Privacy policy

What we collect

• The portrait photo you upload is sent to external AI services only after your explicit consent, to create the document photo. The photo is made by the GPT-Image-2.5 image model from OpenAI; the request reaches it through the OpenRouter gateway. Anthropic's Claude AI model receives a reduced copy of the photo to check it before generation and, when needed, checks the result. Small encrypted previews of the source and the result are retained for no more than 7 days, then deleted automatically; only the owner's password-protected dashboard can access them. If you decline, generation does not start.
• The router.cheap gateway: the request to the same OpenAI model can also go through router.cheap, a compatible gateway — the second photo variant goes through it when the owner switches that variant on, and the main request goes through it if the owner switches the gateway. Your portrait is sent there on the same terms: only after your explicit consent and only to create the document photo. We do not separately confirm the terms of this route — we have no public information about how the gateway handles the image.
• The preview does not require a payment card. Payment details are requested only after you have seen the result and ordered the digital HD set for €2.99; the invoice is in euros, and if your card is in another currency, your bank converts the amount at its own rate.
• The result taken to checkout is encrypted and retained for up to 24 hours if unpaid, or up to 30 days after successful payment for download and support.
• The link to a finished result — so you can come back to the photo, pay another way or share it — keeps the finished photo (never the source selfie) encrypted for up to 24 hours, or up to 30 days after payment, like the paid photo. Anyone who has the link can open it; you can delete it earlier on the result page.
• Plata by mono processes card data. Anfas.Pro does not receive or store the full card number or CVV; we retain the order number, amount, status and technical payment identifiers.
• Basic analytics (page visits, country, browser and site actions) is collected by Plausible only with your analytics consent, in aggregate and without cookies; it is not linked to your photo or email.
• Advertising measurement uses Yandex Metrica only with your marketing consent. Cookies, pseudonymous browser identifiers (ClientID) and ad-click identifiers (yclid) link page visits, site actions and confirmed payments to advertising; payments include the actual amount and currency. We retain advertising attribution for up to 21 days. Webvisor and session recording are disabled; photos, email addresses, card data and access keys are not sent to analytics. We do not sell data. Your cookie choices are stored for up to 180 days; you can withdraw your consent using the footer settings.
• Error reports are captured by Sentry without your photo, email, or payment data — only stack traces and request metadata.

Legal basis (GDPR)

Where portrait processing falls within GDPR Article 9, generation starts only after your explicit consent in the checkbox shown before the Generate button. The source goes to GPT-Image-2.5 from OpenAI through the OpenRouter gateway and to Anthropic's Claude for the check; small encrypted previews are retained for no more than 7 days for the password-protected owner dashboard and then deleted automatically. The same consent covers the router.cheap gateway, used for the second photo variant or when the owner switches the gateway. Without consent no request goes to any model and no image is generated. You can withdraw before a future generation by leaving the checkbox unticked; send data-rights requests to privacy@anfas.pro.

What we do not do

• We do not sell, rent or share your photo with anyone other than the sub-processors listed below.
• Small encrypted previews are retained only after explicit generation consent and are automatically deleted within 7 days.
• We do not use your photo to train any model, and Anthropic, which checks the photo, does not train models on data sent through its API under its commercial terms.
• We make no such promise for the other routes: OpenRouter and OpenAI handle the request under their own published terms, and we found no public documentation from the router.cheap gateway on how long images are kept or whether they are used for training, so we do not separately confirm the terms of these routes. We ourselves do not use your portrait to train models on any route.
• We do not send marketing emails unless you opt in explicitly.

Sub-processors

The following companies process your data on our behalf as GDPR data processors. Each has its own privacy policy, except the gateway noted separately below:

• OpenRouter, Inc. (AI model gateway, United States) — passes your portrait to the image model that makes your document photo and returns the result.
• OpenAI (GPT-Image-2.5 image model, United States) — makes your document photo from the portrait you upload; the request reaches it through OpenRouter.
• router.cheap (compatible gateway to the OpenAI image model; its legal entity and country are unknown to us) — the second photo variant goes through it when the owner switches that variant on, and the main request goes through it if the owner switches the gateway; then there is an intermediary in the chain. We found no public documentation of its terms — retention periods, use of images — and we do not separately confirm them.
• Anthropic PBC (Claude AI models, United States) — checks a reduced copy of the uploaded photo before generation and, when needed, the result: only technical points such as whether it is a real photo, the light, background, eyes and clothing. It also answers the questions you type to the helper chat on the site. It receives the text of your question, up to two previous questions and answers from the same chat and the requirements of the document on the page you are viewing; chat messages carry no photos. We keep the text of chat questions and answers for 30 days to see where the helper answers poorly. If you press “What is wrong and how to retake it?” on the upload screen or attach a photo in the helper chat, Anthropic also receives a reduced copy of that photo to suggest what to change; we do not store that photo. Anthropic does not train models on this data and deletes it within 30 days, unless it has to keep it longer to enforce its usage policy or by law; cross-border transfer is governed by the EU Standard Contractual Clauses included in Anthropic's data processing addendum.
• Vercel Inc. (United States) — application hosting and serverless functions.
• Neon Inc. (United States) — storage for metrics, order data, encrypted short-lived previews and the encrypted selected result for the periods stated above.
• Universal Bank / Plata by mono (Ukraine) — acquiring and secure card-data processing.
• Plausible Analytics (Germany / EU) — cookieless aggregate analytics only with analytics consent.
• Yandex Metrica — advertising measurement using cookies and pseudonymous identifiers only with marketing consent.
• Sentry (United States) — server-side error reporting.

International data transfer

Your portrait photo is transmitted to the United States: to GPT-Image-2.5 from OpenAI through the OpenRouter gateway to generate the document photo, and to Anthropic's Claude for the check. The transfer to Anthropic is covered by the EU Standard Contractual Clauses (SCCs) included in Anthropic's data processing addendum. For the OpenRouter route and the router.cheap gateway we cannot point to separately verified contractual terms and we do not confirm them on the intermediaries' behalf; the consent you give before generation covers these transfers as well. For checkout, only the selected result is separately encrypted and retained for up to 24 hours if unpaid or up to 30 days after successful payment.

Telegram bot @anfas_pro_bot and mini app

You can also make a document photo in Telegram — in the @anfas_pro_bot bot and its mini app (www.anfas.pro/tg/). Below is what data we receive there, where it comes from, why we need it and how long we keep it.

• Your bot record. When you start the bot, use the mini app or accept the terms, we store your Telegram ID (the numeric account number), the ID of your chat with the bot and your Telegram language, so the bot can reply, send files and write in your language. The record also holds your Telegram app version (it tells the bot which messages your app can display), the time you accepted the terms of service (Telegram requires this before a payment in Stars) and a flag if you turned reminders off. We do not store your name, @username or phone number, nor your messages to the bot, except a refund reason (see below).
• Data from the mini app. When the mini app opens, Telegram passes it your profile details with a digital signature. We check the signature so that nobody can act in your name, and from these details we take only your ID and language.
• A photo you send to the bot in the chat is not stored by us: it stays on Telegram's servers. The buttons under the photo open the mini app with a link to the picture; the link works for 15 minutes and only you can open it. Through it the picture passes via our server to the mini app and is not saved anywhere on our side. From there the photo is handled the same way as one uploaded on the site.
• The free check in the mini app runs on your device. Only the outcome — whether the photo fits or which points failed — and the chosen document reach our server. The bot posts this outcome to your chat, and we do not store it.
• The document photo in the mini app is made by the same generator as on the site: consent before generation, sending the portrait to AI services, previews and result retention work as described in the sections above. After payment the bot sends the finished photo and the print sheet to your chat; these messages stay in your Telegram chat history.
• Payment in Stars. Telegram charges the Stars and sends us a confirmation with the amount and the charge ID. For each order from the bot we store which Telegram ID and chat it belongs to, the language, whether a reminder was sent and whether the files were delivered, and after payment the charge ID: without it the Stars cannot be refunded. An order created on the website and paid with Stars in Telegram is linked to your ID and chat in the same way, and the bot sends a copy of the files to that chat if Telegram allows it. The result is kept for the same periods as with payment on the site: up to 24 hours if unpaid and up to 30 days after payment.
• Reminder. If an order stays unpaid, the bot may remind you about it once in the chat. The “Stop reminders” button turns reminders off for good; if you block the bot, they turn off on their own.
• Star refunds. If you ask for a Star refund through the /paysupport command, we save the request: the order number, your Telegram ID and chat ID, the language, the reason you write (up to 1,000 characters), and the status and time of the decision. The bot sends the service owner a request card in Telegram — order number, amount, payment date, your Telegram name, @username, ID and the reason — so the owner can decide on the refund. A request you left without a reason is deleted after 7 days, and a decided request 180 days after the decision.
• What the mini app remembers on your device. To suggest the right document next time, the mini app remembers the last one you chose — the country and the document type, with no photo or personal data. The value is kept in Telegram's storage on this device; if your Telegram version does not support that storage, it is kept in Telegram's cloud storage for this bot and is then also available on your other devices. Like the site, the mini app keeps a copy in the browser's storage together with the interface language.
• Your bot record and the links between your orders and your chat are kept with no time limit, until you ask us to delete them. Write to privacy@anfas.pro and include your Telegram ID — the bot's /id command shows it.
• Telegram itself processes your chat with the bot, the files you send and payments in Stars under its own rules: telegram.org/privacy.

Your rights

Under GDPR you can request a copy of any personal data we hold about you (Art. 15), correction (Art. 16), deletion (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and you may withdraw consent or object to processing (Art. 21) at any time. To exercise any of these rights, write to privacy@anfas.pro — we respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

Data controller

The data controller is the operator of Anfas.Pro; full seller identification is published in the Terms of Service. Email: privacy@anfas.pro.