Privacy Policy

Who we are and how to reach us

Interactive-Img is operated from Switzerland. The person responsible for the processing of your data (the data controller) can be reached at info@interactive-img.com. Please use this address for any privacy question or request.

What data we collect

We only collect what is needed to run the service:

• Account data: your email address, a hashed password (never the password itself), the date you signed up and the IP address used at sign-up.
• Content you create: the images you upload, the hotspots, texts, links and videos you add to them, and the style settings of each image.
• Billing data: if you subscribe to Premium, Stripe processes your payment. We store your Stripe customer id, the subscription status and invoices, but never your card number.
• Messages: what you send us through the contact or support form, together with your email address.
• Technical data: server logs with IP address, browser type and the pages or widget requests made, used for security, abuse prevention and debugging.

Signing in with Google

If you choose "Sign in with Google", Google sends us your email address, your name and your profile picture. We use this data only to create your Interactive-Img account and to sign you in. We do not use Google user data for advertising, we do not sell it, and we do not share it with anyone except the hosting providers listed below that are needed to run the service. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke the access at any time in your Google account settings.

How we use your data

• To provide the service: store and display your interactive images, generate the embed code and serve the widget on the websites where you embed it.
• To manage your account and subscription, and to send transactional emails such as password resets or receipts.
• To answer your messages and provide support.
• To keep the service secure, detect abuse and automated sign-ups, and enforce the free plan limits.
• To understand how the website is used, through aggregated analytics.

Published images are public

An interactive image is meant to be embedded on websites. Once you publish it, the image and its hotspots can be loaded by anyone who knows its numeric id, on any site that embeds it. Do not put personal data in hotspots that you do not want to be public. We do not publish your email address or account details.

Who processes your data

We rely on the following providers, which process data on our behalf under their own data processing terms. Data may be stored in the European Union, Switzerland or the United States.

• Vercel (hosting of the website and API) and Neon (database).
• Cloudflare (content delivery, protection against abuse, and R2 storage for uploaded images).
• Stripe (payments and invoices for Premium subscriptions).
• Amazon Web Services (sending of transactional emails).
• Google (optional sign-in, and Google Tag Manager / Google Analytics for aggregated usage statistics).

Cookies

We use a session cookie to keep you signed in, and a cookie that remembers your language. Google Tag Manager may set analytics cookies to measure visits in aggregate; you can block them in your browser without affecting the service. The embeddable widget does not set cookies on the websites where it is embedded.

How long we keep data

Your account data and images are kept for as long as your account exists. Deleting an image removes it and its hotspots from our servers; the files are deleted from storage. If you want your whole account deleted, write to info@interactive-img.com and we will remove it, including all images. Server logs are kept for a short period for security purposes. Invoices are kept as long as accounting law requires.

Your rights

Under the Swiss Federal Act on Data Protection and, where applicable, the GDPR, you can ask us at any time to:

• access the personal data we hold about you and receive a copy of it,
• correct data that is inaccurate (your email and password can be changed in your account),
• delete your data or your whole account,
• object to or restrict a processing, and lodge a complaint with your data protection authority.

Security

All traffic is encrypted with HTTPS. Passwords are stored as salted hashes. Access to the database and storage is restricted to the operator. No system is perfectly secure, so please use a unique password for your account.

Children

The service is not directed at children under 16 and we do not knowingly collect data from them.

Changes to this policy

We may update this policy when the service changes. The current version is always available at this address, with the date of the last update at the top.