Privacy policy

The short version

You upload a photo so we can restore it. We use it for that and nothing else. Your photos are never used to train AI models, never sold, never published, and never browsed by anyone for curiosity. Uploads and results are deleted automatically within 24 hours, and you can delete them sooner at any moment.

This page is the full version of that promise, written so it can be held against us.

Who is responsible for your data

The operator of Epoha, and the controller of the personal data described here, is ФОП Кравченко Євген Євгенович (Yevhen Kravchenko, sole proprietor), registration and tax number 3475305692, registered at Tovaryska Street 60, Zaporizhzhia, Zaporizhzhia oblast, 69000, Ukraine.

For anything about your data — access, deletion, a complaint — write to privacy@epoha.pro. For everything else, hello@epoha.pro. A real person reads both.

Epoha is offered to people in the European Union, the United Kingdom and elsewhere. Where the GDPR or UK GDPR applies to you, we apply it to you, regardless of where we are established.

What we process

We keep this deliberately short. We process:

• The photographs you upload, and the restored versions generated from them.
• Your email address, if you give us one — to join the early-access list, to receive a result, or to get a receipt.
• Payment status, once payments open: confirmation from the payment provider that a payment succeeded or failed. Card numbers never reach our servers.
• Basic technical data any website receives: browser type, approximate region, pages visited, and security logs used to stop abuse.

We do not ask you to create an account. We do not build advertising profiles, and we do not track you across other websites.

Photographs can be sensitive, and we treat them that way

A family photograph can reveal things the law treats as special categories of personal data — ethnic origin, religious belief, health. You are not asked to declare any of that, and we do not analyse, tag or infer it. We do not run biometric identification, we do not attempt to name the people in your photos, and we do not match faces across uploads.

When you upload a photograph, you are explicitly asking us to process that image in order to restore it. That request is the basis on which such data is processed, and it is used for that single purpose. You can withdraw it at any time by deleting the photo, which also deletes the result.

Why we are allowed to process it

Under the GDPR we rely on the following legal bases, and on nothing else:

• Performance of a contract with you — processing your photo to deliver the restoration you asked for, and handling your payment.
• Your consent — sending you early-access or product emails, if you asked for them. You can withdraw consent at any time, and every email carries an unsubscribe link.
• Our legitimate interests — keeping the service running, preventing abuse and fraud, and defending legal claims. We balance this against your rights and keep the data minimal.
• Legal obligation — retaining accounting and tax records for the period the law requires.

How long we keep things

Uploaded photographs and the restored results are deleted automatically within 24 hours of processing. You do not have to ask, and you do not have to trust us to remember: deletion is the default, not a favour. You can also delete them immediately yourself, and a deletion request by email is acted on without delay.

Email addresses on the early-access list are kept until you unsubscribe or ask to be removed. Security and anti-abuse logs are kept for a short period proportionate to that purpose. Payment and accounting records are kept for as long as tax law requires, and no longer.

Because uploads are deleted within 24 hours, download the file you paid for when you get it. We cannot restore what has already been deleted, and we consider that a feature rather than a shortcoming.

Who else is involved

Running a service means other companies handle parts of it. We use as few as possible, and each one is bound to process data only on our instructions:

• Hosting and content delivery — the infrastructure that serves this site.
• AI processing — the model provider that performs the restoration. Photos are sent for the sole purpose of generating your result, and the provider is contractually barred from using them to train models. This provider will be named here before restoration goes live.
• Payments — a payment provider handling the transaction. It will be named here before payments open. Until then, no payment data exists because no payments are taken.
• Email delivery — the service that sends early-access and transactional email.

We do not sell personal data. We do not share it for anyone else’s marketing. We disclose data to public authorities only where the law genuinely requires it, and we push back where it does not.

Where your data goes

Our operator is established in Ukraine, and the providers above may process data in the European Economic Area, the United Kingdom, the United States or elsewhere. Where personal data leaves the EEA or the UK, the transfer is covered by an adequacy decision or by Standard Contractual Clauses, together with technical measures such as encryption in transit.

How your photos are protected

Uploads travel over encrypted connections and are stored on access-restricted infrastructure for the short period they exist. Access is limited to what is needed to operate the service. Automatic deletion within 24 hours is itself the strongest protection we offer: data that no longer exists cannot be leaked.

No online service can promise perfect security, and we will not pretend otherwise. If a breach ever affects your data and poses a risk to you, we will notify you and the competent authority within the timeframes the law sets.

Your rights

If the GDPR or UK GDPR applies to you, you have the right to:

• Ask what personal data we hold about you and receive a copy.
• Have inaccurate data corrected.
• Have your data erased — for photographs, this happens by default within 24 hours anyway.
• Restrict or object to processing based on our legitimate interests.
• Receive data you provided in a portable, machine-readable form.
• Withdraw consent at any time, without affecting processing carried out before you withdrew it.

Write to privacy@epoha.pro and we will act on your request within one month, and tell you if we need longer and why. Exercising these rights is free.

If you think we have handled your data badly, please tell us first — we would rather fix it. You also have the right to complain to a data protection authority: in the EEA, the authority in your country of residence; in the United Kingdom, the Information Commissioner’s Office; in Ukraine, the Ukrainian Parliament Commissioner for Human Rights.

Cookies and analytics

Epoha sets no advertising cookies and runs no cross-site tracking. There is nothing here to sell your attention with. If we add usage analytics, it will be a privacy-preserving, cookieless kind that reports aggregate numbers and cannot identify you — and this page will say so before it is switched on.

Children

The service is intended for people aged 16 and over. This is about who operates the service — not about who appears in the photographs. Old family photographs are full of children, and restoring them is exactly what Epoha is for.

Changes to this policy

If this policy changes, the current version always lives at this address with its date. If a change materially affects your rights, we will say so plainly rather than quietly editing the text.

Last updated: 19 August 2026. These terms apply from the moment this page is published and for as long as you use the service.