Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between you (“Customer”, “you”, or “Controller” where applicable) and FAPIHUB (“FAPIHUB”, “we”, “us”, “our”, or “Processor” where applicable) for use of the FAPIHUB background removal API and related website services (the “Service”).

This DPA describes how personal data is processed in connection with the Service, including account data, billing data, API usage metadata, and image content submitted for processing. It should be read together with our Privacy Policy.

By creating an account, using the API, or otherwise using the Service, you acknowledge this DPA. If you require a signed paper or custom enterprise DPA, contact us at support@fapihub.com.

1. Definitions

Personal Data means any information relating to an identified or identifiable natural person.
Processing means any operation performed on Personal Data, including collection, storage, transmission, and deletion.
Controller means the party that determines the purposes and means of Processing Personal Data.
Processor means the party that Processes Personal Data on behalf of a Controller.
Customer Content means images and related parameters that you or your end users submit to the API for background removal or related image processing.
Account Data means information about you as our customer (for example email address, authentication data, subscription status, and API keys).
Sub-processor means a third party engaged by us to Process Personal Data in connection with the Service.
Applicable Data Protection Law means GDPR, UK GDPR, and other data protection laws that apply to the Processing described in this DPA.

2. Roles of the Parties

2.1 Account and billing data

For Account Data and billing-related information about you as a customer of FAPIHUB, we act as an independent Controller. We collect and use this data to operate accounts, authenticate API access, enforce plan limits, process payments, prevent abuse, and provide support.

2.2 Customer Content (images and related inputs)

When you submit Customer Content through the API (including images that may contain Personal Data of your end users), you are the Controller (or act on behalf of the Controller), and FAPIHUB acts as a Processor. We Process Customer Content only to provide the image processing features you request and as otherwise described in this DPA.

2.3 Your responsibilities as Controller

You are responsible for:

Ensuring you have a lawful basis to submit Customer Content to the Service;
Providing required notices to, and obtaining any required consents from, your end users;
Configuring and securing your API keys;
Not submitting special-category data or unlawful content unless you have a valid legal basis and our prior written agreement where required.

3. Subject Matter, Nature, and Purpose of Processing

Topic	Description
Subject matter	Provision of background removal and related image processing API services, account management, usage metering, billing, and support.
Duration	For the term of your use of the Service, and thereafter only as needed for legal, security, billing, or dispute-resolution purposes as described in this DPA.
Nature of processing	Receipt of image binaries and parameters; ephemeral processing; return of processed image binaries; logging of request metadata; account authentication; usage counting; payment processing via Stripe.
Purpose	To deliver the Service you request, secure the platform, enforce quotas and rate limits, bill for usage, and improve reliability and support.
Data subjects	You and your authorized users; individuals whose images appear in Customer Content you submit; payment-related contacts as applicable.

4. Categories of Personal Data

4.1 Customer Content (images) — processed, not stored by FAPIHUB

Images you upload to the API may contain Personal Data (for example faces, product shots with people, or other visual information). FAPIHUB processes Customer Content as follows:

The image is received as a binary upload (multipart form data);
It is validated in memory (file type and size limits);
It is forwarded as binary data to our image processing infrastructure for the requested operation;
The processed result is returned to you as binary data;
We do not store the submitted photo or the processed output image in our application database or media storage.

After the request completes, image content is not retained by the FAPIHUB application. Transient buffers used during the request lifecycle are discarded when processing ends.

We may log metadata about the request (see Section 4.3), such as file size in bytes, endpoint, status code, and timing — never the image pixels themselves.

4.2 Account and authentication data

When you register or sign in, we may Process:

Email address;
Password (stored only as a secure hash, if email/password authentication is used);
Name and profile information provided via Google sign-in (when you choose Google OAuth);
Account status, plan, and subscription period dates;
API keys you create (key value, label, active status, last-used time).

4.3 API usage and request logs

For security, billing, quota enforcement, debugging, and dashboard analytics, we store request metadata, including:

Associated user and API key reference;
Endpoint path and HTTP method;
Request type (for example matte, mask, blur, color, gradient, shadow, generate);
HTTP status code, success/failure flag, and response time;
File size (bytes) of the successful response where applicable;
IP address and user agent;
Timestamp;
Error messages (for failed or rejected requests);
Aggregated usage counters and short-window chart aggregates (success/error counts by day).

Request logs do not include image binary content or request body image data.

4.4 Billing and invoice data

For paid plans we Process:

Stripe customer and subscription identifiers;
Plan name, amounts, currency, invoice status and numbers;
Invoice PDFs and hosted invoice URLs (PDFs may include name, email, and billing details as rendered by Stripe).

Payment card numbers and full payment method details are handled by Stripe and are not stored in our application database.

4.5 Website and session data

We use session cookies and CSRF cookies as needed for authenticated dashboard access. We also use Google Analytics on public and product pages, which may collect device, browser, and usage information via cookies or similar technologies.

5. Image Processing Flow

You authenticate an API request with your API key.
You submit an image as binary multipart data, optionally with processing parameters (for example model name, colors, or blur settings).
We validate the upload and authorize the request against your plan, quota, and rate limits.
We transmit the image binary and parameters to our image processing infrastructure.
We return the processed image binary to you in the HTTP response.
We record request metadata and update usage counters. We do not persist the image file.

Processing parameters you send (for example model selection or color values) are used only to fulfill that request and are not stored as image content. EXIF and similar embedded metadata may be stripped during processing to reduce payload size and protect privacy.

6. Sub-processors

You authorize us to engage the following categories of Sub-processors to deliver the Service:

Sub-processor / category	Purpose	Data involved
Image processing infrastructure provider	Perform background removal and related image operations	Customer Content (image binary and processing parameters)
Stripe	Payments, subscriptions, invoices, customer billing portal	Email, name/username, customer and subscription IDs, payment and invoice data
Google (OAuth)	Optional account sign-in	Email, profile name, and related identity data you authorize
Google Analytics	Website and product usage analytics	Device/browser data, page views, approximate location derived by Google, cookie identifiers
Hosting / database infrastructure	Run the application, store Account Data, logs, invoices, and sessions	Account Data, request metadata, invoice files, session data

We will use commercially reasonable efforts to ensure Sub-processors provide appropriate data protection commitments. For enterprise customers requiring advance notice of Sub-processor changes, contact support@fapihub.com.

7. Instructions and Scope of Processing

Where we act as Processor for Customer Content, we will Process such data only:

To provide the API features you invoke;
In accordance with this DPA and our documented Service behavior;
As required by Applicable Data Protection Law (in which case we will inform you unless legally prohibited from doing so).

Your API calls and account configuration constitute your documented instructions to Process Customer Content for the selected image operations.

8. Security Measures

We implement technical and organizational measures appropriate to the risk, including:

API key authentication for image processing endpoints;
HTTPS for Service access in production deployments;
Password hashing for credential-based accounts;
Access controls for customer dashboards and staff administration;
Rate limiting and quota controls to reduce abuse;
Ephemeral handling of Customer Content (no application-level image retention);
Logging of security-relevant request metadata for monitoring and support.

No method of transmission or storage is completely secure. You are responsible for keeping API keys confidential and for securing systems that call our API.

9. Retention and Deletion

Data category	Retention
Customer Content (images)	Not retained by the FAPIHUB application after the request is completed. Processed only in transit / memory for the duration of the request.
Request logs (metadata)	Retained for operational, security, and support purposes. Staff may purge older logs; typical operational cleanup targets records older than 14 days, but retention may vary for abuse prevention, legal holds, or troubleshooting.
Usage counters / chart aggregates	Kept for the relevant billing period and dashboard history; chart aggregates use a short rolling window (approximately 15 days).
Account Data and API keys	Retained while your account is active and as needed after closure for security, billing, and legal compliance.
Invoices and billing records	Retained as required for accounting, tax, and legal obligations.

Upon written request after termination of the Service, and where we act as Processor, we will delete or return Customer Content remaining under our control, if any, except for data we must keep under law or that has already been discarded because it was never stored.

10. International Transfers

Personal Data may be Processed in Hungary and in other locations where we or our Sub-processors operate infrastructure. Where Personal Data is transferred internationally, we will take steps designed to ensure appropriate safeguards under Applicable Data Protection Law (for example standard contractual clauses or equivalent mechanisms where required).

11. Assistance with Data Subject Rights

Taking into account the nature of Processing, we will provide reasonable assistance to you in responding to requests from data subjects to exercise rights under Applicable Data Protection Law (access, rectification, erasure, restriction, portability, and objection), insofar as those rights relate to Personal Data we Process on your behalf.

Because Customer Content images are not stored by our application, we generally cannot retrieve or delete a specific uploaded photo after the API response has been returned. Requests related to Account Data, logs, or billing records can be directed to support@fapihub.com.

12. Personal Data Breach

If we become aware of a Personal Data breach affecting Customer Content we Process as Processor, we will notify you without undue delay and provide information reasonably available to us to help you meet your notification obligations. You remain responsible for notifying your end users and supervisory authorities where required, unless applicable law assigns that duty to us.

13. Audits and Compliance Information

Upon reasonable written request, and no more than once per twelve (12) month period (unless required by a supervisory authority or following a confirmed breach), we will provide information reasonably necessary to demonstrate compliance with this DPA. Enterprise customers may request additional security questionnaire responses or contractual terms by contacting us.

14. Confidentiality

We ensure that persons authorized to Process Personal Data are subject to appropriate confidentiality obligations and Process such data only as needed to perform their duties.

15. Liability and Order of Precedence

Liability under this DPA is subject to the limitations and exclusions set out in the main Service terms or other commercial agreement between the parties, to the extent permitted by Applicable Data Protection Law. If there is a conflict between this DPA and our Privacy Policy regarding Processing of Customer Content as Processor, this DPA controls for that subject matter.

16. Changes

We may update this DPA from time to time to reflect operational, legal, or Sub-processor changes. The “Last updated” date at the top of this page will be revised when changes are published. Material changes affecting Processing of Customer Content will be communicated through the Service or by email where appropriate.

17. Contact

For questions about this DPA, data protection requests, or enterprise agreements:

By email: support@fapihub.com