy Policy.
Change your choice using “Privacy settings” in the footer. Rejecting analytics reloads the page and prevents further analytics loading. Use browser settings to clear cookies previously set by third parties. The preference is stored only in the current browser. We do not send marketing emails or offer automatic marketing subscriptions.
4. Sharing and providers
We do not sell personal information. Necessary information is shared to deliver services, with your permission or to satisfy legal requirements:
- Waffo Pancake: hosted checkout, payments, taxes and refunds. Card details are processed by Waffo and its payment partners and are not stored on our servers.
- remove.bg: images you choose to submit for AI background removal.
- Vercel: website and API hosting, including information necessary to provide network services.
- Tencent Cloud: account and transaction database and backup hosting in Nanjing, China.
- If password reset email is enabled, email addresses and reset messages are sent through Resend. Such messages are not sent when the feature is disabled.
- Google analytics that you allow, and authorities where disclosure is legally required.
5. Retention
Account, balance and usage records are kept while an account remains available, purchased credits remain or orders need resolution. They are not cleared automatically based on visit counts. Request deletion or closure through the contact channel below. After verifying a request, we address personal information no longer needed. Legally required records and information concerning unresolved transactions or disputes may remain until the relevant obligation or dispute ends, without reuse for new marketing purposes.
Login sessions last up to 30 days. Single-use password reset tokens last up to 15 minutes. Daily database backups are retained for 30 days, so deleted data may remain in backups until rotation. Images are transmitted and temporarily processed for the current request; third-party retention is governed by each provider's policy. Hosting logs follow the provider's actual retention settings. We do not promise an automatic deletion period that has not been configured.
6. Security and international processing
We use HTTPS in transit, salted scrypt password hashes, HttpOnly session cookies and an authenticated database gateway. The database service is not exposed directly to the public internet. No system guarantees absolute security. Incidents affecting personal information will be reported to affected users and authorities as required by applicable law.
The database is in China. Hosting, image processing, payment and email providers may process information in other countries. Their applicable processing terms and transfer safeguards are provided by those vendors. We do not claim unconfirmed certifications or transfer agreements.
7. Your rights
Use your account page to view orders, credits and usage, change your password or sign out. Depending on applicable law, you can request access, correction, deletion, restriction, portability, objection or withdrawal of consent, and complain to your local data protection authority.
Submit requests using the contact channel below. We verify account ownership and normally respond within 30 calendar days, explaining any legally permitted extension. Withdrawing analytics consent does not affect earlier lawful processing. Account deletion may not immediately erase records that must be retained by law.
8. Children and changes
Accounts and paid services are for users aged 18 or older. We do not knowingly collect account information from younger users. Guardians may contact us about such information. Do not upload children's images without lawful authority to process them.
Material updates will be announced on the website in advance and dated and versioned here. When a new purpose needs additional consent, we will ask separately rather than treating this Policy as consent.
Contact us
For account support, refunds, billing disputes, privacy requests or security concerns, contact PicFiit through the channel below with your account email and relevant order ID. Do not send passwords, full card numbers or sensitive image content.