The short version: the files you convert, compress or turn into passport photos stay on your device. Altols never receives them. We only see what is needed to take a payment, and Stripe handles that.
Last updated 29 October 2026.
Who we are
Altols (altols.com) is operated by Altols, a sole trader business, ABN 43 276 196 879, Sydney NSW, Australia. We are responsible for personal information collected through this website. Contact us about privacy at privacy@altols.com.
Your files
When you use any Altols tool, the processing is done by code running in your web browser. Your photos, videos, PDFs and other files are read and processed on your own device and are not sent to our servers or anyone else's. Closing the page discards them, except as described under “What is stored on your device”.
The passport photo tool downloads a small face-detection model from our own server so it can find your face. The detection runs on your device. No image or face data leaves it.
Information we collect
When you pay
Payments are processed by Stripe, Inc. You enter your card details on Stripe's checkout page, not on ours, and we never see your full card number. Stripe shares the following with us so we can provide what you bought and handle refunds: your email address, the country of your card, the amount, the product, the date, and the last four digits and brand of your card. We use these only to deliver your purchase, answer support questions, process refunds, prevent fraud and meet tax and accounting obligations. Stripe's own use of your data is described in the Stripe Privacy Policy.
Server logs
Our hosting provider, Vercel Inc., keeps short-term technical logs of requests to our website, such as IP address, browser type and the page requested. We use these only to keep the site secure and working, and they are deleted automatically according to Vercel's retention period.
Analytics
We do not use analytics, advertising or tracking scripts.
If you email us, we keep the conversation so we can help you. We do not send marketing email. If we ever do, it will only be with your consent and every message will include a one-click unsubscribe link.
What is stored on your device
Altols uses your browser's local storage, not cookies, for three things:
- Your cookie and analytics choice, so we don't ask again.
- Purchase unlocks, a signed code that proves you paid, kept until it expires (up to 72 hours).
- A finished passport photo awaiting payment, so it's still there when you return from checkout. It is deleted when you download it or after 72 hours, whichever comes first.
You can clear all of this at any time by clearing site data for altols.com in your browser settings.
Children
Altols is meant for adults. People under 18 should use it only with a parent or guardian. Parents and guardians often make passport photos of their children; because those photos are processed on your device, we never receive them. Before paying, we ask you to confirm that you are 18 or over, or the parent or guardian of the person in the photo.
Who we share information with
Only with service providers who help us run Altols: Stripe (payments) and Vercel (hosting). Both are in the United States, so your payment and log data may be processed there. They are bound by contracts and by their own privacy commitments, including standard contractual clauses for data from the EU and UK. We do not sell or rent personal information, and we do not share it for advertising.
How long we keep it
Payment records are kept for as long as tax law requires, which in Australia is generally five years. Support emails are kept for up to two years after the conversation ends. Server logs are kept only for the hosting provider's short retention period.
Your rights
Wherever you live, you can ask us to tell you what personal information we hold about you, correct it, or delete it. Depending on where you live, you may also have the right to object to or restrict how we use it, to receive a copy in a portable format, and to complain to a regulator: in Australia, the Office of the Australian Information Commissioner; in the UK, the Information Commissioner's Office; in the EU, your local data protection authority. California residents have rights under the CCPA; we do not sell or share personal information as defined there.
See how to request access or deletion. We reply within 30 days.
Security
The site is served only over HTTPS, uses a strict content security policy, and never handles card numbers. Payment unlocks are cryptographically signed so they can't be forged. No system is perfectly secure, but because we don't receive your files, there is very little of yours for anyone to take.
Changes
If we change how we handle personal information, we will update this page and the date at the top.