Privacy Policy

1. Who we are

Lustermount LLC, a Wyoming limited liability company located in Wyoming, United States ("Lustermount," "getwhitebg," "we," "our," or "us"), operates getwhitebg.com and is responsible for the processing described in this Privacy Policy.

Questions about privacy can be sent to [email protected].

2. Scope

This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you use our website, image processing tools, billing flows, account features, and support channels.

This Privacy Policy does not apply to third-party sites, payment providers, login providers, or services that maintain their own separate privacy notices.

3. Information we collect

We may collect the following categories of information:

• account and authentication information such as email address, login provider, session data, and account identifiers
• uploaded source images, generated outputs, task records, export records, and related workflow metadata
• billing and transaction information such as product selection, order identifiers, payment status, refund status, and provider event records
• support communications and any information you send to us by email
• limited usage and performance telemetry through Vercel Analytics, Vercel Speed Insights, and optional session replay / heatmap tooling such as Microsoft Clarity when enabled
• technical information such as IP-derived network context, browser type, device information, request metadata, and log data needed to operate and secure the service

4. How we collect information

We collect information in several ways:

• directly from you when you sign in, upload files, export images, buy credits, or contact support
• automatically when you use the website and tool surfaces
• from third-party providers that support login, hosting, analytics, billing, and image processing
• from fraud, security, and operational systems used to keep the service reliable

5. Authentication and account data

The current product uses Google sign-in as the primary authentication path, with account infrastructure supported by Supabase-based systems. When you sign in, we receive account identifiers and related session information needed to authenticate you, maintain your account, and authorize uploads, exports, billing, and history access.

6. Image uploads, outputs, and workflow history

When you use the live tool, the image you upload is transmitted through our application and third-party image processing providers so the background can be removed and a white-background export can be generated.

Uploaded source images, generated outputs, task history, export records, and related workflow metadata may be retained for up to 30 days. We do not currently offer a self-serve deletion control for in-product image history.

7. Payments and billing data

Payments are handled through third-party providers, including Stripe. We do not store full payment card numbers in our application. We do receive billing-related information needed to create checkout sessions, track payment status, grant credits, investigate disputes, and maintain accounting and fraud-prevention records.

8. Analytics, performance telemetry, cookies, and similar technologies

We currently use Vercel Analytics and Vercel Speed Insights to understand site usage, route performance, and high-level product interaction patterns. We do not currently run third-party ad-tech, remarketing, or behavioral advertising trackers on the site.

Depending on browser and provider behavior, our website and service providers may use cookies, local storage, session storage, or similar technologies to support authentication, routing, security, and measurement. We do not currently present the site as relying on advertising cookies.

9. How we use information

We may use information to:

• operate the website and image processing tools
• authenticate users and maintain accounts
• process uploads, exports, and workflow history
• create checkout sessions, process payments, grant credits, and handle billing support
• respond to support, legal, operational, and security requests
• monitor reliability, detect abuse, investigate fraud, and enforce our terms
• analyze product usage and improve product performance, copy, and onboarding
• comply with law, legal process, and provider requirements

10. Legal bases for processing for certain regions

If you are located in a jurisdiction that requires a legal basis for processing, we generally rely on one or more of the following: performance of a contract with you, our legitimate interests in operating and securing the service, compliance with legal obligations, and your consent where required.

11. When we share information

We do not sell personal information. We may disclose information to categories of recipients that help us operate the service, including:

• hosting, infrastructure, database, and storage providers
• authentication and identity providers
• payment, billing, fraud review, and refund-support providers
• image processing providers used to generate exports
• analytics, session replay, heatmap, and performance monitoring providers
• professional advisers, auditors, legal counsel, or acquirers where reasonably necessary
• authorities or other parties where disclosure is required by law, court order, or to protect rights, safety, and security

12. International transfers

We are based in the United States and may process or store information in the United States and other countries where we or our providers operate. Those countries may have data protection laws that differ from the laws of your country of residence.

By using the service, you understand that your information may be transferred to and processed in the United States and other jurisdictions, subject to this Privacy Policy and applicable law.

13. Data retention by category

Our current retention approach is as follows:

• uploaded source images: up to 30 days
• generated outputs: up to 30 days
• task and export history: up to 30 days
• billing and payment records: retained as needed for accounting, dispute handling, fraud prevention, and legal compliance
• support communications: retained as reasonably necessary to respond, document requests, and manage operations
• analytics and performance telemetry: retained according to provider and operational settings

We may retain information longer where required by law, needed for fraud prevention, dispute resolution, tax and accounting obligations, security review, or enforcement of our rights.

14. Security

We use reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, misuse, alteration, and disclosure. No service can guarantee absolute security, and you use the service with that understanding.

15. Children and minors

The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, contact us at [email protected] so we can review the situation and take appropriate action.

16. Your rights and choices

Depending on where you live, you may have rights regarding access to, correction of, deletion of, portability of, restriction of, or objection to the processing of certain personal information.

• all users may contact us with privacy questions or requests at [email protected]
• users in certain US states may have rights to know, access, correct, or delete certain personal information, subject to exceptions
• users in the EEA, UK, or Switzerland may have rights to access, rectify, erase, restrict, object, and request portability, and may also lodge complaints with their local supervisory authority
• we may need to verify your identity before processing certain requests

Because the current product does not offer self-serve deletion of in-product image history, image-processing records generally follow our standard retention schedule of up to 30 days unless a different outcome is legally required.

17. Policy updates

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when changes were last made. Changes become effective when posted unless a different effective date is stated.

18. Contact

Privacy questions or requests can be sent to [email protected].

Controller: Lustermount LLC, Wyoming, United States.