Privacy Policy

This Privacy Policy explains how GLEAMFLUX LTD ("we", "us", or "our") handles personal data in connection with the ImgPak iOS application (the "Service"). We are committed to collecting and processing only the minimum data strictly necessary to deliver the Service. We do not sell your personal data, we do not use it for advertising, and we do not use it to train any machine-learning model.

1. Data Controller

The data controller responsible for your personal data is:
GLEAMFLUX LTD
82A James Carter Road, Mildenhall, IP28 7DE, United Kingdom
Email: support@gleamflux.com

2. Data We Process

We process only the following categories of data, strictly to operate the Service:

3. What We Do Not Collect

• No analytics SDKs (no Google Analytics, Firebase Analytics, Umeng, etc.).
• No crash-reporting SDKs (no Sentry, Crashlytics, Bugly, etc.).
• No advertising identifiers (IDFA) and no third-party advertising SDKs.
• No access to your photo library beyond the images you explicitly select for compression.
• No location data, contacts, microphone, or camera access.
• No cross-app or cross-site tracking.

4. Legal Bases for Processing (GDPR / UK GDPR)

• Performance of a contract (Art. 6(1)(b)): processing your account data, subscription data, quota counter, and uploaded images is necessary to deliver the Service you requested.
• Legitimate interests (Art. 6(1)(f)): short-lived server logs are processed to secure the Service and prevent abuse; our interest is balanced against your rights.
• Legal obligation (Art. 6(1)(c)): we may retain certain transaction records for tax and accounting purposes.

5. Third-Party Service Providers

We rely on the following processors:

• Apple Inc. — Sign in with Apple, App Store distribution, and In-App Purchase billing. Apple processes your Apple ID, email (or relay email), and payment information under its own privacy policy.
• Alibaba Cloud (Aliyun) Object Storage Service (OSS) — transient storage of images during the compression process. Files are deleted immediately after processing.

We do not share your personal data with any other third party except where required by law or to respond to valid legal process.

6. International Data Transfers

ImgPak offers several compression modes:

• AI-Compression feature only: images are transferred to and processed by servers located in mainland China.
• All other compression features: images are processed across multiple regions, which may include servers located outside your country of residence.

Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on one or more of the following safeguards under Article 46 / 49 of the GDPR and the UK GDPR:

• Necessity for the performance of a contract (Art. 49(1)(b)): the transfer is necessary to deliver the compression service you have explicitly requested;
• Explicit consent (Art. 49(1)(a)): where required, we will obtain your explicit, informed consent before transferring data to a jurisdiction without an adequacy decision;
• Appropriate safeguards: we enter into Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum with our processors where applicable.

You acknowledge that the legal regime in China may differ materially from that of your country of residence. You may exercise your right to object to these transfers by not using the relevant feature and, if you wish, by deleting your account as described below.

7. Data Retention

• Uploaded images: deleted immediately upon completion of the compression task.
• Account and subscription data: retained while your account is active and deleted when you delete your account, subject to any legal retention obligation.
• Server logs: automatically deleted within a short period, typically no longer than 14 days.

8. Your Rights

Depending on where you reside, you have some or all of the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request that inaccurate or incomplete data be corrected.
• Erasure ("right to be forgotten") — request deletion of your data.
• Restriction — request limitation of processing in certain circumstances.
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time (this does not affect prior lawful processing).
• Lodge a complaint — with a supervisory authority, in particular the UK Information Commissioner's Office (ico.org.uk) or your local EU data-protection authority.

Residents of California (CCPA/CPRA)

You have the right to know the categories of personal information we collect, the right to request deletion, the right to correct inaccurate information, the right to limit the use of sensitive personal information, and the right not to be discriminated against for exercising these rights. We do not sell or share personal information within the meaning of the CCPA/CPRA.

Residents of Mainland China (PIPL)

You have the rights of access, correction, deletion, and portability, as well as the right to withdraw consent and to request an explanation of our processing rules, under the Personal Information Protection Law of the People's Republic of China.

Residents of Brazil (LGPD)

You have the rights granted by the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados), including confirmation of processing, access, correction, anonymization or deletion, data portability, and information about shared data.

To exercise any of these rights, email support@gleamflux.com from the email address associated with your account. We will respond within the timeframes required by applicable law (generally within 30 days).

9. Account Deletion

You can delete your account and all associated personal data directly from the app: open ImgPak and go to User Profile → Delete Account. Deletion is immediate and irreversible; residual backups are purged within a short rolling window. Alternatively, email support@gleamflux.com to request deletion.

10. Children

The Service is intended for users aged 16 and older. We do not knowingly collect personal data from anyone under 16. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

11. Security

We use industry-standard technical and organizational measures to protect your data, including encryption in transit (HTTPS/TLS), access controls, and prompt deletion of uploaded files. No system is perfectly secure, but we continually review our practices to reduce risk.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated in-app or by email before they take effect. The "Last Updated" date at the top indicates when this document was last revised.

13. Contact

For any privacy-related question or request:
GLEAMFLUX LTD
82A James Carter Road, Mildenhall, IP28 7DE, United Kingdom
Email: support@gleamflux.com