Privacy policy

Who is responsible

ilvlup.ai decides what happens to your data and is responsible for it under the GDPR. You can reach us at support@ilvlup.ai for anything on this page, including a deletion request.

What we collect

Only what the product needs to do its job:

• •The photos and chat screenshots you upload, and any text you paste into the coach.
• •The analysis we produce from them: scores, observations and suggestions.
• •Your email address and password, if you create an account. The password is hashed by our authentication provider and is never visible to us.
• •A record of your payments: what you bought, when, and whether it succeeded. Card details go straight to Stripe and never reach our servers.
• •An anonymous session id, stored in your browser, so an analysis you started without an account still finds its way back to you.

What we do with it

We send your photos and text to an AI model to produce the analysis you asked for. That is the entire purpose. We do not build a profile of you, we do not sell anything to advertisers, and we do not use your material to train models.

No person at ilvlup looks at your photos as part of normal operation. They sit in a private storage bucket that is not reachable without a signed link.

We also keep a short record of request volume per user to stop abuse and runaway costs. That is the only thing we process on the basis of legitimate interest; everything else is there to deliver what you asked for.

Who else sees it

We use a small set of external services to run ilvlup. Each one only gets what it needs:

• •OpenAI, to analyse your photos and text. Data sent through their API is not used to train their models.
• •Supabase, for the database, file storage and accounts. Our project runs in the European Union.
• •Stripe, for payments. Stripe handles your card details directly; we only receive the outcome.
• •Resend, to send you account and trial emails.
• •Upstash, for the rate limiting that keeps the service from being abused.
• •Vercel, which hosts the site and therefore processes your requests.
• •Google Fonts, which serves a font used across the site and therefore sees your IP address when a page loads.

How long we keep it

On the free plan your analysis and the photos behind it are kept for 24 hours. On Pro they are kept for 30 days, so you can compare one run against another.

Your account and your payment records stay as long as you have an account. Payment records we have to keep longer for tax purposes.

You do not have to wait for any of that. You can delete everything yourself, at any time, from Settings.

Deleting your data

Settings has a delete button that removes your analyses, the photo files behind them, and your payment records. It is immediate and it cannot be undone.

If you never made an account, the same button still works: your data is tied to the anonymous session in your browser. If you have lost that session and still want something removed, mail support@ilvlup.ai and we will find it.

Your rights

Under the GDPR you can ask us for a copy of what we hold, ask us to correct it, ask us to delete it, or object to us processing it. Mail support@ilvlup.ai and we will answer within a month.

If you think we are handling this badly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Cookies

We do not use tracking or advertising cookies, and there is nothing to consent to. If you log in, our authentication provider sets a cookie to keep you logged in. Your browser also stores an anonymous session id so an analysis survives a page reload. Both are necessary for the product to work.

Children

ilvlup is for adults. Do not use it if you are under 18, and do not upload photos of anyone who is.

Changes to this policy

If we change how any of this works, we change this page and move the date at the top. If the change is significant and you have an account, we will email you about it.