Legal

Privacy Policy

Last updated: 26 July 2026 · Plain-language policy for a small service — questions to [email protected].

Who we are

ImgAff ("we") provides shoppable-image overlays for website publishers: publishers upload their own affiliate product feeds, embed our widget or WordPress plugin, and matching products appear on their images. The service is operated from within the European Union.

What we collect from publishers (account holders)

• Account data you give us: email, password (stored hashed), optional name/company/website URL.
• Your uploaded product feeds (product names, prices, links, image URLs — no personal data expected in feeds). When we cannot recognise a feed's columns, the column names and up to three sample rows (each value shortened) are sent to a third-party language-model provider so we can suggest what each column means. This happens only when automatic recognition fails, and never for feeds we already understand. Separately, the descriptions of images on your site that matched no product are sent to the same provider once a day, so we can group them into subject areas and show you what your catalogue does not cover.
• Optional first-touch marketing attribution at signup (which campaign or referrer brought you), used only to understand which channels work.
• If you join our email list: your email address, used for the requested content and product updates. Unsubscribe any time.
• On imgaff.com itself we use Google Analytics to understand site traffic; see Google's privacy policy for how it processes data.

What the widget processes on publisher sites

• To match products, the widget sends us the URLs and text context of images on the page being viewed.
• We count overlay impressions and clicks so publishers can see performance. These counts are tied to the publisher's site, not to visitor identities.
• The widget does not set visitor tracking cookies, does not fingerprint visitors, and does not build visitor profiles. Visitor IP addresses reach our servers as a technical necessity of HTTP and appear in short-lived operational logs; we do not use them to profile visitors.
• Clicking a product overlay leads to the publisher's own affiliate link; the destination network's privacy terms then apply.

The page audit

• When you paste a URL into our audit tool, we fetch that page and read its markup: the images, their descriptions, the links around them, and the page's title and headings. We keep what we derive from it — the counts, and each image's address and description — not a copy of the page itself.
• Anyone can audit any public URL, so an audit is not a claim of ownership and we don't treat it as one. Connecting a feed still requires verifying the site is yours.
• If you give us an email address to receive the report, the image descriptions from that page are sent to a third-party language model to group them into subject areas. Only those descriptions are sent, de-duplicated and capped in both number and length — not the page, not your email address.
• If the address is new to us, it creates an account so the report has somewhere to live, and we email a single-use link that opens it. If the address already has an account we attach the report to it and send you to the ordinary sign-in instead — we never email a sign-in link to an account we can't confirm the requester owns. If you'd rather the account didn't exist, ask us and we'll delete it.

Where data lives

Servers in the EU (Germany) with database hosting in the EU; CDN and DNS by Cloudflare. We don't sell data to anyone.

Retention & your rights

Account data is kept while your account exists and deleted on request. Match caches and analytics rollups expire on rolling windows. EU/GDPR rights (access, correction, deletion, portability, objection) — email [email protected] and we'll act on it promptly.

Changes

If this policy changes materially we'll note it here with a new date.