Privacy Policy

This Privacy Policy explains how Spindlers ("Spindlers," "we," "us," or "our") collects, uses, discloses, and otherwise handles personal information in connection with Photonfolio, including our websites, hosted galleries, accounts, uploads, and related services (the "Service"). It applies to photographers and other account holders, gallery viewers, people who contact us, and people who sign up for product updates.

1. Scope and Roles

Photonfolio is a hosted photography platform. In many cases, the photographer or studio using Photonfolio decides what content to upload, what galleries to publish, whether downloads are enabled, and whether metadata such as EXIF or map information is displayed. That means the account holder remains responsible for the legality of the content they upload and for providing any notices or obtaining any consents required for clients, guests, or other individuals whose information appears in that content.

This Policy describes our own handling of information as the operator of the Service. It does not govern third-party sites, apps, payment processors, storage providers, or other services that may be linked from or integrated with Photonfolio.

2. Personal Information We Collect

Information you give us directly

• Account and profile data such as your email address, password hash, first and last name, and optional studio profile details like business name, bio, website URL, logo, brand color, and album defaults.
• Billing and plan data such as subscription tier, billing status, Stripe customer and subscription references, and related entitlement records. We do not store full payment card numbers; payment details are handled by our payment processors.
• Contact and support data such as your email address, message contents, optional phone number, subject line, and any information you choose to include when you contact us. Support submissions may also generate internal alerts, including provider-routed text or email notifications, where we have configured them.
• Product update signup data such as your email address and the Photonfolio update list you joined.

Media, metadata, and related content

• Uploaded media such as photos, RAW files, thumbnails, previews, placeholders, branding assets, and associated filenames and sizes.
• Embedded and extracted metadata such as EXIF data, camera make and model, lens model, shutter speed, aperture, focal length, ISO, date taken, dimensions, hashes for duplicate detection, and GPS latitude, longitude, and altitude where present.
• Generated and moderation data such as AI-generated titles, captions, and descriptions, moderation results, moderation categories and scores, and processing status records.

Usage, device, network, and security data

• Request and device data such as IP address, browser, browser version, operating system, device type, domain, requested path, query parameters, request headers, referrer, whether the request was secure, and whether it appeared suspicious.
• Gallery interaction data such as photo view counts, share-link access counts, and the time a private share link was last accessed.
• Geolocation and abuse-prevention data such as IP geolocation records, device/browser fingerprints, and optional browser-fingerprint identifiers if our anti-abuse tooling is enabled.
• Error, performance, and diagnostic data such as technical event data, device and request context, account identifiers, and other information reasonably needed to monitor performance, troubleshoot failures, and secure the Service.
• Product analytics and session replay data such as pages visited, buttons clicked, account and product context, visible gallery or workspace media, filenames, titles, slugs, snippets of entered text, and other on-screen activity that helps us understand how Photonfolio is used and where workflows fail.

Cookies and similar technologies

We use cookies and similar technologies for account login, session management, CSRF protection, fraud prevention, security, and service operation. We may also use anti-bot technologies such as Cloudflare Turnstile, which may process technical and challenge-related data when forms are submitted.

3. How We Collect Information

We collect information directly from you, from your browser or device when you use the Service, from your uploaded files and their metadata, from payment or infrastructure providers, from automated moderation and analysis tools, and from other parties when they interact with your public or shared galleries.

4. How We Use Information

We use personal information where reasonably necessary to operate and protect the Service, including to:

• create and administer accounts and authenticate users;
• host, store, process, display, search, share, and deliver galleries and media;
• extract metadata, create thumbnails and previews, and produce gallery and sharing assets;
• generate AI-assisted titles, captions, and descriptions and run automated moderation or safety review;
• show or suppress EXIF, location, map, download, and sharing features based on user settings and system controls;
• manage subscriptions, billing, customer records, and entitlements;
• send service, security, billing, support, and account communications;
• respond to inquiries, support requests, legal demands, and rights complaints;
• detect, investigate, prevent, and respond to abuse, fraud, scraping, infringement, prohibited-media complaints, suspected non-consensual intimate imagery, suspected sexual exploitation, policy violations, suspicious requests, and security incidents;
• measure usage, diagnose issues, maintain logs, improve reliability, and develop or refine product features; and
• comply with law, enforce our Terms of Service, and protect our users, business, and service providers.

5. How We Disclose Information

We may disclose personal information in the following circumstances:

• To people you authorize or expose data to through the Service. For example, when an account holder publishes a gallery, shares a link, enables downloads, or enables EXIF or map display, viewers and recipients may see or receive the information the account holder chose to expose.
• To service providers and infrastructure vendors. Our current stack may involve providers such as Cloudflare (including media delivery, Turnstile, AI Gateway routing, and Workers AI moderation), Stripe, Sentry, PostHog, OpenAI for default AI-generated text, and other hosting, storage, communications, analytics, support, or AI vendors we use from time to time.
• Within corporate transactions. We may disclose information in connection with an actual or proposed financing, merger, acquisition, restructuring, sale of assets, or similar transaction.
• For legal, safety, and enforcement reasons. We may disclose information if we believe it is necessary to comply with law, respond to lawful requests, enforce our terms, investigate misconduct, protect rights or property, or reduce harm.

We do not currently use your uploaded media for third-party advertising. We do not intentionally disclose personal information to others in exchange for money. If our practices change in a way that requires additional disclosures or rights mechanisms, we will update this Policy.

6. Galleries, Share Links, Downloads, Metadata, and AI

Photonfolio lets account holders decide whether galleries are public, available through a private share link, downloadable, or displayed with EXIF and map information. Private galleries are currently link-based, not viewer-account-based. That means anyone who obtains a valid share link, forwarded URL, download link, or accessible file URL may be able to access or redistribute the related content.

If uploaded files contain embedded metadata, including location data, we may extract and store that metadata. If a gallery owner enables EXIF or map features, some of that information may be shown to viewers. If a gallery owner enables downloads, viewers may receive copies of the media. AI-assisted description and moderation features may involve sending processed media or derivatives to third-party model providers.

7. International and Cross-Border Processing

We and our service providers may process, store, or access personal information outside your province, territory, or country, including in the United States and other jurisdictions where privacy and disclosure laws may differ from those in your home jurisdiction. Personal information transferred across borders may be subject to lawful access by courts, regulators, or law enforcement in those jurisdictions.

8. Retention

We retain information for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, maintain accounts and galleries, complete transactions, keep logs and backups, investigate abuse, enforce agreements, comply with legal obligations, resolve disputes, and preserve records relevant to actual or anticipated claims. Different categories of information may be retained for different periods. Deletion from the live Service may not immediately remove information from logs, caches, backups, derived assets, or other systems.

9. Security

We use administrative, technical, and organizational measures that we believe are reasonable for the nature of the information we handle, such as access controls, transport encryption, monitoring, and logging. No method of transmission, storage, or internet-based service is completely secure. We do not guarantee that the Service will be immune from unauthorized access, misuse, interception, loss, or breach.

10. Your Choices and Rights

Depending on applicable law, you may have rights to access, correct, update, delete, withdraw consent for certain processing, request portability, or complain to a regulator. We may ask for information reasonably necessary to verify your identity and authority before acting on a request. We may deny or limit requests where permitted by law, including where rights do not apply, exemptions exist, or we cannot verify the request.

You can change some account and profile information through the Service. Other requests, including account closure, deletion requests, marketing opt-out requests, or privacy complaints, should be sent through our contact page. If you signed up for product updates, you may ask us to stop those messages by contacting us or by using any unsubscribe mechanism included in the message, if available. We may still send non-marketing service, legal, billing, or security notices where permitted by law.

Signed-in account holders can opt out of Photonfolio product analytics and session replay in workspace settings. The opt-out applies to signed-in workspace activity for that account and syncs to the current browser after the setting is saved. It does not remove operational logs, security records, billing records, support records, or analytics collected from anonymous visitors before they sign in.

If you are a resident of a U.S. state with an applicable privacy law, you may have additional rights, subject to statutory thresholds, exceptions, and verification requirements. We will evaluate requests in light of the law that applies to the particular request.

11. Children and Sensitive Content

The Service is not directed to children as account holders. We do not knowingly invite children to create Photonfolio accounts. Because the Service may host family, event, school, client, or other sensitive imagery, uploaded media may include children, intimate content, or other sensitive subject matter. The uploader, not Spindlers, is responsible for ensuring that any required consents, notices, permissions, releases, or legal bases exist for collecting, uploading, sharing, and displaying that material. We may process, review, preserve, disclose, remove, or restrict access to sensitive media where reasonably necessary for abuse prevention, rights enforcement, legal compliance, or application of our Terms of Service.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we do, we will post the revised version here and update the effective date above. Your continued use of the Service after the revised Policy takes effect means you accept the updated Policy to the extent permitted by law.

13. Contact Us

For privacy questions, rights requests, or complaints, contact us.