The short version: The current Free AI Wiper cleaners process supported files and text in your browser. The content you select is not uploaded to our servers. If you create an account or visit the site, we still process the account and technical data described below.
Who is responsible?
The data controller is Mahdi Hezaveh IT Consulting. You can contact us about privacy at support@empinet.com or by using the postal address in our Impressum.
Files and text you process
The current image, document, video, audio and text cleaning features run on your device. Your browser reads the content you select, performs the available checks and cleaning locally, and lets you download or copy the result. We do not receive, store or inspect that content through these features. Your browser and device control any original or downloaded copy you keep.
If we add a feature that sends content to a server, we will explain that before you use it and update this policy.
Account and email data
An account is optional for the basic cleaner. If you register, we store your email address, a display name derived from it, a password hash and the status of your email verification. We use these details to provide and secure your account, send verification and password-reset emails, and respond to account requests. The legal basis is Article 6(1)(b) GDPR, where processing is needed to provide the account, and Article 6(1)(f) GDPR for account security and misuse prevention.
Providing an email address and password is necessary to create an account; without them, you can still use features that do not require sign-in. We do not use account emails for marketing in the current app.
During registration, we send your email address to EasyEmailAPI to check its validity, domain mail records and whether it belongs to a disposable email provider. Validation results may be cached for up to 24 hours to avoid repeated checks. Your password and files selected for cleaning are not sent to this service.
If you email us, we process your address and message to answer you. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in handling inquiries, or Article 6(1)(b) GDPR when your message concerns your account.
Website requests, logs and cookies
When you visit Free AI Wiper, the web server and hosting provider receive technical request data such as your IP address, browser information, requested page and time of access. Technical logs may be kept to operate the site, investigate errors and protect it from abuse. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in a secure and reliable service.
The site uses essential session and security cookies for sign-in, form protection and, if you choose it, remembering your login. These are needed to provide the functions you request; they are not advertising cookies. Access to or storage on your device for these essential functions falls under § 25(2) TDDDG. Related personal-data processing relies on Article 6(1)(b) or 6(1)(f) GDPR, depending on the function.
The language preference cookie remembers the language you choose for up to one year. You can change it using the language selector or remove it in your browser. It is used to provide your selected interface language, not for advertising.
Tool usage and credits
When a clean successfully changes a result, your browser sends us the tool category and a random request ID. The server records the time, your account ID if you have a verified account, or a random visitor ID kept in a first-party cookie, plus the request IP address. We use these records to apply the daily or weekly credit limit and count use of each tool. Inspections, failed cleans and unchanged results are not recorded as tool use. We do not receive the file, filename or text being cleaned.
The visitor cookie lasts for 30 days and is used to apply the daily visitor limit. We remove IP addresses and visitor IDs from usage records after 30 days; the tool category and time remain for aggregate reporting. Account IDs are removed from usage records when an account is deleted. Country, region and city fields exist for a possible future local IP lookup but are not populated now; no IP address is sent to a geolocation service. We rely on Article 6(1)(b) GDPR to provide account credits and Article 6(1)(f) GDPR for visitor limits and basic aggregate service measurement.
Mobile and desktop installation reporting
When the mobile app opens, it can send an app-open check-in with its platform-provided device identifier (Apple vendor ID or Android ID), app version/build, operating system version/build, manufacturer, brand, model and CPU architecture where available. The shared API also accepts desktop reports using a randomly generated app installation ID. Ordinary reports are attempted at most once per 24 hours of use; login and app-version/build changes can trigger another report. Files continue to be cleaned locally.
We use these records to understand approximate installation counts, recent activity, device compatibility and app-version distribution. We store the first and latest check-in times and, when authenticated, the last account ID and authenticated check-in time. Signing out does not erase that last association; guest check-ins never advance account activity. Deleting an account removes its association from the installation record. Installation records currently have no automatic expiry.
These reports contain no files, filenames or individual cleaning events, and add no IP address or location analytics. They do not collect device names, hardware serial numbers, IMEI, MAC addresses or advertising identifiers. Platform identifiers can reset; desktop app data removal can create a new ID. Reporting failures do not prevent otherwise permitted local cleaning. Normal technical request logs described above still apply.
Website analytics
The production website uses Google Analytics 4 to measure visits and website usage. Google's tag loads when you visit the site and may use analytics cookies to distinguish visitors and sessions. Google receives technical information about your browser and device, page visits and interactions. We do not send the files or text you select for cleaning, your account email address or your display name as analytics event data. For more information about Google's processing, see Google's privacy policy.
Website error reporting
When enabled in production, the website uses hosted Sentry to report unexpected application errors. Browser reports contain exception types, reduced stack locations, app release and environment. Laravel server reports and server-rendering failures use similarly reduced diagnostics. Raw error messages, file contents and names, account and device identifiers, request bodies, cookies, authorization headers, arbitrary context, source snippets and local variables are removed from these reports. We do not enable Sentry session replay, performance tracing, profiling, session tracking, breadcrumbs, logs or metrics for this feature. It does not report individual cleanups or app-open analytics.
Repeated errors are suppressed and reporting is limited to reduce unnecessary transmission. Reporting is off in development and when no reporting endpoint is configured. Reporting failures do not prevent local cleaning. Sentry and its infrastructure receive the technical network data needed to accept reports, such as the connection IP address; this is separate from the application data we remove. Reports are retained according to the Sentry project's retention settings and may be processed by Sentry as a service provider. For details, see Sentry's privacy policy. The service-provider, transfer and rights provisions below also apply.
Service providers and transfers
Providers that host the app or deliver account emails may process the technical or account data needed for those services on our behalf. We do not sell your personal data or send files selected for local cleaning to these providers. We may disclose data when legally required.
If a provider processes personal data outside the European Economic Area, we use a valid GDPR transfer mechanism, such as an adequacy decision or standard contractual clauses. You can ask us for information about the providers and applicable safeguards at support@empinet.com.
How long data is kept
We keep account data while your account exists and delete it on a verified deletion request, unless a legal obligation or a necessary legal claim requires longer retention. Password-reset links are valid for 60 minutes; used or expired tokens are removed through the account system's cleanup process. Session data expires according to the site's session settings. Technical logs and support messages are kept only as long as needed for security, troubleshooting or answering the request, subject to any legal retention duty.
Your rights
Subject to the GDPR's conditions, you can request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. Contact support@empinet.com to make a request. You can also complain to a data protection authority, including the North Rhine-Westphalia supervisory authority.
We do not use account data for automated decisions or profiling with legal or similarly significant effects.
Changes to this policy
We will update this page when the app's data practices change and show the current date above. Material changes affecting account holders will also be communicated through the service or by email where appropriate.