Privacy Policy

Operator and Privacy Contact

Reflatten is operated by a sole proprietorship registered in the Republic of Korea. The operator, 데드레컨(Deadreckon), is responsible for this service.

Privacy matters and related complaints are handled by the operator directly. You can reach the operator for personal data questions at contact@reflatten.com.

Temporary Upload Processing

Reflatten processes uploaded images to create editable text layers and export files. The initial launch does not provide accounts, saved projects, public galleries, or permanent user storage.

Uploaded files are used only for the current processing request. Generated PNG and PPTX files are returned to the current browser session.

Uploaded images are never written to a database or long-term storage. During text detection the image is written to a temporary file that is deleted as soon as detection finishes, and the uploaded bytes are dropped once the request is done.

Because processing runs as a background job that your browser collects afterwards, the finished result — including the composed background image — is held in server memory for up to 30 minutes so it can be delivered, and is then deleted automatically. Retained results are also capped by count and total size, and nothing survives a service restart.

No Training on Uploads

Reflatten does not train models on uploaded images. The current OCR and background cleanup steps run on our self-hosted processor service, including self-hosted LaMa inpainting, and do not send uploads to a third-party AI provider.

Overseas Transfer of Personal Information

Uploads are processed on servers located outside the Republic of Korea, so an image you upload — and any text detected in it — leaves the country while it is being processed. This is disclosed here under Article 28-8(1)3 of the Personal Information Protection Act, which permits transfer abroad for processing entrusted under a contract with you when the following items are published in this policy.

Items transferred: the image you upload and the text detected in it. Country, timing and method: Germany, at the moment you upload, over an encrypted network connection. Recipient: netcup GmbH, which provides the server infrastructure (contact: data-protection@netcup.com). Purpose and retention: running detection, background cleanup and export for your request only; results are held for up to 30 minutes for delivery and then deleted, and nothing is stored beyond that.

How to refuse: do not upload an image. Nothing is transferred until you do. Because processing is the service, refusing means the service cannot be used; browsing the site transfers nothing.

Operational Logs

We collect technical logs for reliability, abuse prevention, and debugging. These logs are limited to a fixed set of fields — a generated request identifier, the route, the response status, the duration, the upload size in bytes, image dimensions, and warning codes. They do not contain uploaded image bytes, base64 payloads, OCR text, exported files, original filenames, or error stack traces.

To prevent abuse, we apply a temporary request limit based on IP address. This limit is kept in memory only, and your IP address is not written to our logs.

Cookies and Advertising

Reflatten shows no advertising. Analytics is used only to understand how the tool is used in aggregate, and its script loads only after you accept it; declining leaves the site with essential browser storage only, used to remember editor preferences such as theme and language.

Where analytics is enabled it runs through Google Analytics, which means those aggregate usage statistics are processed by Google outside the Republic of Korea. It never receives your uploaded images, generated files, or detected text. If advertising is introduced later, this policy will be updated first.

Your Rights

You may request access to, correction of, deletion of, or suspension of processing of your personal data, and you may withdraw consent at any time. Send requests to the contact address below; we will respond without undue delay.

In practice there is very little to access or delete: Reflatten has no accounts, keeps no user profiles, and does not store uploads or generated files beyond the temporary processing described above. Your advertising consent choice is kept in your own browser, so you can clear it yourself from the Cookie policy page at any time.

If you believe your data has been handled improperly, you may also lodge a complaint with your national data protection authority. In the Republic of Korea this is the Personal Information Protection Commission.

How We Protect Your Data

Traffic to the site is served over HTTPS. The image processing service is reachable only from our own web application on a private network and is never exposed to the public internet.

Processing runs without a database or object storage, so there is no long-term store to breach. Service containers run as non-privileged users with read-only filesystems, and only the model cache directories are writable.

Request logs are limited to a fixed set of non-identifying fields, and upload size, resolution, and request rate are capped to limit abuse.

Advertising and Your Choices

No advertising is served today, so there is nothing to opt out of. Should advertising be introduced, cookies would never load until you accept them, and choosing “Essential only” would disable advertising personalization. You can review or reset any stored choice on the Cookie policy page.

Contact

Privacy or abuse questions can be sent to contact@reflatten.com