Privacy Policy

This policy explains what data delivered.photos ("we", "us") collects from photographers using the service, and from clients viewing galleries shared with them. We try to keep this in plain language. If anything is unclear, email [email protected].

Who we are

delivered.photos is a client proofing platform for photographers. When a photographer creates an account and uploads photos for a client, the photographer is the data controller for their clients' personal data. We are the data processor — we host and serve galleries on their behalf.

What we collect

From photographers:

• Account email, name, and an authentication credential.
• Studio name, optional logo, and brand colors you configure.
• Photos you upload, gallery metadata (titles, client names, slugs), and gallery settings (passwords, expirations, download toggles).
• Billing information processed by our payment provider — we don't store full card numbers ourselves.

From gallery clients:

• Favorites and comments you submit on photos. These are visible to the photographer who shared the gallery with you.
• If the photographer set a gallery password, the password you enter (verified against a hash, never stored in plain text).
• Standard request logs (IP address, user agent, timestamps) for security and abuse prevention.

How we use it

• To provide the service: storing galleries, delivering photos to clients, processing client selections.
• To bill paying photographers and prevent abuse of free accounts.
• To send transactional emails (account verification, gallery activity notifications you opt into).
• To understand product usage at an aggregate level (anonymized analytics).

We don't sell personal data and we don't use it to train AI models.

Legal basis (GDPR)

• Contract — for the parts strictly necessary to provide the paid or free service you signed up for.
• Legitimate interest — for security logs, abuse prevention, and aggregate analytics.
• Consent — for optional analytics cookies, where applicable.

Sub-processors

We rely on a small set of vendors to operate the service. Each one processes data on our behalf under written agreements:

• Convex — application database and serverless backend (US/EU).
• Vercel — web hosting and edge analytics.
• Dodo Payments — subscription billing.
• AhaSend — transactional email delivery.
• Google Analytics — anonymized usage analytics, only loaded if configured.

Cookies

We use a small number of cookies and similar storage for: keeping you signed in, remembering your interval preference on the pricing page, and analytics. No advertising cookies, no cross-site tracking.

How long we keep data

• Account data: for as long as your account is active. Delete your account and we delete it.
• Galleries and photos: until you delete them, or 90 days after account deletion as a safety window.
• Billing records: 7 years where required for tax and accounting law.
• Security logs: 30 days, then deleted or aggregated.

Your rights

Wherever you live, you can email [email protected] to access, correct, export, or delete your data. EU/UK residents have full GDPR rights; California residents have CCPA rights, including the right to know and the right to delete. We'll respond within 30 days.

If you are a gallery client and want your selections removed, contact the photographer who shared the gallery first. We'll help directly if they're unreachable.

International transfers

Some of our sub-processors are based in the United States. When data leaves the EEA we rely on the EU Standard Contractual Clauses (or an adequacy decision where one applies).

Children

delivered.photos is not directed at children under 16. Photographers using the service to deliver photographs that include children are responsible for obtaining parental consent for the shoot, the delivery, and any client-side selection workflow.

Changes

When we update this policy in a way that materially affects how we use your data, we'll email account holders before the change takes effect. The latest version always lives at this URL with an effective date at the top.

Contact

Privacy questions: [email protected].