Privacy Policy

PhotoCloud.art ("PhotoCloud", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website and services.

By accessing or using PhotoCloud, you consent to the practices described in this Privacy Policy. If you do not agree with these practices, please do not use our services.

1. Information We Collect

Account Information

When you create an account, we collect:

• Your name (first and last)
• Email address
• Company or studio name (if provided)
• Your chosen PhotoCloud address (account name)

Content You Upload

We store photographs and other image files that you upload to your galleries. These files are stored solely for the purpose of providing our service to you and your clients.

Automatically Collected Information

When you use PhotoCloud, we may automatically collect:

• IP address and approximate geographic location
• Browser type and version, device type, and operating system
• Pages visited, features used, and time spent on the platform
• Referral sources and search terms used to find our site

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our services
• Create and manage your account
• Process transactions and send related billing information
• Send service-related communications (e.g., email verification, password resets, security alerts)
• Improve our platform, develop new features, and analyze usage patterns
• Respond to your comments, questions, and support requests

3. How We Share Your Information

We may share your information in the following limited circumstances:

• Service Providers: We work with third-party service providers (e.g., cloud hosting via Cloudflare R2, analytics via Google Analytics and Microsoft Clarity, payment processing via Stripe, Inc., and transactional email via SendPulse) who need access to your information to perform services on our behalf. These providers are contractually obligated to protect your data and act only on our instructions. See Section 4 for details about payment processing.
• Legal Requirements: We may disclose your information if required to do so by law or in response to valid legal processes such as a court order or subpoena.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

4. Payment Processing and Stripe

Payments for paid PhotoCloud plans are processed by Stripe, Inc. ("Stripe"), a payment service provider based in the United States with data centers worldwide. Stripe acts as an independent data controller for payment-card data and as our sub-processor for subscription metadata. Stripe's own privacy practices are described at https://stripe.com/privacy.

What we never store

PhotoCloud does not store, process, or have access to your full credit or debit card number, the CVC security code, or any bank account details. These are collected and handled directly by Stripe on a Stripe-hosted Checkout page. Your card details never touch our servers.

What Stripe receives from us

When you start a checkout, we send the following information to Stripe so it can process your payment and link it to your PhotoCloud account:

• Your email address
• Your PhotoCloud user identifier (as customer metadata, so webhook events can be routed back to the correct account)
• The plan and billing interval you selected (e.g., Starter monthly, Pro yearly)

What we receive from Stripe

When Stripe confirms or updates a subscription, we receive and store:

• Stripe customer identifier and subscription identifier
• Current plan, billing interval, subscription status, and period-end date
• Whether the subscription is scheduled to cancel at period end
• Card brand and the last four digits of the card (for display in your billing settings, if surfaced)

We do not receive or store your full payment-card number, expiry, CVC, postal code, or authentication tokens from Stripe.

What Stripe collects directly from you

When you complete payment on the Stripe-hosted Checkout page, Stripe collects — directly from you, under its own privacy policy — your payment-card details, your billing address, your IP address and device information (for fraud prevention), and any additional authentication data required by your issuer (e.g., 3D Secure). Stripe may also use this data to improve its fraud-detection services, as described in Stripe's privacy policy.

Lawful basis: payment data is processed to perform the subscription contract between you and PhotoCloud (GDPR Art. 6(1)(b)) and to comply with our legal and tax obligations (GDPR Art. 6(1)(c)).

5. Data Storage and Security

Your data, including uploaded photographs, is stored on encrypted cloud infrastructure. We implement industry-standard security measures including encryption in transit (TLS) and at rest, access controls, and regular security assessments.

While we strive to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention obligations.
• Portability: Request a copy of your data in a structured, machine-readable format.
• Objection: Object to certain processing of your personal data, including direct marketing.

To exercise any of these rights, please contact us at support@photocloud.art. We will respond to your request within 30 days.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain certain information for legal, accounting, or regulatory purposes. Uploaded photographs are deleted from our servers when you remove them from your galleries or close your account.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country. Where we transfer your data internationally, we ensure appropriate safeguards are in place, including standard contractual clauses or equivalent mechanisms approved by relevant data protection authorities.

9. Children's Privacy

PhotoCloud is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will take steps to delete such information promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of any material changes by posting the updated policy on our website and updating the "Last updated" date. Your continued use of PhotoCloud after such changes constitutes your acceptance of the updated policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

support@photocloud.art