RapidRAW Logo RapidRAW

Privacy Policy

Effective date: September 20, 2026

1. Summary

  • The RapidRAW desktop editor runs on your computer. Your photos stay there unless you use RapidRAW Cloud.
  • When you use Cloud, only a crop around the area you masked (and the mask itself) is sent for processing. Your full RAW file is never uploaded.
  • We do not store your images, and we instruct our AI infrastructure provider not to store them. The model provider's own handling is described in section 6.4.
  • We do not use analytics, advertising or tracking cookies, and we do not sell personal data.

2. Who is responsible

The controller for the processing described in this policy (the website, user accounts and RapidRAW Cloud) is:

Latent GmbH
c/o profetas gmbh
Ringstrasse 25
6010 Kriens
Switzerland
UID: CHE-422.552.416
Email: timon@cybertimon.ch

The RapidRAW desktop software is developed by Timon Käch and published as open-source software. It does not send personal data to Timon Käch or to Latent GmbH, except when you use RapidRAW Cloud as described below.

3. The RapidRAW desktop software

Editing, the image library, AI masking, tagging and local inpainting run entirely on your computer. We do not receive your photos, your edits or usage statistics from the desktop app.

Update check. When you open the app, it asks GitHub (api.github.com, operated by GitHub, Inc., USA) whether a newer version is available. No information about you, your photos or how you use the app is sent. Like any web request, it reveals your IP address and basic technical information, such as the type of client, to GitHub.

AI model downloads. The built-in AI features (masking, tagging, denoising, local inpainting and depth estimation) use models that are downloaded from Hugging Face (huggingface.co, operated by Hugging Face, Inc., USA) the first time you use each feature. The files are checked for integrity and stored on your computer. After that, the features run offline. Hugging Face sees your IP address during the download.

Community presets. When you open the community presets page, the app loads the list of presets from our public GitHub repository. If no folder is open, it also loads a sample image from the same repository. Preview images are created on your computer using your own photos; your photos are never uploaded. As with the update check, GitHub sees your IP address. Presets are submitted through GitHub issues, so submissions are public and covered by GitHub's own terms and privacy policy.

If you connect the app to your own ComfyUI server, images are sent only to that server, which you control.

4. The website

4.1 Server logs

The website runs on servers rented from Hetzner Online GmbH in the EU. When you visit getrapidraw.com, our web server automatically records technical data: IP address, date and time, the page requested, referrer and browser type. We use this data only to operate the website and protect it against abuse. Logs are rotated daily and deleted after 14 days.

4.2 Images and videos

Some screenshots and demo videos on the website are loaded from GitHub (raw.githubusercontent.com), operated by GitHub, Inc. (USA). When these load, GitHub receives your IP address. Fonts are loaded from Google Fonts (Google LLC / Google Ireland Limited), which receives your IP address when the page loads. Google's handling of this data is described in Google's privacy policy.

4.3 Cookies

We only use cookies that are strictly necessary. Our sign-in provider Clerk sets cookies to keep you signed in. When you open the checkout, the Lemon Squeezy checkout is loaded (see section 5.2). We do not use analytics or advertising cookies.

5. Your account and subscription

5.1 Account (Clerk)

To use RapidRAW Cloud you create an account with our authentication provider Clerk, Inc. (USA). Clerk processes your email address, a user ID and sign-in data (for example session and device information) on our behalf. The desktop app uses this account to check whether you have an active subscription.

We store the following subscription details in your account: plan, subscription status, subscription ID, next renewal or end date, and a link to your customer portal.

5.2 Payment (Lemon Squeezy)

Subscriptions are sold by Lemon Squeezy (Sold through Link, LLC f/k/a Lemon Squeezy LLC, USA), which acts as the merchant of record. Lemon Squeezy processes your payment and billing details, calculates and remits taxes, and issues invoices as an independent controller under its own privacy policy. We never see your full card details. From Lemon Squeezy we receive only what we need to activate your subscription: subscription ID, status and billing dates.

6. RapidRAW Cloud: what happens to your photo

6.1 What is sent

When you run a Cloud edit, the desktop app sends a rectangular crop of your image around the area you masked, together with the mask, to our backend. The full RAW file and its metadata are not sent. The request is linked to your account ID so that we can check your subscription and count your usage; the image itself is not stored with your account.

6.2 Our backend

Our backend processes the crop in memory only. It is not written to disk, not stored in a database and not logged. After the result has been returned to your app, it is discarded. Like the website, the backend records only technical request data (IP address, time, endpoint and status) in its server logs, rotated daily and kept for 14 days. It runs on servers rented from Hetzner Online GmbH in the EU.

6.3 fal (AI infrastructure)

To generate the result, our backend sends the crop and mask to fal (Features & Labels, Inc., USA). We instruct fal not to store the request data, and results are returned to us directly instead of being saved in fal's storage. fal acts as our processor under a data processing agreement. It has committed not to use customer content to train or develop its products.

6.4 Ideogram (model provider)

The object removal model is developed and operated by Ideogram AI, Inc. (Toronto, Canada). fal forwards the crop and mask to Ideogram's API for processing, and the result is returned to us through fal. Ideogram handles these requests under its developer API agreement with fal, which we are not a party to. Under that agreement, input and output submitted through the API are not used to train Ideogram's models, with one exception: if a request is flagged as violating Ideogram's usage policies, Ideogram may use it to train and improve its models in order to detect abusive and unsafe use.

Ideogram's general privacy policy, which covers its own products and users, permits broader use of uploaded content and does not state a fixed retention period. We cannot independently verify how long Ideogram keeps request data, or in which countries it is processed. See the Ideogram privacy policy for details.

6.5 Content safety

fal and Ideogram automatically check requests for prohibited content. If a request is flagged, it is rejected and no result is returned. For flagged requests we keep a minimal record (account ID, time, the fact that a request was blocked) for up to 90 days, to enforce our Terms of Service. We do not keep a copy of the image. As described in section 6.4, Ideogram may retain and use the content of flagged requests to improve its own abuse detection.

6.6 No model training by us

We do not use your images, masks or results to train, fine-tune or evaluate AI models.

6.7 Usage and performance data

To enforce your monthly edit allowance, we store a counter consisting of your account ID, the month and the number of edits in a database run by Upstash, Inc. (USA). Counters are deleted automatically after 60 days. We also record how long requests take, without any link to your account, to monitor the service; these entries are deleted after 24 hours.

7. Legal bases (GDPR)

If the GDPR applies to you, we rely on the following legal bases:

  • Performance of a contract (Art. 6(1)(b) GDPR): your account, your subscription and processing Cloud edits.
  • Legitimate interests (Art. 6(1)(f) GDPR): server logs, abuse prevention, rate limits, content safety checks and service monitoring. Our interest is operating a secure and reliable service.
  • Legal obligations (Art. 6(1)(c) GDPR): keeping business records required by law.

Under Swiss law (FADP), we process personal data in line with the principles of lawfulness, good faith and proportionality.

8. Recipients

We share personal data only with the following providers, and only to the extent needed to run the service:

  • Clerk, Inc. (USA): sign-in and user accounts
  • Lemon Squeezy (USA): payment, taxes and invoicing, as an independent controller
  • Upstash, Inc. (USA): usage counters and rate limits
  • fal (Features & Labels, Inc., USA): AI processing
  • Ideogram AI, Inc. (Canada): AI model processing
  • Hetzner Online GmbH (Germany), with servers in the EU: hosting of the website and the Cloud backend
  • GitHub, Inc. (USA): website images and videos, and the desktop app's update check and community preset list
  • Google LLC / Google Ireland Limited: delivery of website fonts (Google Fonts)
  • Hugging Face, Inc. (USA): download of the desktop app's AI models

We may also disclose data where we are legally required to do so.

9. International transfers

Some of these providers are located outside Switzerland and the EEA, in the USA and in Canada. For these transfers we rely on the EU Standard Contractual Clauses, with the adaptations required under Swiss law, or on the Swiss-U.S. and EU-U.S. Data Privacy Framework where the recipient is certified under it. The transfer to the model provider is made by fal rather than by us; fal's data processing agreement requires it to impose data protection obligations on the providers it uses that are no less protective than those it owes us. Germany, where our hosting provider operates, is recognised by Switzerland as providing an adequate level of data protection.

10. How long we keep data

  • Images and masks sent to Cloud: not stored by us, and deleted from memory once your result is delivered; retention by the model provider is described in section 6.4
  • Account data: until you delete your account or ask us to delete it
  • Subscription status in your account: while your account exists
  • Usage counters: 60 days
  • Request timing data (not linked to you): 24 hours
  • Records of blocked requests: up to 90 days
  • Website server logs: 14 days
  • Billing and tax records: kept by Lemon Squeezy as required by law

11. Security

All data is transmitted over encrypted connections (TLS). Access to our systems is restricted and protected by authentication. No system is perfectly secure, but we limit what we collect so that there is little to expose in the first place.

12. Your rights

You have the right to access your personal data and to have it corrected or deleted. You can also ask us to restrict its processing, object to processing based on legitimate interests, and receive your data in a portable format. To exercise these rights, or to delete your account, email timon@cybertimon.ch. Deleting your account does not cancel your subscription with Lemon Squeezy; please cancel it first.

You can also complain to a data protection authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, the authority in your country of residence.

13. Age

RapidRAW Cloud is only available to people aged 18 or older. We do not knowingly collect personal data from minors.

14. Changes to this policy

We will update this policy when our services or providers change. The effective date at the top shows the current version. We will notify subscribers of material changes by email.