Privacy Policy

We collect the following types of information:

• Account Information: Email address and website URL when you activate the plugin.
• Usage Data: Number of images processed, file sizes, and optimization statistics.
• Technical Data: WordPress version, PHP version, and plugin version for compatibility.

Whether we store your images depends on your plan:

• On WordPress Free and Starter, API Ignite, and the Developer Sandbox, and on WordPress Pro and Business with Cloud Offload turned off, each upload is processed in temporary, encrypted processing storage (AES-256).
• On these plans, the optimized image is returned to your site or application, the upload is deleted automatically within 24 hours, and we keep no copy. Your originals stay on your own server or storage.
• On WordPress Pro and Business, Cloud Offload is optional: if you turn it on, we keep the original image in our secure, encrypted cloud storage (AES-256) and serve the optimized copy through the smallPict CDN. On API Velocity and Momentum (production keys), we keep the original image in our secure, encrypted cloud storage (AES-256), where it moves to long-term archive storage after 90 days, and we store the optimized copy for delivery through the smallPict CDN.
• Images on these plans are kept for as long as your account is active and deleted as described under Data Retention. If you connect your own storage or CDN (BYO), those files live in your own account, outside SmallPict: you are responsible for them, and we do not keep a backup of them.

We implement industry-standard security measures including encryption in transit (HTTPS/TLS), secure cloud infrastructure, and regular security audits to protect your data.

You have the right to access, correct, or delete your personal data. Contact us at privacy@smallpict.app for any data-related requests.

For any questions about this Privacy Policy, please contact us at: privacy@smallpict.app

We process your personal data under the following legal bases: performance of a contract (account creation, billing, and service delivery), legitimate interest (fraud prevention, service analytics, and security monitoring), and consent (marketing communications, which you may withdraw at any time). Where Indonesian law applies, processing is likewise based on your consent, contractual necessity, or our legitimate interest as data controller under UU PDP No. 27/2022.

If you are located in Indonesia, in addition to the rights described elsewhere in this Policy, UU PDP No. 27/2022 grants you the right to: obtain information about the clarity of identity, legal basis, purpose, and accountability for the processing of your personal data; complete, update, or correct errors in your personal data; access and obtain a copy of your personal data; terminate the processing, delete, and/or destroy your personal data; withdraw your consent; object to automated individual decision-making, including profiling; and request compensation for violations of the processing of your personal data in accordance with applicable law. To exercise any of these rights, contact us at privacy@smallpict.app.

If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority and affected users without undue delay. For users protected under UU PDP No. 27/2022, this notification will occur within 3x24 (seventy-two) hours of us becoming aware of the breach, as required by Indonesian law. For users protected under GDPR, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach, and will notify affected individuals directly where the breach is likely to result in a high risk to their rights and freedoms.

To provide the service, SmallPict relies on trusted service providers (cloud hosting, content delivery, payments, and email), which may process your data in countries other than your own. A list of sub-processors is available on request. Where we transfer personal data of EU/EEA users outside the EU/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses. Where we transfer personal data of Indonesian users outside Indonesia, we do so in accordance with Article 56 of UU PDP No. 27/2022, ensuring the receiving country provides an equivalent or higher level of personal data protection, or that appropriate binding safeguards are in place.

We retain your account data for as long as your account remains active. Images and their backups are retained only where we store your images (WordPress Pro and Business with Cloud Offload turned on, API Velocity and Momentum); temporary uploads in all other cases are deleted within 24 hours. If you close or cancel your account, we retain your data for 7 days to allow for account recovery, after which it is permanently deleted from our production systems, subject to any legal obligation to retain certain records longer (e.g., billing records for tax purposes).

SmallPict is not directed at, and we do not knowingly collect personal data from, individuals under the age of 18 (or the age of majority in your jurisdiction, if different). If we become aware that we have inadvertently collected personal data from a minor without appropriate consent, we will take steps to delete that data promptly.

For any questions, requests, or complaints regarding this Privacy Policy or our data processing practices, contact us at privacy@smallpict.app.