Your photograph is not ours to keep.

Sephia Room is a photograph restoration service for household prints in Nigeria, and is the data controller for the processing described here. Write to us at hello@sephiaroom.com about anything in this notice.

Our registered company details are available on request at that address. Ask and we will send them.

This notice is written to meet the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation 2019. Where those instruments give you a right, you have it whether or not it is repeated here.

The whole path, step by step:

• You choose a photograph. It is read by your own browser. Nothing has been sent anywhere yet.
• You set four corners on the print. The squaring and de-skewing happen on your device, in the page, not on our server.
• The squared image is sent to our server over HTTPS so the clearing bath and the enlargement can run.
• Our server holds it in memory, performs those operations, and sends the finished file straight back to your browser in its reply.
• When that reply is sent, the request ends and the image is gone from memory. It is not written to a disk, not copied to storage, not queued, and not backed up.
• Your browser holds the result so you can compare and download it. Closing the tab discards it.

Personal data we process, and nothing beyond it:

• The photograph itself — which will usually contain images of people, and may reveal things like religion or ethnicity. It is held only in memory, for the duration of one request, as described in clause 02.
• Ordinary server request data — your IP address and the technical details every web server receives in order to reply to you at all. We do not build profiles from it.
• Anything you write to us — if you send an email, we have that email.

We do not ask for your name, your phone number, your address or your date of birth, because the service does not need them.

• We do not keep your photographs.
• We do not use your photographs to train, fine-tune, evaluate or improve any model, ours or anyone else’s.
• We do not publish your photographs. Every photograph shown on this site is a public-domain archive print, credited where it appears.
• We do not sell, rent or share personal data with anyone.
• We do not set cookies, and we do not run analytics or trackers.
• We do not load fonts, scripts, images or anything else from a third party. Opening this site causes your browser to contact our server and no one else.

One value, in your browser’s local storage, under the key sephiaroom.prints: a count of how many of your 3 free restorations you have used.

It never reaches our server — we cannot read it. It is not a cookie and it identifies nothing about you. Clearing your browser data resets it, which also resets your free count; we have accepted that, because the alternative is making you create an account.

Our lawful bases under the NDPA:

• Performance of a contract. Processing the photograph you upload is the service you asked for. We cannot restore a photograph without processing it.
• Consent. A photograph of an identifiable person can be sensitive personal data. By uploading it you consent to it being processed for the sole purpose of restoring it for you. You can withdraw that consent by not uploading; once a restoration has finished there is nothing left to withdraw it from.
• Legitimate interests. Keeping the service running and secure.

We do not transfer personal data outside Nigeria, because we do not transfer it to anyone. If that ever changes, clause 07 applies.

Two stages of the bench — repairing tears, and colouring — need a restoration model that we do not run ourselves. No such provider is connected today. Those stages do not run, the interface tells you so before you start, and your photograph reaches no company but us.

When we connect one, all of the following will be true before it goes live:

• This notice will name the provider and the country it processes in.
• The interface will tell you, before you press anything, that the photograph will leave our server.
• We will not connect a provider that reserves the right to train on what we send it.
• Sending your photograph to a provider will remain something you choose, not a default.

A family photograph contains people who are not you, and some of them may be alive. You are responsible for having the right to upload it — see clause 03 of the Terms.

If you appear in a photograph someone else uploaded and you want it dealt with, write to us. We will help where we can, but understand what we are telling you above: we do not keep uploads, so in most cases there will be nothing of yours in our possession to find, correct or delete.

The service is not directed at children and is not intended for use by anyone under 18. Family archives routinely contain photographs of children, including people who are now adults. Restoring a photograph that happens to show a child is an ordinary use of this service; it is handled exactly as clause 02 describes, and the image is not retained.

Under the NDPA, processing a child’s personal data generally requires the consent of a parent or guardian. If the photograph shows a living child, do not upload it unless you are that child’s parent or guardian, or you have their consent.

You have the right to:

• be told what personal data of yours we hold, and get a copy of it;
• have inaccurate data corrected;
• have data erased;
• restrict or object to processing;
• receive data in a portable form;
• withdraw consent at any time, without that affecting what was lawful before you withdrew it;
• complain to the Nigeria Data Protection Commission.

We answer within 30 days and we do not charge for it. In practice most of these requests will get the same honest answer: we are not holding anything of yours, because the architecture does not keep it. We would rather tell you that than perform a search we know is empty.

Photographs are transmitted over HTTPS. They exist on our server as bytes in memory for the life of a single request and are not persisted. Holding nothing is the strongest security measure available to us, and it is the one we have chosen.

No method of transmission over the internet is completely secure. We cannot guarantee absolute security, and we will not claim to.

If we change this notice we will change the date at the top of the page. For a change that materially affects what happens to your photograph — connecting a model provider above all — we will say so on the page before the change takes effect, not afterwards.

Privacy questions, access requests, corrections, erasure and complaints all go to hello@sephiaroom.com. One address, read by a person.

If you are not satisfied with how we handle a request, you can complain to the Nigeria Data Protection Commission. You do not have to come to us first.