Privacy Policy

Last updated: 22 October 2026

At Fotolista.es we take our users' privacy seriously. This policy explains what data we collect, how we use it, and what your rights are under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Data controller

2. Data we collect

Fotolista.es only collects the data strictly necessary to provide the service:

• Images you upload: the photos you upload to generate a listing are sent directly to the AI API for analysis. They are never stored on any server of ours. The same goes for the photos you use in the Fotolista MAX Studio to enhance them or show them on a model: yours and the one the AI creates only pass through our server to be sent and returned, and they are not stored. For each photo created we only keep a record (type, date and whether it worked) to count your monthly allowance.
• Account data: if you sign up, we store your email and your password (encrypted, never in plain text) so we can identify you and manage your subscription, and whether or not you want to receive our emails with offers and news.
• Generated listings: we store the text result (title, description, price, condition) linked to your account, so you can check your history. The image itself is never stored — see the point above. We only keep a fingerprint of the photos (a code computed from them, from which the image cannot be rebuilt) so that if you generate a listing again with the same photos, you get the same price.
• Browsing data, only if you accept analytics cookies: Google Analytics records which pages you visit, for how long, from what type of device and browser and from which country, with an identifier for your browser. If you do not accept them, Google Analytics is not loaded.
• Payment data: if you buy a paid plan (Pro or MAX) or a pack, the payment is handled by Whop (see section 5), including when its payment form appears inside fotolista.es: whatever you type into it goes straight to Whop. Fotolista never sees or stores your card details: Whop only sends us the buyer's email, the product, the amount and the payment status, so we can activate your plan or your listings. We also record in your account when you start a payment from the site (which product and from which page) and whether you complete it, so we can spot problems in the checkout and, if you do not complete it, email you in case something went wrong. Before you pay we record that you ticked the box asking for the service to start straight away (date, product and version of the terms of purchase) and, if you withdraw from a purchase, a record of the withdrawal (date, product and what you had used). If you buy directly on Whop without a Fotolista account, we create your account with the email you used there (choosing the language from your billing country) so you can access what you bought, and we send you a link to set your password.
• Contact data: if you get in touch with us by email or WhatsApp, we'll only use the data you provide to respond to your query.

3. Purpose of processing

• Analysing uploaded images to generate optimised titles, descriptions and prices.
• Creating and managing your user account, including email verification and password recovery.
• Managing your purchases and subscriptions (activating your plan or the listings in a pack, purchase confirmations, renewals, cancellations, withdrawals and refunds).
• Sending you the emails the service needs (verification, password, purchase confirmations) and notices about your account.
• Sending you emails with Fotolista offers and news, unless you have opted out.
• Measuring how the site is used with Google Analytics, only if you accept it.
• Protecting the service against abuse (usage limits) and improving how it works.
• Responding to enquiries and support requests.

4. Legal basis for processing

• Performance of a service (Art. 6.1.b GDPR): processing your image and your account data is necessary to provide the service you requested, including managing your subscription.
• Legal obligation (Art. 6.1.c GDPR): keeping the payment records required by tax law, and the box ticked before payment and the withdrawals, required by consumer law.
• Legitimate interest (Art. 6.1.f GDPR): the security of the service and preventing abuse, reminders about payments that are not completed, and emails with offers and news about Fotolista products similar to the ones you use. You can opt out of these emails when you create your account, from My account or from the unsubscribe link in each email.
• Consent (Art. 6.1.a GDPR): Google Analytics cookies.

5. Recipients and international transfers

Uploaded images are sent to the Google Gemini API (Google LLC, US) for AI processing. Google provides adequate safeguards under the GDPR's international transfer framework. We do not share your data with third parties for their own purposes.

The site and the database are hosted by Hostinger (Hostinger International Ltd., Cyprus), within the EU.

If you accept analytics cookies, Google Analytics (Google Ireland Ltd. and Google LLC, US) receives the browsing data described in section 2. The site's fonts are served from fotolista.es itself: nothing is downloaded from Google Fonts. You can read Google's privacy policy at policies.google.com/privacy.

Verification, password-reset and purchase-confirmation emails, notices about your account (for example, that your free listings for the month are back) and, unless you have opted out, offers and news (you can unsubscribe from these in the email itself or from My account) are sent through Brevo (Sendinblue SAS, France), within the EU. You can read its privacy policy at brevo.com/legal/privacypolicy. Brevo tells us if an email could not be delivered or if you unsubscribe or mark it as spam: we note it on your account so we can ask you to check your email address and stop sending you notices.

If you use the chat on the site ("Questions? Chat with us"), the messages you write and, if you give them to us, your name and email are handled with Brevo Conversations (the same provider, within the EU) and we only use them to reply to you. If you open it from the app (Help section), the chat also includes your account email and plan, so we know who we are replying to without having to ask. The chat does not load until you open it: before that nothing is downloaded from Brevo and none of its cookies are stored. Once opened, Brevo stores an identifier in your browser to keep the conversation going if you change page.

Payments are processed by Whop, Inc. (USA), which processes your email and your billing and payment details to take the payment, prevent fraud and meet its legal obligations. Whop provides appropriate safeguards for international data transfers. You can read its privacy policy at whop.com/privacy.

6. Cookies

Fotolista.es uses the following types of cookies:

• Essential cookies: required for the basic operation of the site, such as your account session or your cookie choice. These don't require consent.
• Invitation code: if you reach Fotolista through a partner's link (for example, fotolista.es/?ref=name), we store their code in your browser for 60 days so we can apply their invitation discount when you pay. When you pay, we send it to Whop so the sale is credited to them. It's needed to give you the discount you asked for by using the link, so it doesn't require consent.
• Analytics cookies (Google Analytics: _ga and _ga_*, up to 2 years): tell us how many people use the site and which pages they visit. They are only used if you accept them.

Fotolista does not show ads or use advertising cookies. Essential cookies are always active, as they're necessary for the site to work. Analytics cookies are only used if you accept them in the notice shown when you first visit: until then Google Analytics is not loaded. You can change your choice at any time from the «Cookies» link in the site footer (also on My account); if you withdraw it, they are deleted.

7. Data retention

Uploaded images are not stored after processing. Your account data (email, encrypted password) and your history of generated listings are kept for as long as your account stays active. You can delete your account at any time from My account (“Delete my account”, at the end of the page): they are deleted right away. If you would rather ask us, we delete them within 30 days. For Pack purchases we keep the payment record (date, amount and email) for as long as tax law requires, and for withdrawals we keep their record for as long as consumer law requires; payments are handled by Whop, which keeps its own records. Contact data is kept for as long as needed to handle your enquiry, and for a maximum of 1 year. Google Analytics data is deleted automatically according to the tool's retention period (14 months at most).

8. Your rights

Under GDPR, you have the right to:

• Access: find out what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data. You can do it yourself by deleting your account from My account.
• Restriction: restrict processing in certain cases.
• Portability: receive your data in a structured format.
• Objection: object to processing based on legitimate interest; in particular, stop receiving emails with offers and news from My account or from the unsubscribe link in each email.
• Withdraw your consent to analytics cookies at any time, from the «Cookies» link in the site footer.

You can exercise these rights by contacting us at fotolista09@gmail.com. As the data controller is based in Spain, you can also file a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es. If you're based in the UK, you can alternatively contact the Information Commissioner's Office (ICO) at ico.org.uk.

9. AI-generated content

Fotolista uses artificial intelligence (Google Gemini) to analyse your photo and generate titles, descriptions, estimated prices and keywords. These are automatic suggestions, not professional advice or a guarantee of accuracy. Always review and validate the content before publishing on Wallapop, Vinted or any other platform — you know your item better than the AI does.

It's normal for the AI to make mistakes occasionally, especially with unusual items, unfamiliar brands, or condition details that are hard to see in a photo. If you spot a clear error, please report it via contact so we can improve.

With Fotolista MAX, the AI can also create photos from yours: enhance it (removing wrinkles, with a clean background and corrected light) or show the item worn by an AI-generated model, who is not a real person. We ask the AI not to change the item or hide its defects (stains, holes or wear), but it can make mistakes, especially with small print or logos: check each photo before using it. You are responsible for the photos in your listings showing the item as it really is; if you publish an AI-created photo, tick the AI image option when the platform offers one (Vinted does) and keep at least one real photo. Images created by Google carry an invisible watermark (SynthID) that identifies them as AI-generated.

10. Minimum age

Fotolista is not intended for children under 14. If you are under 14, you cannot create an account.

11. Security

We take appropriate technical and organisational measures to protect data against unauthorised access, loss or accidental destruction, in line with Article 32 of the GDPR.

12. Changes to this policy

We may update this privacy policy at any time. The last-updated date will always be visible at the top of this page. We recommend checking it periodically.

If you have any questions about this policy, email us at fotolista09@gmail.com or message us on WhatsApp at +34 747 40 64 65.