Privacy Policy

1. Who is responsible

Ontara LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States ("we") is the controller for personal data processed through StripC2PA. Contact: support@ontara.co.

2. Files you process

• Server processing: the file is transmitted over HTTPS to our Cloudflare Worker, parsed in memory and discarded as soon as the response is sent. It is never written to disk, cached, logged, inspected by people or used for training.
• Local processing (paid plans): the file is read and rewritten inside your browser. It is not sent to us or anyone else.

Files can contain personal data, such as GPS location or names in metadata. Removing that data is the purpose of the Service, and we do not keep a copy of it.

3. Data we collect

• Quota key: to enforce daily limits we compute a keyed hash (HMAC-SHA-256) of your IP address and store it with operation counts for up to 3 days. We never store the raw IP address. A keyed hash is still pseudonymous personal data, and we treat it as such.
• Operational logs: for each request we log the file type, size, processing time, number of findings and error events. Logs never contain file names or contents. They are kept by Cloudflare for a short period, currently no more than 30 days.
• Network data: like any website, our hosting provider Cloudflare processes your IP address, user agent and request metadata to deliver the site and protect it from attacks.
• Purchase data (paid plans): the merchant of record collects your name, email, billing address, payment details and tax information. We receive your email address, country, order and subscription identifiers, plan and payment status — never your full card details.
• License activation (paid plans): a hash of your license key, a random device identifier generated in your browser, a keyed hash of your IP address and timestamps, to limit each key to 3 active devices and prevent sharing.
• Support: if you email us, we receive your message and email address.

4. Cookies and browser storage

We do not use cookies, analytics, advertising, tracking pixels or third-party scripts, and the site loads its fonts from our own domain. If you have a paid plan, your license key, a short-lived access token, a random device identifier and the local processing engine are kept in your browser's storage so the feature works. You can delete them at any time by signing out of the plan or clearing site data.

5. Purposes and legal bases

• Providing the Service you request, including processing files and paid plans: performance of a contract (GDPR Art. 6(1)(b)).
• Quotas, abuse prevention, security and license-sharing limits: our legitimate interest in keeping the Service available and fair (Art. 6(1)(f)).
• Tax, accounting and legal obligations: legal obligation (Art. 6(1)(c)).
• Answering support requests: contract or legitimate interest.

We do not use your data for automated decision-making with legal or similarly significant effects, and we do not build profiles.

6. Who we share data with

We do not sell or rent personal data and do not share it for cross-context behavioural advertising. We use these service providers, bound by contract to process data only on our instructions or as independent controllers where stated:

• Cloudflare, Inc. (United States) — hosting, network delivery, logs and storage of quota and license records.
• Dodo Payments — merchant of record for purchases, acting as an independent controller for payment and tax data under its own privacy policy.
• Our email provider, for support correspondence.

We may disclose data when required by law or to protect our rights, users or the public, and to a successor in a merger or acquisition subject to this policy.

7. International transfers

We are based in the United States and our providers may process data in other countries. Where data from the EEA, the UK or Switzerland is transferred to countries without an adequacy decision, we rely on the EU Standard Contractual Clauses, the UK Addendum or the EU–US Data Privacy Framework, as applicable.

8. Retention

• Files: not retained.
• Quota keys and counts: up to 3 days.
• Operational logs: up to 30 days.
• License and order records: for the life of your plan, then as long as tax and accounting law requires (typically up to 7 years).
• Support emails: up to 2 years after the conversation ends.

9. Security

All traffic is encrypted with TLS. Files are processed in isolated memory and never persisted, IP addresses are only stored as keyed hashes, and license keys are stored only as hashes. No system is perfectly secure, but we limit what we hold so there is little to expose.

10. Your rights

Depending on where you live (for example under the GDPR, the UK GDPR or US state privacy laws such as the CCPA), you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict processing, to withdraw consent and to not be discriminated against for exercising these rights.

To exercise them, email support@ontara.co. Because we hold so little, we may need your license key or order number to find your records; quota hashes and logs cannot be linked to you and expire on their own. You also have the right to lodge a complaint with your local data protection authority.

11. Children

The Service is not directed at children under 16 and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes

We may update this policy. The date at the top shows the latest version; we will notify paid users of material changes by email or on the website.

13. Contact

Ontara LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States. Email: support@ontara.co.