Privacy Policy

1. Information We Collect

We collect information you provide directly, information generated through your use of the Service, and information from third-party integrations.

Account Information

When you create an account or place an order, we collect:

• Full name
• Email address
• Password (hashed; never stored in plain text)
• Billing and shipping address

Photos and Media

Studios upload photos taken at events. Buyers may access galleries and download purchased photos. We store these images securely using Amazon Web Services S3 (see Third-Party Services below).

Purchase Information

When you make a purchase, we collect order details including the products selected, price, and transaction identifiers. Payment processing is handled entirely by Stripe — we do not store full credit card numbers or CVV codes on our servers.

Usage Data

We automatically collect information about how you interact with the Service, including IP address, browser type, device identifiers, pages visited, and actions taken. This data is used to operate, improve, and secure the Service.

2. How We Use Your Information

We use the information we collect to:

• Deliver your order — fulfill photo purchases, send download links, and ship physical prints.
• Manage your account — create and maintain your studio or buyer account, authenticate you, and provide customer support.
• Process payments — charge for purchases and issue refunds via Stripe.
• Send transactional emails — order confirmations, gallery-ready notifications, receipts, and password reset messages via Amazon SES.
• Operate and improve the Service — diagnose bugs, analyze usage patterns, and develop new features.
• Comply with legal obligations — respond to lawful requests from public authorities and meet applicable legal requirements.

We do not sell your personal information to third parties.

3. Third-Party Services

Picfolio uses a small set of trusted third-party service providers to operate the platform. Each provider is subject to their own privacy policies and data processing agreements.

Amazon Web Services (AWS S3)

Photos and other media files are stored on Amazon S3, a cloud storage service operated by Amazon Web Services, Inc. Files are stored in encrypted buckets with access restricted to authenticated requests. AWS Privacy Policy: aws.amazon.com/privacy.

Amazon SES

Transactional emails (order confirmations, gallery notifications, password resets) are delivered via Amazon Simple Email Service (SES). We share your email address and relevant order details with SES solely for email delivery.

Stripe

All payment processing is handled by Stripe, Inc. When you enter payment information, it is transmitted directly to Stripe using industry-standard TLS encryption. Picfolio receives a token and transaction identifiers but does not receive or store your raw card data. Stripe Privacy Policy: stripe.com/privacy.

Analytics — Microsoft Clarity

We use Microsoft Clarity, a behavioral analytics service operated by Microsoft Corporation, to understand how visitors interact with the Service through heatmaps and session replays. Clarity captures interaction data such as clicks, taps, scrolling, mouse movement, pages visited, referring pages, and technical information about your device, browser, and approximate location (derived from IP address). Clarity sets first-party cookies (such as _clck and _clsk) to recognize a browser across a visit.

We configure Clarity with safeguards specific to our Service:

• Photos are never recorded. Gallery, checkout, and preview images — including photos of minors — are masked on your device before any session data leaves your browser. Replays and heatmaps show placeholder boxes, not the images.
• Access links are never recorded. Pages whose addresses carry gallery access codes, download grants, sign-in links, or payment identifiers are excluded from recording entirely.
• No advertising use by us. We use this data solely to improve usability, diagnose problems, and secure the Service. We do not use it for advertising, and we do not sell it.

Interaction data is processed by Microsoft on our behalf and handled in accordance with the Microsoft Privacy Statement: privacy.microsoft.com/privacystatement. Session replays are retained by Clarity for a limited period (currently up to 30 days); aggregated statistics are retained longer. You can block analytics cookies in your browser without affecting your ability to use the Service (see Cookies and Tracking below).

Vercel (hosting and aggregate analytics)

The Service's web application is hosted by Vercel Inc., which processes requests (including IP addresses) as a hosting provider. We also use Vercel Web Analytics, a cookie-less service that records aggregate page-view metrics. Page addresses containing access codes or download grants are redacted in your browser before any analytics event is sent. Vercel Privacy Policy: vercel.com/legal/privacy-policy.

4. Data Retention and Deletion

Photos

Studio-uploaded photos are retained for the duration of the associated event gallery, as configured by the studio. Galleries may be set to expire automatically after a defined period. After expiration, photos are permanently deleted from our storage systems within 30 days.

Account Data

Account information is retained for as long as your account is active. If you close your account, we will delete or anonymize your personal data within 90 days, except where we are required to retain it for legal, tax, or fraud-prevention purposes.

Order Records

Purchase records and transaction logs are retained for a minimum of 7 years to comply with financial record-keeping regulations.

Requesting Deletion

You may request deletion of your personal data at any time by contacting us at privacy@picfolio.co. We will respond within 30 days.

5. Data Security

We implement industry-standard technical and organizational measures to protect your information, including TLS encryption in transit, AES-256 encryption at rest for stored media, role-based access controls, and regular security reviews. No system is perfectly secure; if you believe your account has been compromised, please contact us immediately.

6. Children's Privacy

The Picfolio Service is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. Account registration requires users to be at least 13 years old.

While studios may photograph minors as part of school or event picture days, such photos are uploaded and managed by the studio operator (an adult business entity) and accessed by parents or guardians who have created accounts on the platform. Picfolio acts as a data processor for the studio in those cases.

If you believe we have inadvertently collected personal information from a child under 13, please contact us at privacy@picfolio.co and we will delete it promptly.

7. Your Rights and Choices

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your personal data
• Object to or restrict certain processing activities
• Data portability (receive your data in a machine-readable format)

To exercise any of these rights, contact us at privacy@picfolio.co. We will respond within 30 days.

8. Cookies and Tracking

We use two kinds of cookies. Essential cookies operate the Service itself (for example, keeping you signed in); the Service does not function without them. Analytics cookies are first-party cookies set by Microsoft Clarity (see Third-Party Services above) to understand how the Service is used. We do not use advertising cookies, and we do not sell or share analytics data for advertising purposes.

You may block or delete cookies in your browser settings. Blocking analytics cookies does not affect your ability to use the Service; blocking essential cookies may prevent features such as sign-in from working.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" at the top of this page and, for material changes, notify you by email or a prominent notice on the Service. Continued use of the Service after any changes constitutes your acceptance of the revised policy.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, please reach out: