Aperty

GDPR overview

GDPR is addressed explicitly. Shinyfields Limited names itself as data controller and commits to "commercially reasonable steps to maintain compliance with GDPR requirements". The policy sets out the full set of rights — access, rectification, erasure, restriction, portability, objection and withdrawal of consent — all exercised through privacy@skylum.com, with complaints directed to the Office of the Commissioner for Personal Data Protection of Cyprus. Being established in Cyprus, the publisher needs no Article 27 representative. Transfers outside the EEA are anticipated and covered by standard contractual clauses. Two reservations deserve stating: the text still cites the EU-US Privacy Shield, invalid since 2020, and carries update dates of 23 July 2018 and 2 September 2022. No DPO is named, no DPA is offered and no subprocessor list is published.

Who owns the data?

Aperty processes images locally: Skylum states that your files never leave your machine, so editing alone transfers no photograph to the vendor. The software itself remains Skylum's — you hold a licence, not the code. The caution sits elsewhere. Under the Terms of Use, any "Materials" you do submit to the website or the products, photographs included, fall under a perpetual, irrevocable, worldwide, sub-licensable and royalty-free licence granted to Skylum, extending to commercial exploitation and to the publicity, image and name rights of the people depicted. Shinyfields Limited acts as data controller for personal data.

Reuse rights

You keep your photographs, which stay on your own computer, and nothing restricts what you do with the images you produce: retouched files can be delivered, printed and sold to clients without asking Skylum for permission. What you receive over the software is narrower — the Terms of Use grant a limited, revocable, non-transferable licence to use the website, and the EULA governs use of the program itself. In the other direction, Skylum needs no permission to reuse anything you voluntarily submit to it: the "Materials" clause is unlimited in time, territory and purpose. Skylum does state it will not pass your personal data to other businesses for their own marketing.

Data retention & training

Hosting summary

Two questions need separating here. Your photographs are not hosted anywhere: Aperty processes them locally on your own computer, and Skylum states that files never leave your machine. Hosting therefore concerns only account, billing and usage data. On that data the privacy policy stays deliberately vague. It confirms that information may be stored and processed on systems located outside the European Economic Area, without naming a single country, region or provider. For transfers it invokes standard contractual clauses and — in wording that has not been refreshed — the EU-US Privacy Shield, invalidated in 2020. The United States is explicitly cited as a jurisdiction without an adequacy decision. Security is described in general terms only: secure servers, appropriate technical and organisational measures. No certification is claimed anywhere on the site, no data processing agreement is offered and no subprocessor list is published. For completeness, the aperty.ai website itself resolves to an Amazon Web Services node in the United States. That says where the site is served from, not where customer data lives.