Skip to main content
Menu

City and Landscape Stock Photos

Privacy policy

Last Updated: November 1, 2026
Effective Date: November 1, 2026

This Privacy Policy is to help you understand how Anshar Images ("we," "us," or "our") collects, uses, processes, and safeguards your personal information when you access and use our website, services, and applications (collectively, the "Services").

Your Privacy Rights

For EU Residents (GDPR): You have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data. You may also withdraw consent at any time and lodge complaints with supervisory authorities.

For California Residents (CCPA): You have the right to know what personal information we collect, delete your personal information, opt-out of sale (we don't sell data), and non-discrimination for exercising your rights.

Contact for Privacy Rights: Use our contact form to exercise your rights or ask privacy questions.

Information We Collect

Direct Registration

When you send our sign-up form, we save your email address in a new account and send you an email with a link. We also send ourselves a notice with the address. We do this also if you never open the link. When you press Confirm Email Address on the page of the link, we save your name and your newsletter choice. You can then choose a password. We save it only as a hash, a protected form that nobody can read. This information is used for account management and service provision.

Social Login Authentication

Facebook Login: We no longer offer sign-in with Facebook. If you signed in with Facebook before, we keep your Facebook user ID with your account until you delete your account.

Google Sign-In: When you sign in with Google, we collect your name, email address, and profile information through Google's OAuth 2.0 API using OpenID Connect. We request minimal scopes ('openid', 'email', 'profile'). Google Privacy Policy

X (Twitter) Login: We no longer offer sign-in with X (Twitter). If you signed in with X before, we keep your X user ID with your account until you delete your account. To sign in, use "Forgot password" on the Login page to set a password.

Social Account Management: You can remove our access at any time in your Google or Twitter (X) account settings. This does not delete your account or the data we keep. To delete them, delete your account. The Delete Account part below says what we keep.

Automatic Information

We automatically collect technical information including IP address, browser type (the User-Agent text your browser sends), the page address, the page you came from, and the time. Our web server writes these into its log for every request. We use the log to keep the website working and to stop abuse. We delete the log each time we update the website. There is no fixed time limit. Copies can stay longer in backups of our server. Our other logs and our error alerts do not contain your IP address. Our login, sign-up, contact and newsletter forms use Cloudflare Turnstile. When one of these pages opens, your browser loads a check from Cloudflare, so Cloudflare gets your IP address. When you send one of these forms, we also send your IP address to Cloudflare. When you are signed in, we do not do this for the contact form. Cloudflare uses it to check that you are not a bot.

Visitor Counting

We estimate how many visitors our website has each day. One visitor means one IP address and one browser (the User-Agent text your browser sends) in one day, in UTC time. We count you only after you click, tap, scroll with a mouse wheel or a touchpad, or press a key on one of our pages. Touching the screen to scroll also counts. Your browser then sends one small request to our server. This request sets no cookie and stores nothing in your browser. Your browser also sends our website's cookies with this request, as with every request to our website. We do not use them to count visitors. We count visitors in this way whether you click Accept or Decline. To count visitors, our server turns your IP address and User-Agent into a code, using a secret key. We do not store your IP address or User-Agent for this count. We make a new key every day. Our cache stops giving out a key when its day ends. The key itself can stay longer in the cache's memory, in the cache's files on our server, and in backups of our server. When counting starts on a new day, we delete the codes of earlier days. Some codes can stay longer, for example when a deletion fails, and are removed by a later deletion. We keep only the number of visitors per day. Our database logs and backups can contain codes, but never the key.

Photo Data API and MCP Server

Our public photo data API (addresses that start with /api/v1/) and our MCP server for AI assistants (/mcp) limit the number of requests from each IP address. For this limit, we use your IP address only to keep a count in our server's cache for about one minute. The cache keeps the count under a code made from your IP address. We also count the calls of the API and of each MCP tool per day. These daily counts do not contain your IP address.

Buying Through an AI Assistant

You can buy a photo through an AI assistant that you connect to our purchase server for AI assistants (/mcp/purchase). To connect, you sign in to your account on our website, or you continue as a guest. For each connection, we keep a record of the caller: your account, or an identity without an account. The record also holds the time when we created it. An order that you make through the AI assistant stores the caller that made it. For an order without an account, it also stores the email address that you give for the order. The company behind the AI assistant that you use gets what our tools return: the photo, the license, the price, the order number, the order's state, the receipt and the download link. It also gets the email address that you give for the order, and your name if you withdraw from an order through it. To pay, the AI assistant gives us a payment token from Stripe. We send it only to Stripe, and we do not store it. To stop abuse, our server's cache keeps two counts for each IP address. One counts the new guest connections and lasts one hour. The other counts the requests that AI assistants send to find our sign-in service or to register with it, and lasts one minute.

Google Maps

Our Photos page, every country page and every city page load Google Maps when you open the map, or when you open the page in map view. Every photo map page loads Google Maps as soon as it opens. Google then gets your IP address and information about your browser. Your cookie choice does not change this. Google Privacy Policy

How We Use Your Information

We use your information to provide services, personalize your experience, process transactions, send communications (with your consent), and comply with legal obligations.

Data Sharing

We do not sell your personal information. We share it with services that run parts of our website for us, for example Cloudflare for the bot check, and PayPal and Stripe for payments. We share it with anyone else only when the law requires it, to protect our rights, or when you agree.

These services get personal data through our website:

  • DigitalOcean runs our server. The server holds our database, with your account, your orders, your messages to us, your comments and your newsletter subscription. The server also keeps our web server log, which contains your IP address.
  • Cloudflare checks for bots on our login, sign-up, contact and newsletter forms. It gets your IP address.
  • PayPal and Stripe take your payment. They get the names of the photos, the licenses and the prices. For an order of your account, Stripe also gets your email address and your customer number on our website. For an order without an account, you type your email address on the Stripe page, and Stripe sends it back to us. For a PayPal order without an account, we keep the email address that you type on our website. We do not send it to PayPal.
  • The AI assistant that you connect gets data if you buy through it. The company behind it gets what our purchase tools return about your order, and the email address and the name that you give through it. The part Buying Through an AI Assistant above says more.
  • Mailgun delivers our emails. It gets your email address and the text of each email that we send you. It also gets the emails that we send to ourselves about you, for example about your order or your message.
  • Google hosts our own mailbox. It holds the emails that we send to ourselves about you, and the emails that you send us.
  • Telegram delivers notices to us about accounts, orders, newsletter sign-ups, comments and contact messages. A notice can hold your name, your email address, your newsletter choice, and what you bought or wrote.
  • Google Analytics gets data about your visit, but only after you click Accept in the cookie banner.
  • Google Maps gets your IP address when a map loads: on our Photos page, country pages and city pages when you open the map, and on every photo map page. Your cookie choice does not change this.
  • Google learns that you use our website when you sign in with it.

Our pages also load files from other services, for example our photos and some program code. These services get your IP address when your browser loads the files.

Payment Processing

We use third-party payment processors (PayPal and Stripe) for transactions. Their data handling is governed by their own privacy policies, not ours. Please review their privacy policies when making purchases.

When you pay, we keep an email address with your order. For an order of your account, it is the email address that PayPal or Stripe sends us. If they send none, we may keep the email address of your account instead. For an order without an account, it is the email address that you type: on the Stripe page, or on our website before PayPal opens. We keep your country with your order too, if PayPal or Stripe sends it. We also keep your PayPal payer ID or your Stripe customer ID with your order. For an order of your account, we keep it with your account too.

An order without an account belongs to no account. When it is paid, an account whose confirmed email address is the order's email address can see it. The account sees it only while it has that email address.

Your order also holds the email address that we send your order confirmation to. For an order of your account, it is your account's email address when the order completes. For an order without an account, it is the email address that you typed for the payment. We also keep the time when the first download of your order started.

With each order, we also keep one word that tells how your visit to our website began: from an AI assistant site, from another site, or from no site, for example when you typed our address. We keep this word, and not the address of the page that you came from. We use it to compare how buyers come to our website.

Communications from us

We send you the emails that you need for your account and your orders. Examples are the email that confirms your address, a password reset, and a notice when someone tries to sign up with your email address. Others are an order confirmation with the link to your files, which also confirms your right of withdrawal, a new link to your files when you ask for one on our Lost your link? page, and an email that says that we received your withdrawal.

When your account is confirmed, we send you one welcome email. Your account is confirmed when you press Confirm Email Address on the page that the link in our email opens, or when you sign in with Google.

We may send a newsletter about new photos and offers. We send it only to people who ask for it. You ask for it when you tick the newsletter box on the page that confirms the email address of your new account or on your Account page, or when you subscribe on our Subscribe page. The box on the page that confirms your email address starts unticked. When you subscribe on our Subscribe page, we send you an email to confirm your address. After you confirm it, we send you one welcome email.

We send no other marketing emails.

For the newsletter choice on your account, untick the newsletter box on your Account page and click Update. If you subscribed on our Subscribe page, with or without an account, ask us through our contact form to remove your subscription.

Data Retention

Account Data: We keep your account information until you delete your account. The Delete Account part below says what we keep after that. We do not delete an account that nobody confirmed. It keeps the email address, also after the link in our email stops working.

Social Login Data: Social authentication tokens are not stored; only basic profile information is retained.

Purchase History: We keep transaction records for at least 7 years, for legal and tax compliance. We do not delete them automatically. We also keep them when you delete your account. If you withdraw from an order, we keep your withdrawal statement with them too.

AI Assistant Connections: We keep the record of each caller as long as we keep its orders, because the record shows whose orders they are. We do not delete these records automatically. When you delete your account, the record stays, but it no longer leads to your name or email address. When you delete your account or set a new password, every AI assistant that you connected with your account loses its access. The email address of an order without an account is part of the order, and we keep it as the Purchase History line says.

Marketing Data: We keep a subscription from our Subscribe page until you ask us to remove it through our contact form. We can also remove it earlier.

Analytics Data: Google Analytics keeps two kinds of data. Event data is the record of each action on our pages, for example each page you open. Google Analytics keeps it for 14 months. User data is the data linked to the Google Analytics cookie that tells your browser apart from others. Google Analytics keeps it for 14 months after the last activity it records. Each new recorded activity starts that period again. Google deletes data once a month, after its time has passed. These times do not apply to Google's summary reports, which add up the data of all visitors. Google's page about data retention

Cookies and Tracking

Essential Cookies: Required for website functionality, user sessions, and security. Our cookie banner does not turn them off.

Analytics Cookies: We use Google Analytics to understand how our website is used, but only after you click Accept in the cookie banner. Until you accept, our pages do not load Google Analytics. After you accept, Google Analytics gets the address and title of most pages you open, the page you came from, and what you do on our pages. For example, it gets the words you search for and the photos you add to your cart. If the link that brought you to us has campaign tags (utm_source and similar), it also gets these tags. Google Analytics also gets information about your browser and your device. Google works out your approximate place, for example your country and city, from your IP address. We do not attach your account's name, email address or account number to the data that Google Analytics gets. You can change your choice at any time with the Cookie Settings link at the bottom of this page. If you click Decline, Google Analytics stops collecting on that page, and the pages you open after that do not load it. Data recorded in the few seconds before your click may still be sent. Pages of this website that are already open, for example in other tabs, can keep running Google Analytics until you open a new page in them. According to Google, Google Analytics 4 does not log or store IP addresses. Opt out of Google Analytics

Social Login Cookies: Google may set cookies when you sign in with it.

Cookie Management: You can control cookies through your browser settings. Disabling cookies may affect website functionality.

Children's Privacy

Our services are not directed to individuals under 18. We do not knowingly collect personal information from children. If we discover such collection, we will promptly delete the information.

International Data Transfers

Your personal information may be transferred to and processed in countries other than your country of residence, including the United States. We ensure appropriate safeguards are in place for international transfers in compliance with GDPR and other applicable laws.

Security Measures

We implement industry-standard security measures including SSL encryption, secure password hashing (bcrypt), CSRF protection, and regular security updates. We use Cloudflare Turnstile for bot protection and maintain secure hosting infrastructure.

Data Breach Notification

In the event of a data breach affecting your personal information, we will notify you within 72 hours via email and provide details about the incident, affected data, and steps taken to address the breach.

Managing Your Personal Information

Access and Update: You can access and update your personal information by logging into your account.

Delete Account: You can delete your account in your account settings. You cannot undo this. We then delete your comments, likes and favorites. We also delete the user IDs of your Google, Twitter (X) or Facebook sign-in. If you have no orders, we delete everything else in your account too. If you have orders, including unpaid ones, we keep your orders and their invoices for our tax and business records. We also keep the part of your account that they belong to. We remove your name, email address and password from it. Your orders and invoices still hold the email address and the country that we saved with your payment. The messages that you sent us through our contact form stay too. They keep your name and email address. If an email that we send you fails, our system can keep a record of it. The record holds your email address, also after you delete your account. A daily cleanup deletes the record when it is more than 30 days old. Our database also keeps a log of its changes. This log holds the deleted data, and the records of failed emails too. The database keeps each log file for at least 30 days after its last change, and it can keep it longer.

To delete your account you need a password. If you have none, set one with "Forgot password" on the Login page. If you did not finish signing up, or someone else typed your email address on our sign-up form, ask us through our contact form to delete the account.

Download Data: You can request a copy of your personal data through our contact form.

Contact Information

Privacy & General Questions: Contact Form
Business Type: Digital-only business operating online