Instant Studio Lighting
Privacy policy
Effective 3 October 2026. Applies to the Instant Studio Lighting app and this website.
Instant Studio Lighting relights photographs you choose. This policy says what that involves for your data, in the order it happens.
The controller responsible for this data is Jonas Falk, Karlsgatan 6, 267 76 Ekeby, Sweden. Reach us at [email protected].
What we process
Optional account details, pseudonymous guest identities, sessions, uploaded photos, lighting settings, generated results, credit and purchase records, limited security and operational logs, crash diagnostics, and masked session-replay interaction data.
Why we process it
We process account details, photos, lighting settings, results and credits because they are necessary to provide the service you request and perform our contract with you. We process security, fraud-prevention, support, diagnostic and operational data for our legitimate interests in protecting accounts, resolving failures and keeping the service reliable. We retain records where necessary to meet accounting, tax, consumer-protection or other legal obligations.
Who receives it
Photos and lighting settings are sent through our server to OpenAI, our third-party AI image-generation provider, to produce the requested relighted image. RevenueCat and Apple or Google process purchase and credit information. Our hosting, database and transactional-email providers process only the data needed to provide their services. Sentry processes pseudonymous crash diagnostics, application logs and sampled session replays for troubleshooting; replay text, images and webviews are masked. We may disclose information when required by law or to establish, exercise or defend legal claims. We do not sell personal data.
AI processing permission
Before uploading a photo for AI generation, we ask for your explicit permission to share your selected photo and lighting settings with OpenAI, our third-party AI image-generation provider, to create the requested relighted image. Photos may contain personal information, including faces. Permission is saved on your device for future generations under the current policy. You can select “Don’t show again” before allowing sharing to hide this information on this device. A policy version change requires permission again. If you decline, the photo is not uploaded for AI generation.
Retention
Source photos are deleted after processing, with a one-hour fallback limit if immediate deletion fails. Server result copies expire after one day. Private device copies remain until account deletion, app removal or device storage removal. Sessions remain until they expire or you revoke them. Financial and legal records are retained only for the period required by applicable law and are pseudonymised after account deletion where possible. Security, diagnostic and operational records are retained for the shortest configured period needed to investigate reliability, security and refund issues.
Your rights and controls
The app lets you revoke sessions, reset your password and delete your account. Depending on the circumstances, you may request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. Email us to exercise a right or ask a privacy question. You may also lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.
Information needed to use the service
Registration is optional. You can buy credits, generate images and save results without providing a name, email address or password. A random guest identifier and secure device credential protect your balance and results. Email and authentication credentials are required only if you choose to create an account. A photo and lighting settings are required when you request a relight. Purchase information is required only if you buy credits. Without the relevant information, we cannot provide that part of the service.
What is held, and for how long
| Data | Linked to your account or guest identity | Purpose | Retention and control |
|---|---|---|---|
| Email and optional name (registered accounts only) | Yes | Account, security, support | Removed or pseudonymised when you delete your account |
| User ID or random guest identifier and secure device credential | Yes | Account or guest access, security, credit balance | Guest credential stored as a hash on the server; linked guest credentials removed on account deletion |
| Session metadata and IP address | Yes | Authentication and abuse prevention | Session expiry or revocation |
| Uploaded photos | Yes | Relighting | Deleted after processing; one-hour fallback limit |
| Generated photos | Yes | Relighting | Server copy expires after one day; the device copy is yours to keep or delete |
| Purchases and credits | Yes | Purchases and fraud prevention | Financial audit records pseudonymised where possible |
| Crash diagnostics and application logs | Pseudonymous user ID only | App functionality, reliability and diagnostics | Held for the crash reporter's retention period; no personal detail by default |
| Masked session replay and product interaction | Pseudonymous user ID only | App functionality, troubleshooting and diagnostics | Sentry samples 10% of sessions and sessions containing an error; text, images and webviews are masked |
| Operational logs | Job and event IDs only | Reliability, security and refunds | Held for the hosting retention period; photo URLs and auth tokens are never logged |
Tracking
The app does not track you across other companies' apps or websites, does not use advertising identifiers, and does not sell personal data. This website sets no cookies and runs no analytics. It loads the Archivo and Fraunces typefaces from Google Fonts, which means Google receives your IP address when a page loads.
Children
Instant Studio Lighting is not directed at children and we do not knowingly collect data from anyone under 13. If you believe a child has created an account, email us and we will remove it.
Where data is processed
Processing takes place with our hosting, image, payment, email and diagnostics providers, which may be outside your country. Where personal data is transferred outside the European Economic Area, the transfer relies on an adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses. Contact us for information about the safeguard relevant to a particular provider.
Automated processing
The service uses AI to generate relighted images, but we do not use personal data to make solely automated decisions that produce legal or similarly significant effects about you.
Changes
If this policy changes, we will publish the updated version here and change the effective date above. Where required by law, we will provide additional notice or ask for consent.