Privacy Policy

• "Users" refers to photographers and professionals who create accounts and use our Services.
• "End Users" refers to clients, visitors, and customers who view galleries shared by Users.
• "Content" refers to photographs, videos, and other media uploaded to our platform.

1.1 Information You Provide

• Account Information: Name, email address, password, business name, and country when you register.
• Payment Information: Billing details and payment method information processed securely through Stripe.
• Profile Information: Photography specialization, portfolio details, branding preferences, and service offerings.
• Content: Photographs, videos, albums, galleries, and associated metadata (EXIF data, captions, tags).
• Client Information: Client names, contact details, and project information you choose to store.
• Communications: Support requests, feedback, and correspondence with our team.

1.2 Information Collected Automatically

• Usage Data: Feature usage, workflow patterns, upload/download activity, and session information.
• Device Information: IP address, browser type, operating system, device identifiers, and connection details.
• Performance Data: Page load times, error rates, and system performance metrics.
• Location Data: General geographic location based on IP address (not precise GPS location).

1.3 Information from Third Parties

When you connect third-party services (such as social media platforms or cloud storage), we may receive information in accordance with your permissions and their respective privacy policies.

For albums where a photographer turns on our face-grouping feature, Albumy analyzes uploaded photos to detect faces and derive a mathematical representation of facial geometry (a facial embedding) for each detected face. Depending on where you live, this may be considered biometric or biometric identifier information under applicable law.

2.1 What We Collect and Why

• We generate a facial embedding, a set of numeric values describing the geometry of a detected face, from photos in albums where face processing is enabled.
• We use these embeddings only to group photos of the same person within that album, so guests can tap a face to see every photo they appear in (our people filter).
• We do not use facial data to determine a person's identity, age, gender, or any characteristic beyond distinguishing one face from another within the same album, and we do not use it to train AI models.

2.2 Photographer Control

Whether face processing runs on an album is controlled by the photographer who owns that album, through an album-level setting. A photographer can leave face processing off, or hide a specific person from the people filter, at any time.

2.3 Retention

A facial embedding is retained only as long as the photo it was derived from. Deleting a photo or an album first marks it as deleted and removes it from view, and it stays recoverable for a 7 day restore window. After that window passes, a scheduled job permanently removes the photo and, with it, the facial embedding derived from that photo. Turning off the people filter for an album hides all face groupings from guests immediately, but does not by itself delete the underlying embeddings. See Section 6 (Data Retention).

2.4 Your Rights and Removal Requests

If you appear in a photo processed by Albumy and would like your facial data removed, contact us at [email protected] (or ask your photographer directly) with the album name and, if possible, a link to a photo showing you. We will remove the associated facial data. You may also ask the photographer to turn off the people filter for that album, which immediately hides all face groupings from guests.

2.5 No Sale or Third-Party Use

We do not sell facial data or biometric information, and we do not share it with third parties except the infrastructure and processing providers listed in Section 4 (How We Share Your Information) who help us operate the Service under contract.

3.1 Providing Services

• Create and manage your account
• Store, process, and deliver your photography content
• Enable gallery creation, sharing, and client collaboration
• Process payments and manage subscriptions
• Provide customer support and respond to inquiries

3.2 Improving Services

• Analyze usage patterns to improve platform performance and features
• Develop new products and functionality based on user needs
• Conduct research and analytics to enhance user experience

3.3 Security and Protection

• Detect, prevent, and address fraud, abuse, and security threats
• Monitor for unauthorized access and suspicious activity
• Enforce our Terms of Service and protect our legal rights

3.4 Communications

• Send service-related announcements, updates, and security alerts
• Respond to your comments, questions, and support requests
• Send promotional communications (with your consent, which you may withdraw at any time)

We may share your information only in these limited circumstances:

4.1 Service Providers

We work with trusted third-party service providers who assist in operating our platform:

• Payment Processing: Stripe for secure payment handling
• Cloud Storage: AWS S3, Cloudflare R2, and IDrive E2 for secure file storage
• Authentication: Clerk for secure user authentication
• Analytics: PostHog for platform performance insights
• Video Delivery: Bunny.net for optimized video streaming

4.2 Legal Requirements

We may disclose information when required by law, court order, subpoena, or to protect the rights, safety, and security of our users, platform, or the public.

4.3 Business Transfers

In connection with a merger, acquisition, or sale of assets, your information may be transferred.

4.4 With Your Consent

When you explicitly authorize us to share your information for specific purposes.

We implement industry-standard security measures to protect your information:

• Encryption: AES-256 encryption for data at rest and TLS 1.3 for data in transit
• Access Controls: Multi-factor authentication and role-based permissions
• Monitoring: 24/7 security monitoring and threat detection
• Redundancy: Multiple backup systems across geographically distributed data centers
• Compliance: Adherence to SOC 2, GDPR, and CCPA requirements

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

We retain your information for as long as necessary to provide our Services:

• Account Data: Retained while your account is active and for a reasonable period thereafter
• Content: Retained until you delete it or close your account
• Transaction Records: Retained as required by tax and accounting regulations
• Usage Data: Typically retained for 24 months for analytics purposes

Upon account deletion, we will delete or anonymize your personal information within 30 days, except where retention is required by law.

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Portability: Request your data in a portable, machine-readable format
• Restriction: Request restriction of processing in certain circumstances
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent where processing is based on consent

7.1 California Residents (CCPA)

California residents have additional rights including the right to know what personal information is collected, used, and shared; the right to delete; and the right to non-discrimination.

7.2 European Users (GDPR)

If you are in the European Economic Area, you have rights under the GDPR including all rights listed above. You also have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, please contact us at [email protected].

We use cookies and similar technologies for:

• Essential Cookies: Required for authentication, security, and core platform functionality
• Analytics Cookies: Help us understand how users interact with our Services
• Preference Cookies: Remember your settings and preferences

You can control cookies through your browser settings. Disabling certain cookies may limit your ability to use some features of our Services.

Your information is primarily stored and processed in the United States. If you access our Services from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

We ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses approved by the European Commission where applicable.

Our Services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn we have collected information from a child under 13, we will delete it promptly. If you believe we have collected information from a child under 13, please contact us at [email protected].

Our Services may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access through our platform.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. For significant changes, we may also send you an email notification. Your continued use of our Services after any changes constitutes acceptance of the updated Privacy Policy.

If you have questions about this Privacy Policy or our privacy practices, please contact us: