Fotoflo Privacy Policy

Last updated: 17.11.2025

This Privacy Policy explains how Fotoflo ("we", "us", "our") collects, uses, and protects personal data for two groups of individuals:

  • Fotoflo Users – photographers and account holders who use the Fotoflo platform
  • Photographed Individuals – people who are photographed by a photographer using Fotoflo

We take your privacy seriously and handle all personal data in accordance with applicable data protection laws, including the GDPR.

Overview:

Section A — Privacy for Fotoflo Users

  • 2.1 Information We Collect
  • 2.2 How We Use Your Information
  • 2.3 Information Sharing
  • 2.4 Data Security
  • 2.5 Third-Party Services
  • 2.6 Your Rights
  • 2.7 Data Retention
  • 2.8 Children's Privacy
  • 2.9 Changes to This Policy

Section B — Privacy for Photographed Individuals

  • 3.1 Personal Data We Collect
  • 3.2 How Your Data Is Used
  • 3.3 Who Has Access to Your Data
  • 3.4 Data Retention
  • 3.5 Your Rights Under GDPR
  • 3.6 Why Contact From the Client Cannot Be Reversed
  • 3.7 Data Controller

1. Introduction

This Privacy Policy applies to all processing activities carried out through the Fotoflo platform, including the website, applications, and the services offered through them. Fotoflo provides tools for photographers to upload, manage, and deliver photos. Fotoflo also enables optional collection of personal contact details from individuals who are photographed.

Depending on your role, different parts of this policy may apply to you.

Section A — Privacy for Fotoflo Users (Photographers)

2.1 Information We Collect

We collect the following categories of personal data:

Account Information

  • Name
  • Email address
  • Profile details

Photos and Media

  • Images and metadata you upload to Fotoflo

Usage Information

  • Actions you take within the service
  • Access logs
  • Analytics data

Device Information

  • IP address
  • Browser type
  • Device identifiers

2.2 How We Use Your Information

We use your data to:

  • Provide, maintain, and operate the Fotoflo service
  • Process and securely store uploaded media
  • Communicate with you about service updates or account matters
  • Respond to your support requests
  • Improve and optimize the platform
  • Detect and prevent security threats, abuse, or fraud

2.3 Information Sharing

We do not sell or trade your personal information. We may share data only in the following cases:

Service Providers

We use trusted third-party providers to operate the platform, including:

  • Supabase for secure data storage and database services
  • Vercel for application hosting

These providers process data only on our behalf and do not access or use your information for their own purposes.

Legal Requirements

We may disclose information if legally required or necessary to protect our rights.

Business Transfers

If Fotoflo undergoes a merger, acquisition, or sale of assets, personal data may be transferred to the new entity.

2.4 Data Security

We implement robust technical and organizational measures, including:

  • Encryption of data in transit and at rest
  • Regular security evaluations
  • Strict access controls
  • Backup and recovery systems

2.5 Third-Party Services

Some parts of the service use third-party integrations (e.g., Google OAuth). These services may collect or process your data according to their own privacy policies.

2.6 Your Rights

You have the right to:

  • Access and update your personal information
  • Delete your account and associated data
  • Request a copy of your data
  • Opt out of certain communications
  • Withdraw consent when applicable

2.7 Data Retention

We retain personal data for as long as your account is active or needed to operate our service. Some data may be retained longer if required by law or for legitimate business purposes.

2.8 Children's Privacy

Fotoflo is not intended for children under 13. We do not knowingly collect personal data from children under 13. If such data is identified, it will be deleted promptly.

2.9 Changes to This Policy

We may revise this policy from time to time. Material updates will be reflected on this page with an updated "Last Updated" date.

Section B — Privacy for Photographed Individuals

This section applies to individuals who are photographed by a photographer using Fotoflo.

3.1 Personal Data We Collect

Required Data

  • Photographs of you (image files, previews, and metadata)

Optional Data

(collected only if you complete the Contact Collection form)

  • Name
  • Email address
  • Phone number
  • Company

Providing optional data is voluntary.

3.2 How Your Data Is Used

Delivering Your Photos

Fotoflo enables the photographer to deliver your photos and manage galleries.

Use by the Client (Event Organizer or Commissioning Company)

If your photo session was arranged by a third-party company or event organizer ("Client"), optional data you provide may be shared with the Client.

The Client may use your data for:

  • Event follow-up
  • Business communication
  • Sales or marketing activities (in compliance with GDPR)

By submitting your contact details, you consent to this sharing.

3.3 Who Has Access to Your Data

Your data may be processed by:

  1. The photographer, who manages your photo session
  2. The Client, if you submitted optional contact details
  3. The Fotoflo platform, which stores your information using third-party infrastructure
    • Your data is stored securely in Supabase, Fotoflo's managed database and storage provider
    • These providers do not use or access your data for their own purposes

3.4 Data Retention

  • Photos are stored as long as the photographer keeps the gallery active
  • Optional contact data is kept until the photographer or Client deletes it
  • You may request deletion at any time

3.5 Your Rights Under GDPR

You have the right to:

  • Access your personal data
  • Request correction or deletion
  • Restrict or object to processing
  • Withdraw your consent at any time

All requests must be directed to the photographer, who is the data controller.

3.6 Why Contact From the Client Cannot Be Reversed

If you provide your contact details:

  • The photographer may share them with the Client
  • The Client may contact you
  • Fotoflo and the photographer are not responsible for communications sent by the Client

To stop receiving messages, you must contact the Client directly.

3.7 Data Controller

For photographed individuals, the photographer or the commissioning company acts as the data controller. Fotoflo acts solely as a data processor, providing the technical platform for data storage and delivery.

4. Contact Information

If you have questions about this Privacy Policy or our practices, please contact:

Email: info@fotoflo.co
Website: https://fotoflo.co

For GDPR-related requests from photographed individuals, please contact your photographer directly, using the contact details provided at your photo session.