Privacy Policy

Who we are

Fotoloft is a booking and photo-delivery service for photographers, available at fotoloft.app and operated from Bosnia and Herzegovina. In this policy “we”, “us” and “the Fotoloft team” mean the operator of Fotoloft.

Write to info@fotoloft.app about anything on this page, including any request about your data. We answer in English, Bosnian, Croatian and Serbian.

Two kinds of people use Fotoloft

This decides who is responsible for what, so it comes first.

Photographers and their team members hold accounts with us. For account, billing and support data we are the controller, and this policy governs it directly.
Their clients book sessions, receive gallery links, view, favourite, comment on and download photographs. For that data, and for the photographs themselves, the photographer is the controller and we process it on their behalf as a processor, under our Data Processing Agreement. If you are a client, the studio that photographed you decides what happens to your data. Ask them first; we will help them act on it.

What we collect

Your account. Your name and email address. If you set a password we store only an Argon2 hash of it, never the password itself.

Google sign-in, if you use it. We ask Google for openid, email and profile, and nothing more. From those we receive your Google account identifier, your email address and whether Google has verified it, and your display name. We do not request or receive access to Gmail, Drive, Calendar, Contacts, Photos or any other Google service, and we hold no Google credentials of yours. It is used to create your account and sign you in, nothing else. You can disconnect it at any time at Google’s permissions page.

Your studio. Business name, your public address on the site, time zone, language, biography, logo and cover, contact links, the photoshoot types you offer with their prices, locations and example photos, and your working hours.

Team members. If you invite people to your studio, their name and email address, and the studio data they can then see and change.

Bookings and clients. The name, email address, phone number and notes a client gives when booking, the time and photoshoot type they chose, and any client details you enter yourself. If you turn on calendar invites, the invite carries the client’s name and email address.

Galleries and the people you send them to. The email address and, if given, the name of each person a gallery is shared with, and when they first opened it. While a client uses a gallery we record which photos were viewed and downloaded and when, which photos they marked as favourites, and any comments they leave with an optional name. Your studio sees these, which is what they are for. We do not store visitors’ IP addresses.

Photographs. The files you upload, and the smaller versions we generate from them. Originals are kept exactly as uploaded, including whatever metadata the camera wrote, which can include the date, the exposure settings and sometimes GPS coordinates. What we show in galleries and on booking pages never carries the location or personal details (such as an owner’s name or a camera’s serial number); it may show the camera, lens, exposure settings and when the photo was taken. A small photo with none of the former may be shown as uploaded. We copy a few non-location details (camera, lens, exposure) into our database to show them in your studio.

Messages to us. What you send through the contact form (your email address, a title and the message) and our replies.

Security records. Each sign-in creates a session record with an IP address and the browser’s user-agent string. Sign-in attempts are recorded with the email address and IP address, which is how the limit that blocks password guessing works.

Payments. Taken by our payment provider, Lemon Squeezy, who acts as merchant of record. We never see or store your full card number. We keep your plan, its status and renewal dates, the provider’s customer and subscription identifiers, the card brand and last four digits shown in your account, and the provider’s notifications about your subscription, which include your name and email address.

Why we process it, and on what legal basis

To provide the service you signed up for: your account, booking page, calendar, galleries, storage, team and exports. Legal basis: performance of a contract.
To send the email the service depends on: verification codes, password resets, booking confirmations, changes and reminders, gallery invitations, export links, team invitations, billing and storage notices. Legal basis: performance of a contract.
To answer you when you write to us. Legal basis: our legitimate interest in supporting our users, or steps you asked for before a contract.
To keep accounts and the service secure: session and sign-in records, rate limits, and investigating misuse. Legal basis: our legitimate interest in the security of the service and of your data.
To take payment and keep the records that go with it. Legal basis: performance of a contract, and legal obligation for anything tax or accounting law requires us to retain.
To meet legal obligations, such as answering a lawful order or acting on a report of illegal content. Legal basis: legal obligation.

What we never do

We do not sell personal data, or share it for advertising, to anyone.
We do not show advertising, and we do not track you across other websites.
We do not use your photographs or your clients’ data to train machine-learning models, and we do not run face recognition.
We do not use your photographs to promote Fotoloft without your permission.
We do not send newsletters or marketing email. Every email we send is about your account, your bookings or your galleries.

Only the services needed to run the product, each given the minimum it needs. They process data on our instructions under their own data-processing terms, except where noted.

Hetzner: our servers and database. Germany.
Cloudflare: storage of uploads in progress and of the smaller versions of photos (R2), and fast delivery of photos and downloads through its global network.
Backblaze (B2): storage of full-size originals, from a day after upload. Our storage region is in the EU (Amsterdam, Netherlands).
Resend: sends our email, including messages to your clients, which go out in your studio’s name with replies going to you. United States.
Lemon Squeezy: takes payment as merchant of record and handles the tax that goes with it. It receives your email address at checkout and acts as an independent controller of payment data under its own privacy policy. United States.
Google: only if you choose to sign in with Google, as described above. In addition, galleries and the gallery editor load the typefaces a studio chooses from Google Fonts, so your browser connects to Google’s servers, which see its IP address.

Some of these providers are established, or process data, outside the European Economic Area. Where that happens, transfers rely on an adequacy decision (for example the EU-U.S. Data Privacy Framework, where the provider is certified) or on the European Commission’s standard contractual clauses.

Within a studio, the photographer and the team members they invite see the studio’s bookings, clients and galleries. Our own administrators can see account-level information (studio and owner names, email addresses, plan and usage) to run the service; they do not browse your photographs or your clients’ data, and administrative actions are logged.

Beyond this, we disclose personal data only where the law requires it of us, for example to answer a binding order from a court or authority.

Cookies and browser storage

Fotoloft runs no analytics, advertising or third-party tracking. It uses only the cookies and browser storage needed for features you use, which is why you are not asked for consent.

Cookies:

session: keeps you signed in. It holds a random token, not your identity, and lasts up to thirty days from your last visit.
fotoloft_locale: remembers the language you chose, for up to a year.
fotoloft_first_steps_hidden: remembers, in your studio, that you hid the getting-started steps.
g_state, g_verifier, g_nonce, g_next: set only while a Google sign-in is in progress, to tie the trip to Google to the browser that started it. They last ten minutes and are deleted when you come back.

Browser storage (kept on your device, not sent to us unless stated): in a gallery, a random identifier for your browser, sent with your favourites so that they stay yours, and the name you type for comments during a visit; in your studio, display choices such as how lists are sorted and where the upload panel sits.

How long we keep it

Account and studio data: for as long as the account exists.
Photographs and galleries: until you or your team delete them. A gallery given an expiry date is deleted, with its photos, on that date.
Download archives and full exports: available for seven days, then deleted.
Uploads that never finish: removed after a day.
Storage over your plan’s limit: handled as set out in the Terms, which can end in the oldest galleries being deleted after 30 days, with notice by email.
Accounts that are disabled: the files are deleted 15 days after access ends.
Security records: for as long as needed to protect the account and the service.
Messages you send us: the contact form emails them straight to our mailbox and keeps no copy in the service. In the mailbox we keep them as long as needed to deal with them and keep a record of what we agreed. Ask and we will delete them.
Payment records: as long as tax and accounting law requires.

You can delete your account yourself, under Account → Delete your account. It happens straight away: your studio, its galleries, photographs and bookings, and the account itself are deleted from our storage, and your clients’ links stop working. If you have a subscription that will renew, cancel it first. A team member who deletes their account removes only that account; what they made stays with the studio. We keep payment records only as long as tax and accounting law requires. Before you delete it, take a full export: Account → Request full export gives you every original at full size, and it is free on every plan.

Your rights

We give everyone the rights of the EU General Data Protection Regulation, wherever you live. Where your local law gives you more, you have that too. You can ask us to:

tell you what we hold about you, and give you a copy
correct something inaccurate
delete your data
give you your data in a portable form
restrict a particular use, or object to a use based on our legitimate interest

Write to info@fotoloft.app and we will answer within a month. We may ask you to confirm your identity first. If you are a photographer’s client, ask that studio: they decide what happens to your data, and we help them act on it.

You can also complain to a data protection authority, for example the one in the country where you live or work. In Bosnia and Herzegovina that is the Personal Data Protection Agency (azlp.ba). We would be grateful for the chance to put things right first.

Security

Account passwords and gallery passwords are hashed with Argon2. We could not tell you a password if we wanted to.
Session tokens, password-reset links, verification codes and invitations are stored only as hashes.
Everything travels over HTTPS.
Storage is private. Originals are handed out only through links that expire within minutes; the smaller viewing versions are served through long, unguessable addresses.
Gallery links are unguessable, and can be given an expiry date and a password.
Sign-in attempts are rate-limited, and administrative access is limited and logged.

If a breach affects personal data, we will tell the photographers affected without undue delay, so they can meet their own obligations, and notify the authorities where the law requires it. No system is perfect, and we would rather say so than promise otherwise: keep your own copies of work you cannot afford to lose.

Children

Fotoloft is a tool for professionals. Accounts are for people aged 16 or over, and we do not knowingly collect personal data from children. Photographing children is ordinary work for many studios: where a photographer uploads photographs of a child, it is for that photographer to have the consent of whoever holds parental responsibility.

Changes to this policy

If this policy changes in a way that matters, we will email account holders before the change takes effect, rather than quietly moving the date at the top of the page.