Last updated: January 11, 2026

Privacy Policy

1. Introduction and Who We Are

This Privacy Policy explains how Tremble Oy (Finnish business id: 3235618-3) ("we", "us", or "our"), collects, uses, and protects your personal data when you use our website passportphotolab.com (the "Website") and passport photo editing service (the "Service").

2. Key Privacy Features

Local Image Processing: All images you upload are processed locally on your device. Your images will never be uploaded to our servers or to third party servers.

3. Personal Data We Collect

3.1 Data Collection and Usage

• Email address (when making a purchase, for product key association)
• Contact form submissions (for responding to your inquiries)
• Pro Early Access form submissions (for responding to your inquiries)
• Technical data necessary for service operation:
  • IP addresses
  • Browser type and version
  • Operating system
  • Date and time of access
  • URLs of referring websites

4. Service Providers and Data Storage

We work with the following service providers to deliver our Service:

• Firebase (EU)
  • Purpose: Storage of product keys and associated email addresses
  • Location: European Union
• Paddle
  • Purpose: Payment processing
  • Role: Acts as Merchant of Record for all purchases
  • Note: When making a purchase, you enter into a direct relationship with Paddle. Any payment-related data protection requests should be directed to them.
• Formspree
  • Purpose: Contact form and Pro Early Access form processing
  • Location: United States
  • Data retention: Form submissions are retained for 30 days in Formspree's systems
  • Note: Form data forwarded to our email system is retained until deletion is requested
  • International transfer: By using the contact form or Pro Early Access form, you consent to data transfer and processing in the US. Transfers are conducted with appropriate safeguards and only occur when using these forms.
• PostHog
  • Purpose: Analytics
  • Configuration: No personal information collection, no cookies
• Google Ads (Google Ireland Ltd)
  • Purpose: Advertising measurement and optimization
  • Scope: Only for users who arrive via Google Ads and provide consent
  • Data processed: Click identifiers (gclid, wbraid, gbraid) for conversion attribution
  • Legal basis: Consent (Art. 6(1)(a) GDPR)
  • Note: We use Google Consent Mode v2. No tracking data is collected unless you explicitly consent via our cookie banner.

5. Cookies and Similar Technologies

5.1 Essential Cookies

We use Local Storage to remember your preferences and settings. Your consent is not required for these as they are strictly necessary for the Service to function.

5.2 Marketing Cookies (Consent Required)

If you arrive at our site through a Google Ads advertisement, we will ask for your consent before setting any marketing or advertising cookies. These cookies help us understand how effective our advertising is. If you decline, no marketing cookies will be set and no advertising data will be collected.

You can change your marketing cookie preferences at any time using the Privacy Settings section below, or through the "Privacy Settings" link in our footer (visible if you have previously visited from an ad).

6. Legal Basis for Processing (GDPR)

We process your personal data based on:

• Contract performance (providing the Service)
• Legal obligations (accounting requirements, responding to lawful authorities)
• Legitimate interests (implementing security measures, maintaining functionality, preventing fraud)
• Consent (for marketing/advertising tracking via Google Ads, which is only enabled when you explicitly consent)

7. Security Measures

We implement appropriate technical and organizational measures to protect your data:

• HTTPS encryption for all data in transit
• Encryption of data at rest
• Regular security assessments
• Local image processing to ensure photo privacy

8. Your Rights Under GDPR

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure of your data
• Restrict or object to processing
• Data portability
• Withdraw consent (where processing is based on consent)

9. Contact Us

For any questions about this Privacy Policy or our data practices, please use our contact form or moc.balotohptropssap@ycavirp.

For EU residents: You have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data in accordance with applicable law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We recommend checking this page regularly for any changes.