1. Who we are and our responsibilities
PhotoUpload is operated by SJC Designs Online Ltd, registered in England and Wales, company number 10809959, at 102 Andover Road, Ludgershall, Andover, Wiltshire, SP11 9NA, United Kingdom. Contact privacy@photoupload.app for privacy matters or support@photoupload.app for service enquiries.
This policy covers our website, personal galleries (a Guest Upload Gallery for your own event, managed with your order email and the gallery’s access code) and Business accounts, which run Guest Upload Galleries and Client Galleries (delivery and proofing) in Studio, our business dashboard. It applies to customers, team members, guests, clients and people pictured.
We are the controller for our own account administration, billing, support, security, fraud prevention, content reports, moderation and legal obligations, and for our public website.
For business galleries, the business is normally the controller and we are its processor (or sub-processor, where the business acts for someone else). Our Data Processing Addendum governs that processing, and the business should give you its own privacy information. Branding or a custom domain does not change these roles.
For personal galleries, someone sharing their own wedding, birthday or family event within their personal circle may be covered by the household exemption, depending on actual use. We act as controller for providing personal gallery hosting and sharing (see section 3).
Owning an image and being responsible for personal data in it are different things. We do not assume every uploader owns an image or is its controller.
2. Information we process and its sources
Depending on the features used, we process:
- Account details: names, email addresses, business and contact details, sign-in details (a password, or your name, email address and account identifier if you sign in with Google), two-step sign-in settings, team members and permissions, branding, custom-domain and preference settings.
- Gallery content: photos, videos and audio, including slideshow music; filenames, captions and embedded metadata; and the copies, previews and watermarked proofs we make. We remove location data and camera or lens serial numbers from uploaded photos and videos, and keep the capture date and time and copyright and credit details.
- Gallery activity: guest names entered when uploading, likes, categories, proofing picks and notes, publication status, which uploads came from the business or its team, client email recipients and reply-to addresses, gallery settings and dates, and gallery insights such as opens, visits by QR code or link, likes, picks and downloads. Likes are separate from proofing picks and are not consent to marketing.
- Live screen: the controller link, paired screens and display settings. Guests’ names, captions and likes may be shown on screen if the Host chooses.
- Purchases and billing: billing contact and address details, orders, subscription dates, storage usage, invoices, credits, payment status and amounts owed. Our payment provider processes card details; we never see or store full card numbers or security codes.
- Communications: support requests, messages sent through a gallery’s contact form, privacy requests, complaints and related correspondence.
- Reports and moderation: the reported item, reason and details given, an optional contact email, relevant technical activity, decisions, moderation history and necessary evidence.
- Technical information: IP addresses, browser details, security and access logs, and records of upload and download requests (time, items and, where known, the account or team member). An IP address or download request does not by itself identify a person or prove a download completed. Error records have email addresses and access tokens stripped, but may be linked to the signed-in account so we can tell affected customers.
- Connected services: the connection details needed for Google Drive or OneDrive backup and for guest or client exports, kept encrypted and only while needed.
- Website analytics: if you allow Google Analytics on our main website, page views, referring pages, approximate location and browser or device information. It is not used on galleries or upload pages.
Information comes from you, from Hosts and guests, from your use of the Service, and from our payment provider, and from Google or Microsoft where you use them. Photos can include children and may reveal sensitive information; an ordinary photo is not automatically biometric data. If you do not give information needed for a purchase or feature, we may not be able to provide it.
3. Purposes and lawful bases
Where we are controller, our purposes and lawful bases are:
| Purpose | Basis |
|---|---|
| Provide a purchase, subscription, personal gallery or support to the person we contract with | Contract, or steps you ask for before entering one |
| Provide personal gallery sharing for guests and people pictured, and administer business contacts and team members who are not parties to our contract | Legitimate interests in providing the service requested and running the business relationship |
| Measure storage, calculate bills, take payments and manage overdue amounts | Contract with the customer; legitimate interests for business contacts; legal obligation for accounting records |
| Protect the Service, check uploads for malware, investigate reports and errors, moderate misuse, preserve evidence and deal with legal claims | Legitimate interests in security, preventing abuse and protecting legal rights; legal obligation where a specific duty applies |
| Respond to privacy requests and other legal requirements | Legal obligation |
| Send optional marketing | Consent, which you can withdraw at any time |
| Measure visits to our main website with Google Analytics | Consent. Analytics stays off unless you allow it, and you can change your choice on the Cookie Notice page. |
Service emails, including gallery and billing messages, do not depend on marketing consent. A Host’s purchase does not let us market to their guests, and client email addresses entered by a business are used only for that gallery’s emails. Accepting our Terms or sharing a gallery is not consent to marketing and does not establish consent from everyone pictured.
Where an investigation involves special-category information or alleged offences, we also meet the extra legal conditions required and limit collection and access. A report is an allegation, not a finding.
These bases do not apply to a business’s own processing: the business decides its purposes and lawful basis, and we follow its lawful instructions under the DPA. We do not use business gallery data for our own advertising or AI-model training.
4. Who receives information
Gallery visitors. Galleries are private and unlisted, but anyone with the link or QR code (and PIN, if one is set) can open them, and the Host decides who receives them. Categories organise Content; they do not make it private. Copies people download or export are outside our control. In a business Guest Upload Gallery, the business’s own uploads stay hidden from visitors until it publishes them.
Hosts and team members can see gallery activity and insights within their permissions. A gallery’s contact form sends what you enter to the Host. Content reports come to PhotoUpload, not the Host, and we do not routinely tell the uploader or Host who reported.
Evidence and authorities. Authorised PhotoUpload staff may use restricted, encrypted evidence packages (relevant files, an integrity inventory, reports, moderation history and upload and download records) to investigate an incident. We may disclose relevant information where the law requires or where a lawful, necessary disclosure protects rights or deals with misuse, after checking the recipient’s authority and limiting what is shared.
Service providers. We use carefully chosen providers for the purposes below, each only as needed and under data-protection terms. We don’t sell personal information or share it for advertising.
| Purpose | What they do and what they receive |
|---|---|
| Hosting and storage | Run the website, databases, sessions, gallery files and their copies, malware scanning and operational records. |
| Network and security | Route traffic for our domains and businesses’ custom domains and protect the Service, processing connection data and the requests and Content passing through. |
| Deliver account, gallery, client and billing emails, including emails sent in a business’s name, and host our support correspondence. | |
| Payments | Process payments, subscriptions, invoices and card details. We keep transaction references, invoice information and payment status. |
| Accounts and bookkeeping | Hold our sales records (names, email addresses and amounts paid) so we can keep accounts as the law requires. |
| Google sign-in (if you choose it) | Lets Studio users sign in with a Google account; Google shares your name, email address and account identifier with us. |
| Google Drive and Microsoft OneDrive (if you choose them) | Receive the files and connection details needed when a business turns on backup or a guest or client saves files to their own account. We only ask for access to files we create there. |
| Website analytics (only if you accept) | Google Analytics measures visits to our main website. It never runs on galleries or upload pages, and advertising features are off. |
Contact privacy@photoupload.app if you’d like the names of our providers in a particular category.
A backup or export destination is chosen by the person connecting it, and its own terms apply to copies stored there. Disconnecting it or deleting a gallery here does not delete copies already sent.
5. International processing
Our providers may process information, or allow support access, in the UK, the European Economic Area, the United States and other countries where they operate. Our application and media storage are configured to run in the European Economic Area, but a storage location does not mean all network or support access stays there.
Where a restricted transfer takes place, we rely on an adequacy regulation or appropriate safeguards, such as approved contractual clauses with the UK Addendum where required. Contact privacy@photoupload.app for details of the safeguards relevant to your information or a copy of them. Exports to Google Drive or OneDrive follow the destination’s own arrangements.
6. How long information is kept
Galleries close, move to Recently deleted and are then permanently deleted.
| Information or event | Retention and deletion |
|---|---|
| Personal galleries | Open for one month from the event date on the free Snapshot plan, or up to three months on paid plans, plus any one-month extension. After the latest closing date the plan allows, the gallery moves to Recently deleted. |
| Business galleries | Follow the dates the business sets, then stay closed for the period it chooses (up to 60 days) before moving to Recently deleted. A Client Gallery that has not been shared closes after 60 days without a change or upload. If a trial ends without a subscription, galleries close for 7 days. |
| Cancellation and failed payment | Cancelling does not delete anything straight away; galleries move to Recently deleted when the subscription ends. Galleries suspended for non-payment are unavailable but not deleted; if the subscription ends unpaid, they move to Recently deleted. |
| Recently deleted | 30 days, during which the gallery can be restored (for business galleries, subject to the conditions in our Terms). The first time anyone uses Message the host while a gallery is in Recently deleted, it is kept for 30 more days; later messages do not add more time. Afterwards Content is permanently deleted. |
| Single files and unpicked proofing photos | Deleting a single file is permanent straight away. Unpicked (unselected) proofing photos are kept until the gallery is deleted unless the business chooses to delete them, which is permanent straight away. |
| Likes, picks, unpublished uploads and insights | Kept and deleted with the gallery, unless limited records must be kept for a separately justified purpose. |
| Accounts | Kept until you ask us to close the account; we do not close accounts just for inactivity. On closure we remove operational account information and Content, keeping only what we must for legal, accounting or dispute purposes, then delete or anonymise it. |
| Billing and accounting records | Generally six years from the end of the relevant financial year, or longer where required. Detailed usage and debt records are kept only while needed to support charges, collect amounts owed or resolve disputes. |
| Storage activity and business gallery audit records | Deleted after 24 months. |
| IP addresses in upload, download and report records | Removed after 90 days, unless an active preservation hold applies to the account. Holds are justified, reviewed and released when no longer needed. |
| Reports, moderation records and evidence | Kept as long as needed to investigate, deal with challenges, meet legal duties or deal with legal claims, which may be longer than the gallery. Generated evidence packages expire after 24 hours. |
| Disconnected custom domains | The link between the domain and the account is kept for 12 months to reserve the domain to that account. |
| Error records | Deleted 90 days after the error was last seen. |
| Browser details and email delivery records | Browser details in access records are removed after 90 days. Records of emails we sent are deleted after 12 months. |
| Enquiries | Deleted 24 months after the enquiry was last updated, unless still open. |
| Service notifications and trusted devices | Copies of service notifications we send are cleared after 90 days. A device you trust during two-step sign-in is remembered for 30 days. |
| Disaster-recovery backups | Database backups are taken daily and kept for 6 days, with a weekly copy kept for one month, all with restricted access. If we ever restore from a backup, we delete again anything that was deleted after it was taken. Backups do not extend Recently deleted. |
| Support, connections and marketing | Support correspondence is kept while needed for the enquiry or a related dispute or legal duty; connection details until no longer needed; marketing records while we have a valid basis, plus minimal details to respect an opt-out. |
A business’s verified return or deletion instruction under the DPA takes priority over these periods, subject to legal retention, and does not depend on paying for a new subscription.
7. Your rights and how to request help
Depending on the law and the basis of processing, you may have rights to access, correct or erase your personal information, restrict or object to its use, and receive information you gave us in a portable format. These rights have conditions and exceptions. A subject access request covers your personal data, which may be in a photo; a photo’s commercial value or copyright is not by itself a reason to withhold it. We handle valid requests regardless of unpaid bills or download restrictions.
You can object to processing based on legitimate interests, and to direct marketing at any time. Where we rely on consent, you can withdraw it without affecting earlier processing.
Contact privacy@photoupload.app. We may ask for proportionate information to confirm your identity or authority. For business galleries, contact the business or us, and we will pass your request on and help the business under the DPA.
To complain about how we use personal information, email privacy@photoupload.app or write to our postal address. We will acknowledge your complaint within 30 days, investigate without undue delay, keep you informed and tell you the outcome. You can also complain to the Information Commissioner’s Office or another competent regulator.
8. Security, cookies and automated processing
We use measures appropriate to the risks, including HTTPS, access checks on private media, malware scanning, optional two-step sign-in and encryption of recorded IP addresses and connection details. No service can guarantee absolute security.
We use essential cookies for sign-in, security, gallery PINs and downloads, and browser storage for features you use, such as remembering your name when uploading. If you like an image, a random identifier is stored for up to one year. Google Analytics runs on our main website only if you allow it. Our Cookie Notice gives details and lets you change your choices. We do not use cookies for advertising.
We automatically measure storage, calculate bills and apply the trial, storage and payment restrictions in our Terms using recorded storage, payment status and dates. Where a decision based solely on automated processing has a legal or similarly significant effect on you, you can ask for an explanation, make representations, contest it and ask for human review by contacting support@photoupload.app. You can also use that address to ask us to check a bill or restriction you think is wrong.
9. Changes and contact
We will keep this policy in line with how we process information and tell you about material changes where appropriate.
Privacy: privacy@photoupload.app. Service support: support@photoupload.app. Postal address: SJC Designs Online Ltd, 102 Andover Road, Ludgershall, Andover, Wiltshire, SP11 9NA, United Kingdom.