Skip to content
IRISORA – Deine Iris. Dein Kunstwerk.
This English version is a convenience translation. Only the German version is legally binding. View the German version.

Privacy Policy

1. Data controller

Florian Böhm
IRISORA
St.-Afra-Str. 11
86447 Todtenweis
Deutschland
Phone: 0821 / 999 830 94
Email: kontakt@fb-fotos.de

No data protection officer has been appointed.

2. What data we process

  • Eye or iris photographs you upload, as well as the intermediate and final results generated from them
  • Order-related technical data such as project ID, session ID, chosen number of people, chosen style, status and processing timestamps
  • Communication data if you contact us by email or phone, or declare a withdrawal
  • Technical connection data generated when accessing the website and operating the servers, as well as data processed in truncated or hashed form for abuse prevention

3. Purposes and legal bases

  • Creating and providing the iris artwork you requested: Art. 6(1)(b) GDPR (contract or pre-contractual measures)
  • Operation, stability and security of the website, limiting abuse and overload: Art. 6(1)(f) GDPR (legitimate interest)
  • Handling requests and withdrawal declarations and documenting them: Art. 6(1)(b) and (c) GDPR
  • Fulfilling statutory documentation and retention obligations: Art. 6(1)(c) GDPR

4. Eye photos and special care

Your eye photos are processed solely to create the artwork you requested. No biometric identification of persons takes place; the images are not evaluated, matched or stored for biometric recognition purposes or in recognition databases.

The image is already resized and stripped of embedded metadata in your browser before it is transmitted. Storage takes place in non-publicly accessible storage areas; retrieval takes place via time-limited links.

Your images and results are not used as a reference, for advertising, or as a public preview image without a separate, explicit consent.

5. Use of generative artificial intelligence

To create the iris illustration and the artwork, your image data is transmitted to Google's image AI interface (Gemini, generativelanguage.googleapis.com). The provider is Google Ireland Limited or Google LLC.

Only the image material and the technical processing request are transmitted. Name, email address, phone number or postal address are not transmitted.

Processing on servers outside the European Union cannot be ruled out. Such transfers are based on the European Commission's Standard Contractual Clauses as well as the provider's terms for its paid API.

Whether and how long the AI provider temporarily stores transmitted content on its end is outside our technical control. We do not guarantee "zero data retention" in this respect. The provider's applicable terms govern.

6. Hosting and technical service providers

The website, database and file storage run on the Lovable platform, which uses managed database and storage infrastructure for this purpose. The database and storage region used for this project is located in the European Union (Paris, France).

The service providers used process the data on our behalf under our instructions; data processing agreements are in place for this purpose. Insofar as sub-processors outside the European Union are used as part of the platform operation, transfers take place on the basis of the Standard Contractual Clauses.

7. Storage on your device

We do not use any analytics, tracking, advertising or profiling services. No cookies are used for advertising purposes.

  • A project or session ID is stored in your browser's local storage so that you can return to your project after reloading. This storage is strictly necessary for the function you explicitly requested (§ 25(2) no. 2 TDDDG, the German Telecommunications-Digital-Services-Data-Protection Act).
  • In the non-public internal administration area, a login token and a cookie for remembering the sidebar display are also stored. These storages only affect logged-in administrators.

Since only strictly necessary storage takes place, no consent via a cookie banner is required.

8. Protection against abuse

To prevent abuse and limit system load, the number of projects per connection within a period of time is limited. For this purpose, technical connection data is only stored in derived, hashed form. The legal basis is Art. 6(1)(f) GDPR.

9. Retention period and deletion

You can delete your project yourself at any time. In addition, an automatic deletion routine runs with the following technically configured periods:

  • Raw uploads: deleted after 24 hours
  • Project and session data: deleted after 30 days
  • Generated image files: deleted after 30 days
  • Failed processing runs: deleted after 7 days
  • Technical events for abuse prevention: deleted after 7 days

Withdrawal declarations and evidence of consents given during the order process are retained to document contract handling and to fulfil statutory obligations, and are deleted afterwards.

10. Categories of recipients

  • Providers of hosting, database and storage infrastructure
  • Provider of the image AI interface used
  • Payment service providers, once paid services are offered; currently no payment service provider is integrated
  • Authorities and courts, insofar as there is a legal obligation to do so

11. Email sending

Currently, no automated email sending is set up. For an electronically declared withdrawal, we generate the confirmation immediately as a PDF file that is provided directly to you for saving; it is not sent by email and is not stored under a publicly accessible address. We process your email address only to assign the case and for later contact. Replies to inquiries are sent from the email address stated in the Imprint.

12. Your rights

Under the GDPR, you have the following rights:

  • Access to the data processed (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on legitimate interests (Art. 21 GDPR)
  • Withdrawal of given consent with future effect (Art. 7 GDPR)

Please send requests to kontakt@fb-fotos.de. You will find further ways to reach us on the Contact page.

13. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

14. Necessity of providing data

Providing your image data is required to create the artwork. Without an upload, the service cannot be performed. No automated decision-making with legal effect within the meaning of Art. 22 GDPR takes place.

15. Cookies, browser storage and analytics

Strictly necessary browser storage (e.g. project identifier, session, security features) is used on the basis of Section 25 (2) TDDDG and Art. 6 (1)(f) GDPR. It is required to operate the site and cannot be switched off.

In addition we run our own self-hosted analytics. It is only activated after your consent in the cookie banner (Section 25 (1) TDDDG, Art. 6 (1)(a) GDPR). We measure: a randomly generated anonymous device and session identifier stored in your browser, pages viewed, timestamp, language version, referral source, campaign parameters, coarse device type and the country reported by the network.

No IP addresses are stored, no data is transferred to ad networks or third parties, and no cross-device profiles are created. Analytics data is deleted after 12 months. You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer.

16. Last updated

Stand: August 2026