Last updated: 4 November 2026

Who runs Noumbra

Noumbra is operated by ipassas design, Agiou Georgiou 40, Syros 84100, Greece. ipassas design is the data controller for the personal data described here. Write to design@ipassas.com about anything on this page.

The short version

Your photos stay on your device. All image processing happens inside your browser, and we never receive the original file. We store what it takes to run your account: your email, your pass and balance, your payment confirmations, and a small record of each image you trace. We run no advertising and no analytics.

What we process and why

• Photos. Decoded and traced in your browser. They are never uploaded to our servers. So you can reopen a piece later, the browser may keep the photo in its own storage on the device you traced it on.
• Account data. Your email address and a hashed password, or your Google sign-in, stored with Firebase Authentication. We use your email to send account messages such as password resets, from noreply@noumbra.com. Legal basis: performance of contract.
• Access and history. Your pass, your generation balance and, for each traced image, a small thumbnail, the file name, the settings and the colour palette, stored in Cloud Firestore so your shelf follows your account. Legal basis: performance of contract.
• Payments. Handled by Stripe Payments Europe Ltd. We never see or store your card or other payment details. We receive a confirmation of the purchase, which pass it was, the amount and the currency. Legal basis: performance of contract and our bookkeeping obligations.
• Invites. If you join through someone's invite link, we record who invited you and credit that person when you buy a pass. Your browser keeps the link's reference until you make your account. Legal basis: legitimate interest in running the invite programme.
• School applications. The form opens your own email app. If you send the message, we receive what you wrote at design@ipassas.com and use it to decide on free access. Legal basis: your request.
• Technical data. Our hosting provider handles your IP address and browser details to deliver the site. The site's typeface loads from Google Fonts, so Google also receives your IP address when a page opens. Legal basis: legitimate interest in delivering the site.

What you choose to make public

Nothing is public until you tick the consent box and share a template. A shared piece shows a mid-resolution preview of the generated template, its name, its palette and its settings on the community page and your gallery page, and it may be picked for the wall on the home page. Your original photo is not included. Any profile details you fill in (name, nickname, gallery title, intro and avatar) appear next to your pieces, and your star votes feed the public leaderboard. Legal basis: your consent, which you can withdraw by taking the piece down from your shelf.

Who receives your data

• Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Firebase Hosting and Google Fonts).
• Stripe Payments Europe Ltd (payments).

Both process data under their own GDPR commitments, with standard contractual clauses where data leaves the EU. We do not sell personal data or share it with anyone else unless the law requires it.

How long we keep it

Account data and history stay for as long as your account exists. A history entry you delete is removed immediately. You can delete your account from your profile page, or ask us to, and everything except the records tax law makes us keep is removed within 30 days.

Your rights

Under the GDPR you can ask for access, correction, deletion, restriction and portability, and you can object to processing or withdraw consent. Email design@ipassas.com and we will act within 30 days. You can also complain to the Hellenic Data Protection Authority or your local data protection authority.

Cookies and browser storage

The cookies page lists what is stored in your browser.