Privacy Policy

Operator and Privacy Contact

Reflatten is operated by a sole proprietorship registered in the Republic of Korea. The operator, 데드레컨(Deadreckon), is responsible for this service.

Privacy matters and related complaints are handled by the operator directly. You can reach the operator for personal data questions at contact@reflatten.com.

Personal Data We Process

Reflatten processes the four categories below and collects nothing else. Because there are no accounts, member details such as your name, date of birth, or phone number are never collected in the first place.

The image you upload and the text detected in it — provided by you directly. Used to build text layers, clean the background, and generate export files. The finished result is held for up to 30 minutes for delivery and then deleted.

Your IP address — collected automatically from the browser request. Used only for the abuse-prevention request limit. It is held in server memory only, is never written to logs or storage, and does not survive a service restart.

Technical logs — a generated request identifier, the route, the response status, the duration, the upload size, the image dimensions, and warning codes. Used to check reliability and diagnose failures. They contain no value that identifies you.

Browser storage — theme and language preferences, your consent choice, and the filenames of your uploads so the editor can label each image. These stay in your browser and are never sent to our servers, so you can clear them yourself at any time.

Temporary Upload Processing

Reflatten processes uploaded images to create editable text layers and export files. The initial launch does not provide accounts, saved projects, public galleries, or permanent user storage.

Uploaded files are used only for the current processing request. Generated PNG and PPTX files are returned to the current browser session.

Uploaded images are never written to a database or long-term storage. During text detection the image is written to a temporary file that is deleted as soon as detection finishes, and the uploaded bytes are dropped once the request is done.

Because processing runs as a background job that your browser collects afterwards, the finished result — including the composed background image — is held in server memory for up to 30 minutes so it can be delivered, and is then deleted automatically. Retained results are also capped by count and total size, and nothing survives a service restart.

How We Destroy Personal Data

Reflatten destroys personal data without delay once its retention period ends. There is no separate approval step because destruction is a system action rather than a human decision.

Uploads and detected text: the temporary file used for detection is deleted as soon as detection finishes, and the uploaded bytes are dropped when the request completes. A finished result is deleted automatically after 30 minutes, or sooner if the retained count or total size cap is reached.

Method: processing and result retention happen in server memory without a database or file store, so destruction is the release of that memory. Retained results do not survive a service restart. The temporary detection file is deleted from the filesystem.

No personal data is currently retained under a statutory preservation duty. If payment or account features are introduced, the items and periods that law requires will be reflected in this policy first.

No Training on Uploads

Reflatten does not train models on uploaded images. The current OCR and background cleanup steps run on our self-hosted processor service, including self-hosted LaMa inpainting, and do not send uploads to a third-party AI provider.

Overseas Transfer of Personal Information

Uploads are processed on servers located outside the Republic of Korea, so an image you upload — and any text detected in it — leaves the country while it is being processed. This is disclosed here under Article 28-8(1)3 of the Personal Information Protection Act, which permits transfer abroad for processing entrusted under a contract with you when the following items are published in this policy.

Items transferred: the image you upload and the text detected in it. Country, timing and method: Germany, at the moment you upload, over an encrypted network connection. Recipient: netcup GmbH, which provides the server infrastructure (contact: data-protection@netcup.com). Purpose and retention: running detection, background cleanup and export for your request only; results are held for up to 30 minutes for delivery and then deleted, and nothing is stored beyond that.

How to refuse: do not upload an image. Nothing is transferred until you do. Because processing is the service, refusing means the service cannot be used; browsing the site transfers nothing.

Operational Logs

We collect technical logs for reliability, abuse prevention, and debugging. These logs are limited to a fixed set of fields — a generated request identifier, the route, the response status, the duration, the upload size in bytes, image dimensions, and warning codes. They do not contain uploaded image bytes, base64 payloads, OCR text, exported files, original filenames, or error stack traces.

To prevent abuse, we apply a temporary request limit based on IP address. This limit is kept in memory only, and your IP address is not written to our logs.

Cookies and Advertising

Reflatten shows no advertising and currently uses no analytics. The only browser storage in use is the essential kind — editor preferences such as theme and language, and your consent choice.

If analytics or advertising is introduced later, this policy and the Cookie policy will be updated first. Analytics would run through Google Analytics, which means aggregate usage statistics would be processed by Google outside the Republic of Korea, so Google will be added as a recipient in the overseas-transfer section above — with the same items published — before it is switched on. In no case are your uploaded images, generated files, or detected text sent.

Your Rights

You may request access to, correction of, deletion of, or suspension of processing of your personal data, and you may withdraw consent at any time. Send requests to the contact address below; we will respond without undue delay.

In practice there is very little to access or delete: Reflatten has no accounts, keeps no user profiles, and does not store uploads or generated files beyond the temporary processing described above. Your advertising consent choice is kept in your own browser, so you can clear it yourself from the Cookie policy page at any time.

If you believe your data has been handled improperly, you may also lodge a complaint with your national data protection authority. In the Republic of Korea this is the Personal Information Protection Commission.

How We Protect Your Data

Traffic to the site is served over HTTPS. The image processing service is reachable only from our own web application on a private network and is never exposed to the public internet.

Processing runs without a database or object storage, so there is no long-term store to breach. Service containers run as non-privileged users with read-only filesystems, and only the model cache directories are writable.

Request logs are limited to a fixed set of non-identifying fields, and upload size, resolution, and request rate are capped to limit abuse.

Changes to This Policy

This policy takes effect on 2026-08-23.

When it changes, the change and its effective date are posted together on this page. Changes that are material or unfavourable to you are posted at least 7 days before they take effect, so the before and after can be compared.

Change history: this is the first published version. Each later change will be recorded here with its date and a summary of what changed.

Advertising and Your Choices

No advertising is served today, so there is nothing to opt out of. Should advertising be introduced, cookies would never load until you accept them, and choosing “Essential only” would disable advertising personalization. You can review or reset any stored choice on the Cookie policy page.

Contact

Privacy or abuse questions can be sent to contact@reflatten.com